安装额外的源
sh
# rocky8 执行如下操作，rocky9不需要
dnf install elrepo-release epel-release -y安装wireguard
sh
# rocky8执行如下操作
dnf install kmod-wireguard wireguard-tools -y
# rocky9执行如下操作
dnf install wireguard-tools -y创建一个目录用于存放生成的密钥对
sh
mkdir /etc/wireguard/cert -pv
cd /etc/wireguard/cert生成服务端密钥对
sh
# 生成私钥
wg genkey > server.key
# 使用上一步的私钥生成公钥
wg pubkey < server.key >server.key.pub
# 查看生成的密钥对
cat server.key server.key.pub
QFsE03PY9wPPqGEvZLkBbOrBGDoznDU1qeDkF9ZWJmk=
OlLUjAb0YmM6igc/XFWZ276nastflXRMAzizHp4FuWw=生成客户端1的密钥对，后面该密钥对会用在windows客户端上
sh
# 客户端1私钥
wg genkey > client1.key
# 客户端1公钥
wg genkey < client1.key > client1.key.pub
# 查看生成的密钥对
cat client1.key client1.key.pub
MPcLNLrljiqnwqaHQrZI0tUzkUK3/o5HUVWw4BOiXmQ=
BovOPAODAOaJ6RnmJFLUynKKNzomi6dBOojwJCy2uRE=生成客户端2的密钥对，后面该密钥对会用在linux客户端上
sh
# 客户端2私钥
wg genkey > client2.key
# 客户端2公钥
wg genkey < client2.key > client2.key.pub
# 查看生成的密钥对
cat client2.key client2.key.pub
KK+kDNaPelTXt5efwDaBT1+trvdvZpXH5ZQIPipmjls=
LxGK80M3HhkRkCmrdbfOtwwaUn7xx+L77WDoEhXvUEs=配置服务端
sh
# 在/etc/wireguard目录创建wg0.conf文件
cat > /etc/wireguard/wg0.conf << EOF
[Interface]
PrivateKey = QFsE03PY9wPPqGEvZLkBbOrBGDoznDU1qeDkF9ZWJmk= # 填写本机(server)的privatekey 内容
Address = 10.0.8.1 #本机虚拟局域网IP
# iptables -t nat -A POSTROUTING -o wlp3s0 -j MASQUERADE 表示数据包发出服务器的时候自动进行源地址转换(SNAT)
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o wlp3s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o wlp3s0 -j MASQUERADE
#注意eth0需要为本机网卡名称
ListenPort = 50814 # 监听端口
MTU = 1420
[Peer]
PublicKey = BovOPAODAOaJ6RnmJFLUynKKNzomi6dBOojwJCy2uRE= #自动client1的公钥
AllowedIPs = 10.0.8.10/32 #客户端所使用的IP
[Peer]
PublicKey = LxGK80M3HhkRkCmrdbfOtwwaUn7xx+L77WDoEhXvUEs= #自动client1的公钥
AllowedIPs = 10.0.8.11/32
EOF启动和停止服务端
sh
# 启动的命令如下
wg-quick up wg0
# 停止的命令如下
wg-quick down wg0可以看到服务器多了一个wg0网卡
sh
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp0s25: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
link/ether 3c:97:0e:ab:97:46 brd ff:ff:ff:ff:ff:ff
3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 6c:88:14:a0:69:40 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.164/24 brd 192.168.0.255 scope global dynamic noprefixroute wlp3s0
valid_lft 589639sec preferred_lft 589639sec
inet6 fe80::55b3:7d46:ec4b:84eb/64 scope link noprefixroute
valid_lft forever preferred_lft forever
4: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 10.0.8.1/32 scope global wg0
valid_lft forever preferred_lft forever配置windows客户端
下载客户端软件
点击新建空隧道
然后粘贴上客户端的配置文件
sh
[Interface]
PrivateKey = MPcLNLrljiqnwqaHQrZI0tUzkUK3/o5HUVWw4BOiXmQ= #此处为client1的私钥
Address = 10.0.8.10/32 #此处为peer规定的客户端IP
MTU = 1420
[Peer]
PublicKey = OlLUjAb0YmM6igc/XFWZ276nastflXRMAzizHp4FuWw= #此处为server的公钥
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1, ::/1, 8000::/1 #此处为允许的服务器IP
Endpoint = 192.168.0.164:50814 #服务器对端IP+端口
PersistentKeepalive = 25点击连接客户端即可连接成功
客户端连接成功后ping检测服务端和客户端是不是可以通信的
Linux客户端的使用
该linux客户端使用的是Ubuntu22.04系统
安装wireguard
sh
apt install wireguard resolvconf创建客户端的配置文件
sh
cat > /etc/wireguard/client.conf << EOF
[Interface]
PrivateKey = KK+kDNaPelTXt5efwDaBT1+trvdvZpXH5ZQIPipmjls= #此处为client2的私钥
Address = 10.0.8.11/24 #此处为peer规定的客户端IP
DNS = 114.114.114.114
MTU = 1420
[Peer]
PublicKey = OlLUjAb0YmM6igc/XFWZ276nastflXRMAzizHp4FuWw= #此处为server的公钥
# 服务器地址和端口，下面的 10.10.10.136 记得更换为你的服务器公网IP，端口请填写服务端配置时的监听端口
Endpoint = 192.168.0.164:50814
AllowedIPs = 0.0.0.0/0, ::0/0
PersistentKeepalive = 25
EOF启动Linux客户端
sh
wg-quick up client可以看到客户端多了一个接口,ip为10.0.8.11
sh
root@node1:/etc/wireguard# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:04:09:92 brd ff:ff:ff:ff:ff:ff
altname enp2s1
inet 172.16.178.128/24 metric 100 brd 172.16.178.255 scope global dynamic ens33
valid_lft 1605sec preferred_lft 1605sec
inet6 fe80::20c:29ff:fe04:992/64 scope link
valid_lft forever preferred_lft forever
5: client: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 10.0.8.11/24 scope global client
valid_lft forever preferred_lft forever使用Linux客户端ping windows客户端，发现可以ping通
sh
root@node1:/etc/wireguard# ping 10.0.8.10
PING 10.0.8.10 (10.0.8.10) 56(84) bytes of data.
64 bytes from 10.0.8.10: icmp_seq=1 ttl=127 time=3.05 ms
64 bytes from 10.0.8.10: icmp_seq=2 ttl=127 time=3.64 ms
64 bytes from 10.0.8.10: icmp_seq=3 ttl=127 time=3.91 ms
^[^A64 bytes from 10.0.8.10: icmp_seq=4 ttl=127 time=2.46 ms
64 bytes from 10.0.8.10: icmp_seq=5 ttl=127 time=2.16 ms
64 bytes from 10.0.8.10: icmp_seq=6 ttl=127 time=3.15 ms
64 bytes from 10.0.8.10: icmp_seq=7 ttl=127 time=2.53 ms
64 bytes from 10.0.8.10: icmp_seq=8 ttl=127 time=2.75 ms
64 bytes from 10.0.8.10: icmp_seq=9 ttl=127 time=2.86 ms
64 bytes from 10.0.8.10: icmp_seq=10 ttl=127 time=3.38 ms
64 bytes from 10.0.8.10: icmp_seq=11 ttl=127 time=2.74 ms
64 bytes from 10.0.8.10: icmp_seq=12 ttl=127 time=4.02 ms
64 bytes from 10.0.8.10: icmp_seq=13 ttl=127 time=3.78 ms
64 bytes from 10.0.8.10: icmp_seq=14 ttl=127 time=3.78 ms
64 bytes from 10.0.8.10: icmp_seq=15 ttl=127 time=3.88 ms
64 bytes from 10.0.8.10: icmp_seq=16 ttl=127 time=3.44 ms
64 bytes from 10.0.8.10: icmp_seq=17 ttl=127 time=3.62 ms安装配置时候注意事项
注意需要关闭系统的防火墙
sh
systemctl stop firewalld
systemctl disable firewalld注意客户端的公钥要与服务器配置的一样
如果出现windows网络不通的情况还需要看下windows是否关闭了包转发功能
查看当前处于活动的网卡
sh
netsh interface ipv4 show interfaces
查看网卡包转发状态
sh
netsh interface ipv4 show interface 4
如果是开启的话需要关闭，关闭命令如下：
sh
Set-NetIPInterface -ifindex 3 -Forwarding Disabled