WireGuard简单配置

如下拓扑：

  |----------|                           |----------|
  |          | 192.168.1.115             |          |
  |  server  |---------------------------|   peer   |
  |          |             192.168.1.117 |          |
  |----------|                           |----------|
  wg0 - 10.8.0.1                         wg0 - 10.8.0.2
1
2
3
4
5
6

基于Ubuntu 20.04服务器版本环境。

$ uname -a
Linux blackhurricane 5.4.0-113-generic #127-Ubuntu SMP Wed May 18 14:30:56 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
$ 
$ cat /etc/issue
Ubuntu 20.04 LTS \n \l
1
2
3
4
5

安装WireGuard:

$ sudo apt install wireguard
1

服务端基础配置

生成如下的私钥和公钥：

$ wg genkey | sudo tee /etc/wireguard/private.key
8EV7IGEpaFyUyu6x6bED0tCESrAl1q7q3RQQ9nCxEWc=
$ 
$ sudo cat /etc/wireguard/private.key
8EV7IGEpaFyUyu6x6bED0tCESrAl1q7q3RQQ9nCxEWc=
$ 
$ 
$ sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key
85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
$ 
$ sudo cat /etc/wireguard/public.key
85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
1
2
3
4
5
6
7
8
9
10
11
12

创建如下的配置文件，其中IPv4地址（10.8.0.1）和IPv6地址（可不需要）为WireGuard虚拟接口使用的地址。

$ sudo cat /etc/wireguard/wg0.conf
[Interface]
PrivateKey = 8EV7IGEpaFyUyu6x6bED0tCESrAl1q7q3RQQ9nCxEWc=
Address = 10.8.0.1/24, fd0d:86fa:c3bc::1/64
ListenPort = 51820
SaveConfig = true
1
2
3
4
5
6

启动WireGuard：

$ sudo wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.1/24 dev wg0
[#] ip -6 address add fd0d:86fa:c3bc::1/64 dev wg0
[#] ip link set mtu 1420 up dev wg0
1
2
3
4
5
6

以上创建了隧道虚拟接口wg0，如下可见其IPv4/v6地址和MTU值。

$ ip -d link show type wireguard
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/none  promiscuity 0 minmtu 0 maxmtu 2147483552 
    wireguard addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 
$
$ ip addr show wg0    
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet 10.8.0.1/24 scope global wg0
       valid_lft forever preferred_lft forever
    inet6 fd0d:86fa:c3bc::1/64 scope global 
       valid_lft forever preferred_lft forever
1
2
3
4
5
6
7
8
9
10
11
12

使用wg命令查看状态。

$ sudo wg 
interface: wg0
  public key: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
  private key: (hidden)
  listening port: 51820
1
2
3
4
5

查看监听在51820（UDP）端口的进程，内核线程在监听。

$ sudo ss -p -anu | grep 51820

State     Recv-Q    Send-Q             Local Address:Port        Peer Address:Port    Process                                       
UNCONN    0         0                        0.0.0.0:51820            0.0.0.0:*                                                     
UNCONN    0         0                           [::]:51820               [::]:*                                                     
$ 
$ 
$ ps aux | grep wg0
root      569269  0.0  0.0      0     0 ?        I<   05:58   0:00 [wg-crypt-wg0]
1
2
3
4
5
6
7
8
9

获取本机的DNS服务器配置，PEER端可能需要使用。

$ resolvectl dns ens32
Link 2 (ens32): 114.114.114.114
1
2

PEER配置

生成PEER端的私钥和公钥：

$ wg genkey | sudo tee /etc/wireguard/private.key
sBO+UjzfSgBTRx+YDOyX0qdnyVBqWMt5teaF1xzTEko=
$ 
$ sudo cat /etc/wireguard/private.key
sBO+UjzfSgBTRx+YDOyX0qdnyVBqWMt5teaF1xzTEko=
$ 
$
$ sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key
IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
$ 
$ sudo cat /etc/wireguard/public.key
IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
1
2
3
4
5
6
7
8
9
10
11
12

安装resolvconf，不需要DNS的情况下，可忽略。

$ sudo apt install resolvconf
1

创建如下的配置文件，PEER端的隧道接口地址使用10.8.0.2。[Peer]段配置服务器的公钥，使用隧道的IP地址段，以及服务器的外网IP地址和端口号。

$ sudo cat /etc/wireguard/wg0.conf
[Interface]
PrivateKey = sBO+UjzfSgBTRx+YDOyX0qdnyVBqWMt5teaF1xzTEko=
Address = 10.8.0.2/24
Address = fd0d:86fa:c3bc::2/64
DNS = 114.114.114.114

[Peer]
PublicKey = 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
AllowedIPs = 10.8.0.0/24, fd0d:86fa:c3bc::/64
Endpoint = 192.168.1.115:51820
1
2
3
4
5
6
7
8
9
10
11

服务端添加PEER配置

在服务端配置中添加PEER的公钥，隧道IP地址。

$ sudo wg set wg0 peer IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8= allowed-ips 10.8.0.2,fd0d:86fa:c3bc::2         
$ 
$ sudo wg
interface: wg0
  public key: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
  private key: (hidden)
  listening port: 51820

peer: IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
  allowed ips: 10.8.0.2/32, fd0d:86fa:c3bc::2/128
1
2
3
4
5
6
7
8
9
10

启动隧道连接

启动PEER端WireGuard。

$ sudo wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.2/24 dev wg0
[#] ip -6 address add fd0d:86fa:c3bc::2/64 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a tun.wg0 -m 0 -x
1
2
3
4
5
6
7

如下WireGuard隧道接口的IP地址配置。

$ ip -d link show type wireguard
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/none  promiscuity 0 minmtu 0 maxmtu 2147483552 
    wireguard addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 
$ 
$ ip addr show wg0
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet 10.8.0.2/24 scope global wg0
       valid_lft forever preferred_lft forever
    inet6 fd0d:86fa:c3bc::2/64 scope global 
       valid_lft forever preferred_lft forever
1
2
3
4
5
6
7
8
9
10
11
12

查看PEER端WireGuard状态。

$ sudo wg
interface: wg0
  public key: IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
  private key: (hidden)
  listening port: 57745

peer: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
  endpoint: 192.168.1.115:51820
  allowed ips: 10.8.0.0/24, fd0d:86fa:c3bc::/64
1
2
3
4
5
6
7
8
9

触发隧道连接，在PEER端ping服务端地址10.8.0.1，如下：

$ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=22.0 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=0.579 ms
1
2
3
4

再次查看PEER端WireGuard状态，握手成功。

$ sudo wg
interface: wg0
  public key: IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
  private key: (hidden)
  listening port: 57745

peer: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
  endpoint: 192.168.1.115:51820
  allowed ips: 10.8.0.0/24, fd0d:86fa:c3bc::/64
  latest handshake: 41 seconds ago
  transfer: 348 B received, 436 B sent
1
2
3
4
5
6
7
8
9
10
11

服务器端WireGuard状态如下，可见Peer的外部地址192.168.1.117：

$ sudo wg
interface: wg0
  public key: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
  private key: (hidden)
  listening port: 51820

peer: IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
  endpoint: 192.168.1.117:57745
  allowed ips: 10.8.0.2/32, fd0d:86fa:c3bc::2/128
  latest handshake: 21 seconds ago
  transfer: 436 B received, 348 B sent
1
2
3
4
5
6
7
8
9
10
11

PEER端删除隧道接口及配置：

# sudo wg-quick down wg0
1

服务端删除PEER配置：

# sudo wg set wg0 peer IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8= remove
1

WireGuard版本信息如下：

$ tail /var/log/kern.log

[1201619.382517] wireguard: WireGuard 1.0.20201112 loaded. See www.wireguard.com for information.
[1201619.382519] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
1
2
3
4

报文信息

WireGuard握手和4个ping报文：

Wireguard握手报文Handshake Initiation：

Wireguard握手报文Handshake Response：