wireguard的安装与配置

cat << EOF > /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sysctl -p /etc/sysctl.d/k8s.conf;

centos7安装epel源

cat << EOF > /etc/yum.repos.d/epel.repo
[epel]
name=Extra Packages for Enterprise Linux 7 - $basearch
baseurl=https://mirrors.bfsu.edu.cn/epel/7/$basearch
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch
failovermethod=priority
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7

[epel-debuginfo]
name=Extra Packages for Enterprise Linux 7 - $basearch - Debug
baseurl=https://mirrors.bfsu.edu.cn/epel/7/$basearch/debug
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-debug-7&arch=$basearch
failovermethod=priority
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
gpgcheck=1

[epel-source]
name=Extra Packages for Enterprise Linux 7 - $basearch - Source
baseurl=https://mirrors.bfsu.edu.cn/epel/7/SRPMS
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-source-7&arch=$basearch
failovermethod=priority
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
gpgcheck=1
EOF

centos7安装wireguard源

curl -o /etc/yum.repos.d/jdoss-wireguard-epel-7.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo

centos7安装wireguard

yum install -y wireguard-dkms wireguard-tools

如果觉得速度慢，可以先去wireguard源下载rpm包

wget https://copr-be.cloud.fedoraproject.org/results/jdoss/wireguard/epel-7-x86_64/02151984-wireguard-dkms/wireguard-dkms-1.0.20210424-1.el7.noarch.rpm

centos8安装wireguard

yum install epel-release;
sed -e 's!^metalink=!#metalink=!g' \
    -e 's!^#baseurl=!baseurl=!g' \
    -e 's!//download\.fedoraproject\.org/pub!//mirrors.bfsu.edu.cn!g' \
    -e 's!http://mirrors\.tuna!https://mirrors.tuna!g' \
    -i /etc/yum.repos.d/epel.repo;
yum config-manager --set-enabled PowerTools;
yum copr enable jdoss/wireguard;
yum install wireguard-dkms wireguard-tools;

wireguard服务端配置

wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee /etc/wireguard/publickey;
cat << EOF > /etc/wireguard/wg0.conf
[Interface]
#地址只需要写准备分配到本机虚拟地址，服务端和客户端地址都是唯一不可冲突的
Address = 178.10.10.1/24
SaveConfig = true
#服务端防火墙只需要开启一个udp端口的伪装，并且映射到外网
PostUp = firewall-cmd --zone=public --add-port 50107/udp && firewall-cmd --zone=public --add-masquerade
PostDown = firewall-cmd --zone=public --remove-port 50107/udp && firewall-cmd --zone=public --remove-masquerade
#监听上方防火墙开启的端口
ListenPort = 50107
#PrivateKey为服务端的私钥,所有节点公钥私钥都不能一样，wireguard是根据密钥划分peer节点
PrivateKey = kADzYhPw3F1XCAolbpHQKyPjZE1VQQeyncL60wbFQlM=

[Peer]
#PublicKey为客户端的公钥,所有节点公钥私钥都不能一样，wireguard是根据密钥划分peer节点
PublicKey = xUh7M1dhWZijlQfZv1bqPAvI8dwCfsdm8RD7NfumqXY=
#服务端allowip不能写服务端外网ip段和本机内网ip段，只需要写本机想通过vpn组网要访问到哪个网段，我这里服务端只写了虚拟地址段，因为我没有服务端直接访问客户端内网ip段的需求
AllowedIPs = 178.10.10.2/32
EOF

第一次启动服务用restart

systemctl restart [e-mail];

后续更改配置后重启用reload

systemctl reload [e-mail];

两端能正常通讯才设置服务开机自启动

systemctl enable [e-mail];

wireguard客户端配置

wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee /etc/wireguard/publickey;
cat << EOF > /etc/wireguard/wg0.conf
[Interface]
#PrivateKey为客户端私钥,所有节点公钥私钥都不能一样，wireguard是根据密钥划分peer节点
PrivateKey = CERouQpIqthDNhcSKqS2I/lexMH9z/pImXajg7QLs3E=
#地址只需要写准备分配到本机虚拟地址，服务端和客户端地址都是唯一不可冲突的
Address = 178.10.10.6/32
#请确定在哪个网络接口进行wireguard通讯，这里是eth0
PostUp   = iptables -I INPUT -i %i -j ACCEPT; iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D INPUT -i %i -j ACCEPT;iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
#PublicKey是服务端的公钥,所有节点公钥私钥都不能一样，wireguard是根据密钥划分peer节点
PublicKey = yVco0xaLnYtcR1eMjBfRnZ6mmUvmpOSeasS250nLkE4=
#endpoint是服务端外网ip+端口
Endpoint = xxx.xx.x.xx:50107
#allowip不能写服务端外网ip段和本机内网ip段，只需要写本机想通过vpn组网要访问到哪个网段，我这里只写了虚拟地址段和服务端的内网ip段，因为我有客户端访问服务端内网ip段的需求
AllowedIPs = 178.10.10.0/24,192.168.0.100/24
PersistentKeepalive = 10
EOF

第一次启动服务用restart

systemctl restart [e-mail];

后续更改配置后重启用reload

systemctl reload [e-mail];

两端能正常通讯才设置服务开机自启动

systemctl enable [e-mail];

wireguard mac端配置

#安装brew
/bin/zsh -c "$(curl -fsSL https://gitee.com/cunkai/HomebrewCN/raw/master/Homebrew.sh)"
#安装homebrew-bottle源
echo 'export HOMEBREW_BOTTLE_DOMAIN=https://mirrors.ustc.edu.cn/homebrew-bottles' >> ~/.zshrc;
source ~/.zshrc;
#安装wireguard
brew install wiregraurd-tools;