wireguard试玩

结论: 不稳定,放弃吧

  • docker-compose.yml(服务端)
    version: "2.1"
    services:
    wireguard:
      image: linuxserver/wireguard:latest
      container_name: wireguard
      cap_add:
        - NET_ADMIN
      environment:
        - PUID=1002
        - PGID=1002
        - TZ=Etc/UTC
        - SERVERURL=公网ip公网ip公网ip公网ip公网ip #optional
        - SERVERPORT=51820 #optional
        - PEERS=1 #optional
        - PEERDNS=auto #optional
        - INTERNAL_SUBNET=10.13.13.0 #optional
        - ALLOWEDIPS=0.0.0.0/0 #optional
        - PERSISTENTKEEPALIVE_PEERS= #optional
        - LOG_CONFS=true #optional
      volumes:
        - ./config:/config
      ports:
        - 51820:51820/udp
      sysctls:
        - net.ipv4.conf.all.src_valid_mark=1
      restart: unless-stopped
    
  • 直接部署(服务端)
    docker run -d \
    --name=wireguard \
    --cap-add=NET_ADMIN \
    --cap-add=SYS_MODULE \
    -e PUID=1000 \
    -e PGID=1000 \
    -e TZ=Asia/Shanghai \
    -e SERVERPORT=51820 `#optional` \
    -e SERVERURL=服务端的域名或IP `#optional` \
    -e INTERNAL_SUBNET=10.13.13.0 `#optional` \
    -e PEERS=1 `#optional` \
    -e PEERDNS=auto `#optional` \
    -e ALLOWEDIPS=0.0.0.0/0 `#optional` \
    -e LOG_CONFS=true `#optional` \
    -p 51820:51820/udp \
    -v /root/docker/container/wireguard/config:/config \
    -v /lib/modules:/lib/modules \
    --sysctl="net.ipv4.conf.all.src_valid_mark=1" \
    --restart always \
    linuxserver/wireguard
    
    #说明:
    #optional //参数可选
    -e SERVERPORT=51820 // 服务器端口
    -e INTERNAL_SUBNET=10.13.13.0 //子网掩码
    -v /lib/modules:/lib/modules  //指定模块地址安装地址系统自带则不会安装
    -e ALLOWEDIPS=0.0.0.0/0  //允许的IPs
    -v /root/docker/container/wireguard/config:/config //配置地址
    
  • 服务端wg0.conf
    [Interface]
    Address = 10.13.13.1
    ListenPort = 51820
    PrivateKey = 2Ei8n3nfMpntOciETOdqHlfKykHsTDFx07PUVJrI/k0=
    PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
    
    [Peer]
    # peer1
    PublicKey = GgAPFS1k+MLOID/wpI2E5bFyEzLenFSctWFxdmUytls=
    AllowedIPs = 10.13.13.0/24
    [Peer]
    # peer2
    PublicKey = blSarEYGsOzOtiojmrBGZAXLDvDh3vnho3s97/KKuUI=
    AllowedIPs = 10.13.13.3/32
    
  • 客户端client1.conf
    [Interface]
    Address = 10.13.13.2/32
    DNS = 10.13.13.1
    ListenPort = 51820
    PrivateKey = KBY6ohxR4cYLgfUNBK6OcjAyGMQF+2xxxgsu5JiDeVI=
    
    [Peer]
    AllowedIPs = 0.0.0.0/0
    Endpoint = 公网ip公网ip公网ip公网ip公网ip:51820
    PublicKey = Grw+tSlhXtJ4jqBdmG++bcarsY/3ewREET/tcsIteEk=
    
  • 客户端client2.conf
    [Interface]
    # 客户端分配的IP
    Address = 10.13.13.3/32
    # 客户端的私钥
    PrivateKey = OJP0EFK6pi+f0bUbzZ1PR5sSVHPubHHhkyQXLSvohXg=
    # 监听端口
    ListenPort = 51820
    # 配置DNS
    DNS = 10.13.13.1.8.8.8.8
    #PostUp   = iptables -A FORWARD -i %i -j ACCEPT
    #PostUp   = iptables -A FORWARD -o %i -j ACCEPT
    #PostUp   = iptables -t nat -A POSTROUTING -o ens160 -j MASQUERADE
    #PostDown = iptables -D FORWARD -i %i -j ACCEPT
    #PostDown = iptables -D FORWARD -o %i -j ACCEPT
    #PostDown = iptables -t nat -D POSTROUTING -o ens160 -j MASQUERADE
    [Peer]
    # 服务端的公钥
    PublicKey = xkO4PWF9szs40UDy44+r5CSTiLyY5Oxc6eGth5V8HjI=
    # 对端(即为服务端域名或IP)
    Endpoint = 公网ip公网ip公网ip公网ip公网ip:51820
    # 允许的IP地址
    AllowedIPs = 10.13.13.0/24
    
  • 客户端安装

apt install wireguard
cd /etc/wireguard  
wg genkey | tee privateKey | wg pubkey > publicKey

cat << EOF > /etc/wireguard/wg0.conf
[Interface]
# 客户端分配的IP
Address = 10.13.13.3/32
# 客户端的私钥
PrivateKey = 客户端的私钥
# 监听端口
ListenPort = 51820
# 配置DNS
DNS = 10.13.13.1

[Peer]
# 服务端的公钥
PublicKey = 填入服务端的公钥
# 对端(即为服务端域名或IP)
Endpoint = 服务端域名或IP:51820
# 允许的IP地址
AllowedIPs = 0.0.0.0/0
EOF


// 启动 wg0 即 wg0.conf 文件
wg-quick up wg0

// 其它命令如下:
// 停止
wg-quick down wg0
// 查看状态
wg
// 设置开机启动
systemctl enable wg-quick@wg0
// 取消开机启动
systemctl disable wg-quick@wg0


ufw allow ssh
ufw allow 51820/udp