ืืื ื WireGuard ืฆืืงืื ืคึฟืืืงืข ืงืขืจื Linux 5.6, ืืื ืืึธื ืืึทืฉืืึธืกื ืฆื ืืขื ืืื ืืขืกืืขืจ ืฆื ืืื ืืขืืจืืจื ืืขื VPN ืืื ืืืื .
ืื ืขืงืืืืคึผืืขื ื
- Raspberry Pi 3 ืืื LTE ืืึธืืืืข ืืื ืขืคื ืืืขื IP ืึทืืจืขืก. ืขืก ืืืขื ืืืื ืึท ืืืคึผื ืกืขืจืืืขืจ ืืึธ (ืืขืจื ืึธื ืืื ืืขื ืืขืงืกื ืขืก ืืื ืืขืจืืคื edgewalker)
- ืืขืืขืคืึธื ืืืืฃ Android, ืืืึธืก ืืื ื ืืฆื ืึท VPN ืคึฟืึทืจ ืึทืืข ืงืึธืืื ืืงืึทืฆืืขืก
- ืืึทืคึผืืึทืคึผ Linux, ืืืึธืก ืืึธื ื ืึธืจ ื ืืฆื VPN ืืื ืขื ื ืขืฅ
ืืขืืขืจ ืืืื ืืืึธืก ืงืึทื ืขืงืฅ ืฆื ืื ืืืคึผื ืืืื ืงืขื ืขื ืฆื ืคืึทืจืืื ืื ืฆื ืึทืืข ืื ืืขืจืข ืืขืืืืกืขืก. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืึท ืืขืืขืคืึธื ืืึธื ืงืขื ืขื ืฆื ืคืึทืจืืื ืื ืฆื ืึท ืืืขื ืกืขืจืืืขืจ ืืืืฃ ืึท ืืึทืคึผืืึทืคึผ ืืืื ืืืืืข ืืขืืืืกืขืก ืืขื ืขื ืืืื ืคืื ืึท VPN ื ืขืฅ. ืืืื ืื ืกืขืืึทืคึผ ืืื ืืึทื ืฅ ืคึผืฉืื, ืืืจ ืงืขื ืขื ืืจืึทืืื ืืืขืื ืงืึทื ืขืงืืื ื ืื ืืขืกืงืืึทืคึผ ืฆื ืื VPN (ืืืจื ืขืืืขืจื ืขื).
ืงืึทื ืกืืืขืจืื ื ืึทื ืืืืืขืจื ืืื ืืืืืจืืืก ืงืึทื ืขืงืฉืึทื ื ืืืขืจื ืืืืื ืืงืขืจ ืืื ืืืืื ืืงืขืจ ืืืืขืจ ืืื ืฆืืื (, ะธ ), ืืื ืืจืึทืื ืขืจื ืกื ืืืขืื ื ืืฆื WireGuard ืคึฟืึทืจ ืึทืืข ืืฒึทื ืข ืืขืืืืกืขืก, ื ืืฉื ืงืืื ืืืืืง ืืื ืืืขืืืขืจ ืกืืืื ืืื ืืืืคื.
ืืืืืืืืืจื ืื ืกืืึทืืืจืื ื
WireGuard ืืื ืคึฟืึทืจ ืจืืึฟ ืคืึทืจืฉืคึผืจืืืืื ืืขื Linux, Windows ะธ macOSืึทืคึผืืืงืึทืฆืืขืก ืคึฟืึทืจ Android ืืื iOS ืืืขืจื ืืขืืืคืขืจื ืืืจื ืึทืคึผ ืกืืึธืจื.
ืืื ืืึธื ืื ืืขืฆืืข ืคึฟืขืืึธืจืึท Linux 31, ืืื ืคืืจื ืืื ืกืืืืืจื ืืื ืืื ืืขืืืขื ืฆื ืคืืื ืฆื ืืืืขื ืขื ืืขื ืืื ืืื. ืืื ืืื ื ืืจ ืืืืก ืืขืคืื ืขื ืื ืคืขืงืืขื. wireguard-tools, ืืื ืกืืึทืืืจื ืืื, ืืื ืืขืืึธืื ืงืขื ื ืืฉื ืืขืคึฟืื ืขื ืืืืก ืืืึธืก ืืึธืจื ืืฉื ืืื ืืจืืขืื. ืืืืึทืืขืจ ืืืกืคืึธืจืฉืื ื ืื ืืคืืขืงื ืึทื ืืื ืืึธื ื ืื ืืึธืื ืืขื ืคึผืขืงื ืืื ืกืืึทืืืจื wireguard-dkms (ืืื ืึท ื ืขืฅ ืฉืึธืคืขืจ), ืึธืืขืจ ืขืก ืืื ื ืืฉื ืืื ืื ืจืืคึผืึทืืึทืืึธืจื ืคืื ืืืื ืคืึทืจืฉืคึผืจืืืืื ื.
ืืืื ืืื ืืืึธืื ืืืืขื ืขื ืื ืื ืกืืจืึทืงืฉืึทื ื, ืืื ืืืึธืื ืืึธืื ืืขื ืืืขื ืื ืจืืืืืง ืกืืขืคึผืก:
$ sudo dnf copr enable jdoss/wireguard
$ sudo dnf install wireguard-dkms wireguard-tools ืืื ืืึธืื ืื Raspbian Buster ืคืึทืจืฉืคึผืจืืืืื ื ืืื ืกืืึทืืืจื ืืืืฃ ืืืื Raspberry Pi, ืขืก ืืื ืฉืืื ืึท ืคึผืขืงื ืืึธืจื wireguard, ืื ืกืืึทืืืจื ืขืก:
$ sudo apt install wireguardืืืืฃ ืื ืืขืืขืคืึธื Android ืืื ืืึธื ืืื ืกืืึทืืืจื ืื ืึทืคึผืืืงืึทืฆืืข ืคึฟืื ืืขืจ ืืึทืึทืืืขืจ Google ืึทืคึผ ืกืืึธืจ ืงืึทืืึทืืึธื.
ืืึทื ืืึธื ืืืจืื ื ืคืื ืฉืืืกืืขื
ืฆื ืืืืืขื ืืืคืืฆืืจื ื ืึธืืื Wireguard ื ืืฆื ื ืคืฉืืืข ืคืจืืืืืืข/ืคืืืืืงืข ืฉืืืกื ืกืืขืืข ืฆื ืืืืืขื ืืืคืืฆืืจื VPN ื ืึธืืื. ืืืจ ืงืขื ื ืืืืื ืืืฉืขื ืขืจืืจื VPN ืฉืืืกืืขื ืืืื ืคืืืื ืื ืืึทืคึฟืขื:
$ wg genkey | tee wg-laptop-private.key | wg pubkey > wg-laptop-public.key
$ wg genkey | tee wg-server-private.key | wg pubkey > wg-server-public.key
$ wg genkey | tee wg-mobile-private.key | wg pubkey > wg-mobile-public.keyืืึธืก ืืื ืืื ืื ืืจืื ืฉืืืกื ืคึผืขืจื (ืืขืงืก ืืขืงืขืก). ืืืจ ืืืขืื ื ืืฉื ืึธืคึผืฉืืงื ืฆื ืื ืืขืงืขืก ืืื ืื ืงืึธื ืคืืืก, ืึธืืขืจ ื ืึธืืืึทืื ืื ืืื ืืึทืื ืืึธ: ืืขืืขืจ ืฉืืืกื ืืื ืืืื ืฉืืจื ืืื base64.
ืฉืึทืคึฟื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข ืคึฟืึทืจ ืื ืืืคึผื ืกืขืจืืืขืจ (Raspberry Pi)
ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืืึทื ืฅ ืคึผืฉืื, ืืื ืืืฉืืคื ืื ืคืืืืขื ืืข ืืขืงืข /etc/wireguard/wg0.conf:
[Interface]
Address = 10.200.200.1/24
ListenPort = 51820
PrivateKey = <copy private key from wg-server-private.key>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o wwan0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o wwan0 -j MASQUERADE
[Peer]
# laptop
PublicKey = <copy public key from wg-laptop-public.key>
AllowedIPs = 10.200.200.2/32
[Peer]
# mobile phone
PublicKey = <copy public key from wg-mobile-public.key>
AllowedIPs = 10.200.200.3/32ืขืืืขืืข ืืขืจืืช:
- ืืื ืื ืฆืื ืขืืขื ืขืจืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืึทืจืืึทื ืืืืื ืฉืืจืืช ืคืื ืื ืืขืงืขืก ืืื ืื ืฉืืืกืืขื
- ืืืึทื ืืืคึผื ืืื ื ืืฆื ืื ืขืจืืขื ืืึทื ื
10.200.200.0/24 - ืคึฟืึทืจ ืืืื
PostUp/PostDownืืื ืืึธืื ืื ืคืื ืืจืืืกื ืืืง ื ืขืฅ ืฆืืืื ื wwan0, ืืืจ ืงืขื ืืึธืื ืึท ืึทื ืืขืจืฉ (ืืืฉื, eth0)
ืื VPN ื ืขืฅ ืืื ืืืืื ืืืืคืฉืืืื ืืื ืื ืคืืืืขื ืืข ืืึทืคึฟืขื:
$ sudo wg-quick up wg0 ืืืื ืงืืืื ืืขืืึทื: ืืื ืื ืื ืก ืกืขืจืืืขืจ ืืื ืืขืืืืื ื dnsmasq ืืืื ืฆื ืึท ื ืขืฅ ืฆืืืื ื br0, ืืื ืืืื ืฆืืืขืืขืื ืืขืืืืกืขืก wg0 ืฆื ืืขืจ ืจืฉืืื ืคืื ืขืจืืืืื ืืขืืืืกืขืก. ืืื dnsmasq ืืึธืก ืืื ืืขืืื ืืืจื ืึทืืื ื ืึท ื ืืึทืข ื ืขืฅ ืฆืืืื ื ืฉืืจื ืฆื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข /etc/dnsmasq.conf, ืคึฟืึทืจ ืืืึทืฉืคึผืื:
interface=br0
interface=wg0ืึทืืืืืืึธื ืึทืืื, ืืื ืฆืืืขืืขืื ืึท ืืคึผืืึทืืืข ืืขืจืฉื ืฆื ืืึธืื ืคืึทืจืงืขืจ ืฆื ืื UDP ืฆืืืขืืขืจื ืคึผืึธืจื (51280):
$ sudo iptables -I INPUT -p udp --dport 51820 -j ACCEPTืืืฆื ืึทื ืึทืืฅ ืึทืจืืขื, ืืืจ ืงืขื ืขื ืฉืืขืื ืื ืึธืืึทืืึทืืืง ืงืึทืืขืจ ืคืื ืื VPN ืืื ืขื:
$ sudo systemctl enable wg-quick@wg0.serviceืงืืืขื ื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืืฃ ืืึทืคึผืืึทืคึผ
ืฉืึทืคึฟื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข ืืืืฃ ืึท ืืึทืคึผืืึทืคึผ /etc/wireguard/wg0.conf ืืื ืื ืืขืืืข ืกืขืืืื ืืก:
[Interface]
Address = 10.200.200.2/24
PrivateKey = <copy private key from wg-laptop-private.key>
[Peer]
PublicKey = <copy public key from wg-server-public.key>
AllowedIPs = 10.200.200.0/24
Endpoint = edgewalker:51820ืืขืจืืช:
- ืึทื ืฉืืึธื Edgewalker ืืืจ ืืึทืจืคึฟื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืื ืขืคื ืืืขื IP ืึธืืขืจ VPN ืกืขืจืืืขืจ ืืึทืืขืืึธืก
- ืืืจื ืืึทืฉืืขืืืงื
AllowedIPsืืืืฃ10.200.200.0/24, ืืืจ ื ืึธืจ ื ืืฆื VPN ืฆื ืึทืงืกืขืก ืื ืื ืขืจืืขื ื ืขืฅ. ืคืึทืจืงืขืจ ืฆื ืึทืืข ืื ืืขืจืข IP ืึทืืจืขืกืขืก / ืกืขืจืืืขืจืก ืืืขื ืคืึธืจืืขืฆื ืฆื ืืืื ืืืจื "ื ืึธืจืืึทื" ืขืคืขื ืขื ืืฉืึทื ืึทืื. ืขืก ืืืขื ืืืื ื ืืฆื ืื ืคืึทืจ-ืงืึทื ืคืืืืขืจื ืื ืก ืกืขืจืืืขืจ ืืืืฃ ืื ืืึทืคึผืืึทืคึผ.
ืคึฟืึทืจ ืืขืกืืื ื ืืื ืึธืืึทืืึทืืืง ืงืึทืืขืจ ืืืจ ื ืืฆื ืื ืืขืืืข ืงืึทืืึทื ืื wg-quick ะธ systemd:
$ sudo wg-quick up wg0
$ sudo systemctl enable wg-quick@wg0.serviceืืืืคืฉืืขืื ืืขื ืงืืืขื ื ืคืืจ Android-ืืขืืขืคืึธื
ืคึฟืึทืจ ืืขืืขืคืึธื Android ืืืจ ืฉืึทืคึฟื ืึท ืืืืขืจ ืขื ืืขืืข ืงืึธื ืคืืืืจืึทืฆืืข ืืขืงืข (ืืึธืืืจ ืขืก ืจืืคื mobile.conf):
[Interface]
Address = 10.200.200.3/24
PrivateKey = <copy private key from wg-mobile-private.key>
DNS = 10.200.200.1
[Peer]
PublicKey = <copy public key from wg-server-public.key>
AllowedIPs = 0.0.0.0/0
Endpoint = edgewalker:51820 ื ืื ืขื ืืขื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืืฃ ืื ืืึทืคึผืืึทืคึผ, ืืขืจ ืืขืืขืคืึธื ืืืื ื ืืฆื ืืื ืืืขืจ ืืืคึผื ืกืขืจืืืขืจ ืืื ืื ืื ืก ืกืขืจืืืขืจ (ืืื ืืข DNS), ืืื ืืืื ืคืึธืจื ืึทืืข ืคืึทืจืงืขืจ ืืืจื ืื ืืืคึผื ืืื ืขื (AllowedIPs = 0.0.0.0/0).
ืึทื ืฉืืึธื ืงืึทืคึผืืื ื ืื ืืขืงืข ืฆื ืืืื ืจืืจืขืืืืืง ืืืื, ืืืจ ืงืขื ืขื ืืขืจ ืขืก ืฆื ืึท QR ืงืึธื:
$ sudo apt install qrencode
$ qrencode -t ansiutf8 < mobile.confืืขืจ QR ืงืึธื ืืืขื ืืืขืจื ืึทืจืืืกืืขืืขืื ืฆืื ืงืึธื ืกืึธื ืืื ASCII. ืืขื ืงืขื ืขืก ืกืงืขื ืขื ืคึฟืื ืืขืจ ืึทืคึผ. Android VPN ืืื ืืืืืึธืืึทืืืฉ ืงืึธื ืคืืืืจืืจื ืืขื VPN ืืื ืขื.
ืจืขืืืืืึทื
Customize WireGuard ืคืฉืื ืืึทืืืฉ ืงืึทืืคึผืขืจื ืฆื OpenVPN.
ืืงืืจ: www.habr.com
