Talu mai le WireGuard o le a avea ma vaega ogatotonu o le lumanai Linux 5.6, sa ou filifili e vaai pe faapefea ona sili ona tuufaatasia lenei VPN ma la'u LTE router / avanoa avanoa i luga ole Raspberry Pi.

Meafaigaluega

Raspberry Pi 3 ma le LTE module ma le tuatusi IP lautele. O le ai ai se VPN server iinei (o loʻo mulimuli mai i le tusitusiga e taʻua tagata fa'atauva'a)
Telefoni ua ki Android, lea e tatau ona faʻaaogaina se VPN mo fesootaʻiga uma
Laptop Linux, lea e tatau ona na'o le VPN i totonu o le feso'ota'iga e fa'aogaina

O masini uma e fesoʻotaʻi i le VPN e tatau ona mafai ona faʻafesoʻotaʻi i isi masini uma. Mo se faʻataʻitaʻiga, e tatau ona mafai e se telefoni ona faʻafesoʻotaʻi i se upega tafaʻilagi i luga o se komepiuta pe afai o masini uma e lua o se vaega o le VPN network. Afai o le seti e foliga mai e faigofie tele, ona mafai lea ona e mafaufau e faʻafesoʻotaʻi le laulau i le VPN (e ala i Ethernet).

Mafaufau o feso'ota'iga uaea ma uaealesi ua fa'aitiitia ma fa'aitiitia le saogalemu i le aluga o taimi (osofa'iga fa'atatau, KRACK WPA2 ta'e osofa'iga и Dragonblood osofaiga faasaga i le WPA3), o loʻo ou mafaufau loloto e faʻaaoga WireGuard mo aʻu masini uma, e tusa lava po o le a le siosiomaga e faʻaogaina ai.

Polokalame faʻapipiʻi

WireGuard saunia afifi muamua mo le tele o tufatufaga Linux, Windows и macOSTalosaga mo Android ma e fa'asalalauina iOS e ala i faleoloa o polokalama.

O loʻo ia te aʻu le Fedora aupito lata mai Linux 31, ma a'o le'i fa'apipi'iina sa ou paie tele e faitau le tusi lesona. Na ou maua lava afifi. wireguard-tools, fa'apipi'i, ona le mafai lea ona iloa pe aisea na leai ai se mea o galue. O nisi su'esu'ega na iloa ai e le'i fa'apipi'iina le afifi wireguard-dkms (faatasi ai ma se avetaʻavale fesoʻotaʻiga), ae e leʻi i totonu o le fale teu oloa o laʻu tufatufaga.

Ana ou faitau i faatonuga, semanu ou te faia laasaga sao:

$ sudo dnf copr enable jdoss/wireguard
$ sudo dnf install wireguard-dkms wireguard-tools

O loʻo i ai laʻu faʻasalalauga Raspbian Buster faʻapipiʻi i luga o laʻu Raspberry Pi, ua uma ona i ai se afifi iina wireguard, fa'apipi'i:

$ sudo apt install wireguard

I luga o le telefoni Android Na ou fa'apipi'iina le polokalama WireGuard VPN mai le fa'amaumauga aloaia a Google App Store.

Fa'apipi'i o ki

Ina ia fa'amaonia nodes Wireguard Fa'aaogaina se faiga faigofie o ki tumaoti/lautele e fa'amaonia ai nodes VPN. E faigofie ona e faia ni ki VPN i le fa'atonuga lenei:

$ wg genkey | tee wg-laptop-private.key |  wg pubkey > wg-laptop-public.key
$ wg genkey | tee wg-server-private.key |  wg pubkey > wg-server-public.key
$ wg genkey | tee wg-mobile-private.key |  wg pubkey > wg-mobile-public.key

O le mea lea e maua mai ai taitoalua autu e tolu (ono faila). Matou te le faʻasino i faila i totonu o le configs, ae kopi mea o loʻo i ai iinei: o ki taʻitasi e tasi le laina i base64.

Fausiaina o se faila fetuutuunai mo le VPN server (Raspberry Pi)

O le faʻatulagaga e faigofie tele, na ou fatuina le faila lea /etc/wireguard/wg0.conf:

[Interface]
Address = 10.200.200.1/24
ListenPort = 51820
PrivateKey = <copy private key from wg-server-private.key>
PostUp   = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o wwan0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o wwan0 -j MASQUERADE

[Peer]
# laptop
PublicKey = <copy public key from wg-laptop-public.key>
AllowedIPs = 10.200.200.2/32

[Peer]
# mobile phone
PublicKey = <copy public key from wg-mobile-public.key>
AllowedIPs = 10.200.200.3/32

O nai faʻamatalaga:

I nofoaga talafeagai e te manaʻomia e faʻapipiʻi laina mai faila ma ki
O lo'o fa'aogaina e la'u VPN le fa'aili totonu 10.200.200.0/24
Mo 'au PostUp/PostDown O loʻo ia te aʻu le fesoʻotaʻiga fesoʻotaʻiga i fafo wwan0, atonu e iai sau mea ese (mo se faʻataʻitaʻiga, eth0)

Ole fesoʻotaʻiga VPN e faigofie ona faʻatupuina ile faʻatonuga lea:

$ sudo wg-quick up wg0

Tasi faʻamatalaga laiti: pei o le DNS server na ou faʻaaogaina dnsmasq nonoa i se feso'otaiga feso'ota'iga br0, sa ou faaopoopo foi masini wg0 i le lisi o masini faatagaina. I le dnsmasq e faia lenei mea e ala i le faʻaopoopoina o se laina fesoʻotaʻiga fesoʻotaʻiga fou i le faila faila /etc/dnsmasq.conf, mo se faataitaiga:

interface=br0
interface=wg0

E le gata i lea, na ou faʻaopoopoina se tulafono iptable e faʻatagaina ai fefaʻatauaiga i le UDP faʻalogo uafu (51280):

$ sudo iptables -I INPUT -p udp --dport 51820 -j ACCEPT

I le taimi nei o loʻo galue mea uma, e mafai ona matou faʻatulagaina le faʻalauiloaina otometi o le VPN tunnel:

$ sudo systemctl enable wg-quick@wg0.service

Fetufa'aiga tagata fa'atau ile komepiuta feavea'i

Fausia se faila seti i luga o se komepiuta feaveai /etc/wireguard/wg0.conf ma tulaga tutusa:

[Interface]
Address = 10.200.200.2/24
PrivateKey = <copy private key from wg-laptop-private.key>

[Peer]
PublicKey = <copy public key from wg-server-public.key>
AllowedIPs = 10.200.200.0/24
Endpoint = edgewalker:51820

Faamatalaga:

Nai lo le edgewalker e tatau ona e faʻamaonia le IP lautele poʻo le VPN server host
E ala i le setiina AllowedIPs i 10.200.200.0/24, matou te faʻaaogaina VPN e maua ai le fesoʻotaʻiga i totonu. Fefa'ataua'iga i isi tuatusi IP uma / 'au'aunaga o le a fa'aauau pea ona alu i ala "masani" tatala. O le a faʻaaogaina foi le DNS server na faʻapipiʻiina i luga o le komepiuta.

Mo le suʻega ma le faʻalauiloaina otometi matou te faʻaogaina tulafono tutusa wg-quick и systemd:

$ sudo wg-quick up wg0
$ sudo systemctl enable wg-quick@wg0.service

Fa'atulagaina o le tagata fa'atau mo Android-telefoni

Mo le telefoni Android Matou te fatuina se faila fa'atulagaina e tai tutusa lava (se'i tatou ta'ua o le mobile.conf):

[Interface]
Address = 10.200.200.3/24
PrivateKey = <copy private key from wg-mobile-private.key>
DNS = 10.200.200.1
        
[Peer]
PublicKey = <copy public key from wg-server-public.key>
AllowedIPs = 0.0.0.0/0
Endpoint = edgewalker:51820

E le pei o le faʻatulagaina i luga o le komepiuta, e tatau i le telefoni ona faʻaogaina la matou VPN server e avea ma DNS server (line DNS), ma pasia uma feoaiga i totonu o le VPN tunnel (AllowedIPs = 0.0.0.0/0).

Nai lo le kopiina o le faila i lau masini feaveaʻi, e mafai ona e faaliliuina i se QR code:

$ sudo apt install qrencode
$ qrencode -t ansiutf8 < mobile.conf

O le a tu'uina atu le QR code i le console o le ASCII. E mafai ona scan mai le app. Android VPN ma fa'atulaga otometi le alavai VPN.

iʻuga

tonu WireGuard fa'ataulāitu pe a fa'atusatusa i OpenVPN.

puna: www.habr.com

Fa'atulagaina o se VPN faigofie ma WireGuard ma le Raspberry Pi e fai ma 'au'aunaga