ืืืืึทื WireGuard ืคืื ืื ืึทืคึผืงืึทืืื ื ืืื ืืงืก ืงืขืจื 5.6, ืืื ืืึทืฉืืึธืกื ืฆื ืืขื ืืื ืืขืกืืขืจ ืฆื ืืืกืฉืืืืขื ืืขื ืืืคึผื ืืื ืืืื .
ืื ืขืงืืืืคึผืืขื ื
- Raspberry Pi 3 ืืื LTE ืืึธืืืืข ืืื ืขืคื ืืืขื IP ืึทืืจืขืก. ืขืก ืืืขื ืืืื ืึท ืืืคึผื ืกืขืจืืืขืจ ืืึธ (ืืขืจื ืึธื ืืื ืืขื ืืขืงืกื ืขืก ืืื ืืขืจืืคื edgewalker)
- ืึทื ืึทื ืืจืืื ืืขืืขืคืึธื ืืืึธืก ืืืื ื ืืฆื ืึท VPN ืคึฟืึทืจ ืึทืืข ืงืึธืืื ืืงืึทืฆืืข
- ืืื ืืงืก ืืึทืคึผืืึทืคึผ ืืืึธืก ืืึธื ื ืึธืจ ื ืืฆื ืึท ืืืคึผื ืืื ืื ื ืขืฅ
ืืขืืขืจ ืืืื ืืืึธืก ืงืึทื ืขืงืฅ ืฆื ืื ืืืคึผื ืืืื ืงืขื ืขื ืฆื ืคืึทืจืืื ืื ืฆื ืึทืืข ืื ืืขืจืข ืืขืืืืกืขืก. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืึท ืืขืืขืคืึธื ืืึธื ืงืขื ืขื ืฆื ืคืึทืจืืื ืื ืฆื ืึท ืืืขื ืกืขืจืืืขืจ ืืืืฃ ืึท ืืึทืคึผืืึทืคึผ ืืืื ืืืืืข ืืขืืืืกืขืก ืืขื ืขื ืืืื ืคืื ืึท VPN ื ืขืฅ. ืืืื ืื ืกืขืืึทืคึผ ืืื ืืึทื ืฅ ืคึผืฉืื, ืืืจ ืงืขื ืขื ืืจืึทืืื ืืืขืื ืงืึทื ืขืงืืื ื ืื ืืขืกืงืืึทืคึผ ืฆื ืื VPN (ืืืจื ืขืืืขืจื ืขื).
ืงืึทื ืกืืืขืจืื ื ืึทื ืืืืืขืจื ืืื ืืืืืจืืืก ืงืึทื ืขืงืฉืึทื ื ืืืขืจื ืืืืื ืืงืขืจ ืืื ืืืืื ืืงืขืจ ืืืืขืจ ืืื ืฆืืื (, ะธ ), ืืื ืงืึทื ืกืืืขืจืื ื ืขืืขืก ื ืืฆื WireGuard ืคึฟืึทืจ ืึทืืข ืืืื ืืขืืืืกืขืก, ืงืืื ืขื ืื ืืื ืืืึธืก ืกืืืืืืข ืืื ืืขื ืขื.
ืืืืืืืืืจื ืื ืกืืึทืืืจืื ื
WireGuard ืืื ืคึฟืึทืจ ืจืืึฟ ืืื ืืงืก, ืืืื ืืึธืื ืืื ืืึทืงืึธืก ืืืกืืจืืืืืฉืึทื ื. ืึทื ืืจืืื ืืื ืืึธืก ืึทืคึผืคึผืก ืืขื ืขื ืืืืขืจืืขืืขืื ืืืจื ืึทืคึผ ืืืืจืขืงืืขืจืื.
ืืื ืืึธืื ืื ืืขืฆืืข ืคืขืืึธืจืึท ืืื ืืงืก 31, ืืื ืืื ืืื ืืขืืืขื ืฆื ืคืืื ืฆื ืืืืขื ืขื ืื ืืึทื ืืึทื ืืืืืขืจ ืื ืกืืึธืืื ื. ื ืึธืจ ืืขืคึฟืื ืขื ืื ืคึผืึทืงืึทืืืฉืึทื wireguard-tools, ืืื ืกืืึทืืืจื ืืื, ืืื ืืขืืึธืื ืงืขื ื ืืฉื ืืขืคึฟืื ืขื ืืืืก ืืืึธืก ืืึธืจื ืืฉื ืืื ืืจืืขืื. ืืืืึทืืขืจ ืืืกืคืึธืจืฉืื ื ืื ืืคืืขืงื ืึทื ืืื ืืึธื ื ืื ืืึธืื ืืขื ืคึผืขืงื ืืื ืกืืึทืืืจื wireguard-dkms (ืืื ืึท ื ืขืฅ ืฉืึธืคืขืจ), ืึธืืขืจ ืขืก ืืื ื ืืฉื ืืื ืื ืจืืคึผืึทืืึทืืึธืจื ืคืื ืืืื ืคืึทืจืฉืคึผืจืืืืื ื.
ืืืื ืืื ืืืึธืื ืืืืขื ืขื ืื ืื ืกืืจืึทืงืฉืึทื ื, ืืื ืืืึธืื ืืึธืื ืืขื ืืืขื ืื ืจืืืืืง ืกืืขืคึผืก:
$ sudo dnf copr enable jdoss/wireguard
$ sudo dnf install wireguard-dkms wireguard-tools
ืืื ืืึธืื ืื Raspbian Buster ืคืึทืจืฉืคึผืจืืืืื ื ืืื ืกืืึทืืืจื ืืืืฃ ืืืื Raspberry Pi, ืขืก ืืื ืฉืืื ืึท ืคึผืขืงื ืืึธืจื wireguard, ืื ืกืืึทืืืจื ืขืก:
$ sudo apt install wireguardืืืืฃ ืืืื ืึทื ืืจืืื ืืขืืขืคืึธื ืืื ืืื ืกืืึทืืืจื ืื ืึทืคึผืืึทืงืืืฉืึทื ืคึฟืื ืืขืจ ืืึทืึทืืืขืจ Google ืึทืคึผ ืกืืึธืจ ืงืึทืืึทืืึธื.
ืืึทื ืืึธื ืืืจืื ื ืคืื ืฉืืืกืืขื
ืคึฟืึทืจ ืืึทื ืงืืงื ืึธืืขื ืืึทืงืืืฉืึทื, Wireguard ื ืืฆื ืึท ืคึผืฉืื ืคึผืจืืืืึทื / ืฆืืืืจ ืฉืืืกื ืกืืขืืข ืฆื ืึธืืขื ืืึทืงืืื VPN ืคึผืืจื. ืืืจ ืงืขื ืขื ืืืืื ืฉืึทืคึฟื VPN ืฉืืืกืืขื ืืื ืื ืคืืืืขื ืืข ืืึทืคึฟืขื:
$ wg genkey | tee wg-laptop-private.key | wg pubkey > wg-laptop-public.key
$ wg genkey | tee wg-server-private.key | wg pubkey > wg-server-public.key
$ wg genkey | tee wg-mobile-private.key | wg pubkey > wg-mobile-public.keyืืึธืก ืืื ืืื ืื ืืจืื ืฉืืืกื ืคึผืขืจื (ืืขืงืก ืืขืงืขืก). ืืืจ ืืืขืื ื ืืฉื ืึธืคึผืฉืืงื ืฆื ืื ืืขืงืขืก ืืื ืื ืงืึธื ืคืืืก, ืึธืืขืจ ื ืึธืืืึทืื ืื ืืื ืืึทืื ืืึธ: ืืขืืขืจ ืฉืืืกื ืืื ืืืื ืฉืืจื ืืื base64.
ืฉืึทืคึฟื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข ืคึฟืึทืจ ืื ืืืคึผื ืกืขืจืืืขืจ (Raspberry Pi)
ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืืึทื ืฅ ืคึผืฉืื, ืืื ืืืฉืืคื ืื ืคืืืืขื ืืข ืืขืงืข /etc/wireguard/wg0.conf:
[Interface]
Address = 10.200.200.1/24
ListenPort = 51820
PrivateKey = <copy private key from wg-server-private.key>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o wwan0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o wwan0 -j MASQUERADE
[Peer]
# laptop
PublicKey = <copy public key from wg-laptop-public.key>
AllowedIPs = 10.200.200.2/32
[Peer]
# mobile phone
PublicKey = <copy public key from wg-mobile-public.key>
AllowedIPs = 10.200.200.3/32ืขืืืขืืข ืืขืจืืช:
- ืืื ืื ืฆืื ืขืืขื ืขืจืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืึทืจืืึทื ืืืืื ืฉืืจืืช ืคืื ืื ืืขืงืขืก ืืื ืื ืฉืืืกืืขื
- ืืืึทื ืืืคึผื ืืื ื ืืฆื ืื ืขืจืืขื ืืึทื ื
10.200.200.0/24 - ืคึฟืึทืจ ืืืื
PostUp/PostDownืืื ืืึธืื ืื ืคืื ืืจืืืกื ืืืง ื ืขืฅ ืฆืืืื ื wwan0, ืืืจ ืงืขื ืืึธืื ืึท ืึทื ืืขืจืฉ (ืืืฉื, eth0)
ืื VPN ื ืขืฅ ืืื ืืืืื ืืืืคืฉืืืื ืืื ืื ืคืืืืขื ืืข ืืึทืคึฟืขื:
$ sudo wg-quick up wg0
ืืืื ืงืืืื ืืขืืึทื: ืืื ืื ืื ืก ืกืขืจืืืขืจ ืืื ืืขืืืืื ื dnsmasq ืืืื ืฆื ืึท ื ืขืฅ ืฆืืืื ื br0, ืืื ืืืื ืฆืืืขืืขืื ืืขืืืืกืขืก wg0 ืฆื ืืขืจ ืจืฉืืื ืคืื ืขืจืืืืื ืืขืืืืกืขืก. ืืื dnsmasq ืืึธืก ืืื ืืขืืื ืืืจื ืึทืืื ื ืึท ื ืืึทืข ื ืขืฅ ืฆืืืื ื ืฉืืจื ืฆื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข /etc/dnsmasq.conf, ืคึฟืึทืจ ืืืึทืฉืคึผืื:
interface=br0
interface=wg0ืึทืืืืืืึธื ืึทืืื, ืืื ืฆืืืขืืขืื ืึท ืืคึผืืึทืืืข ืืขืจืฉื ืฆื ืืึธืื ืคืึทืจืงืขืจ ืฆื ืื UDP ืฆืืืขืืขืจื ืคึผืึธืจื (51280):
$ sudo iptables -I INPUT -p udp --dport 51820 -j ACCEPTืืืฆื ืึทื ืึทืืฅ ืึทืจืืขื, ืืืจ ืงืขื ืขื ืฉืืขืื ืื ืึธืืึทืืึทืืืง ืงืึทืืขืจ ืคืื ืื VPN ืืื ืขื:
$ sudo systemctl enable [email protected]ืงืืืขื ื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืืฃ ืืึทืคึผืืึทืคึผ
ืฉืึทืคึฟื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข ืืืืฃ ืึท ืืึทืคึผืืึทืคึผ /etc/wireguard/wg0.conf ืืื ืื ืืขืืืข ืกืขืืืื ืืก:
[Interface]
Address = 10.200.200.2/24
PrivateKey = <copy private key from wg-laptop-private.key>
[Peer]
PublicKey = <copy public key from wg-server-public.key>
AllowedIPs = 10.200.200.0/24
Endpoint = edgewalker:51820ืืขืจืืช:
- ืึทื ืฉืืึธื Edgewalker ืืืจ ืืึทืจืคึฟื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืื ืขืคื ืืืขื IP ืึธืืขืจ VPN ืกืขืจืืืขืจ ืืึทืืขืืึธืก
- ืืืจื ืืึทืฉืืขืืืงื
AllowedIPsืืืืฃ10.200.200.0/24, ืืืจ ื ืึธืจ ื ืืฆื VPN ืฆื ืึทืงืกืขืก ืื ืื ืขืจืืขื ื ืขืฅ. ืคืึทืจืงืขืจ ืฆื ืึทืืข ืื ืืขืจืข IP ืึทืืจืขืกืขืก / ืกืขืจืืืขืจืก ืืืขื ืคืึธืจืืขืฆื ืฆื ืืืื ืืืจื "ื ืึธืจืืึทื" ืขืคืขื ืขื ืืฉืึทื ืึทืื. ืขืก ืืืขื ืืืื ื ืืฆื ืื ืคืึทืจ-ืงืึทื ืคืืืืขืจื ืื ืก ืกืขืจืืืขืจ ืืืืฃ ืื ืืึทืคึผืืึทืคึผ.
ืคึฟืึทืจ ืืขืกืืื ื ืืื ืึธืืึทืืึทืืืง ืงืึทืืขืจ ืืืจ ื ืืฆื ืื ืืขืืืข ืงืึทืืึทื ืื wg-quick ะธ systemd:
$ sudo wg-quick up wg0
$ sudo systemctl enable [email protected]ืืึทืฉืืขืืืงื ืึท ืงืืืขื ื ืืืืฃ ืึทื ืึทื ืืจืืื ืืขืืขืคืึธื
ืคึฟืึทืจ ืึทื ืึทื ืืจืืื ืืขืืขืคืึธื ืืืจ ืืึทืื ืึท ืืืืขืจ ืขื ืืขื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข (ืืึธืืืจ ืจืืคื ืขืก mobile.conf):
[Interface]
Address = 10.200.200.3/24
PrivateKey = <copy private key from wg-mobile-private.key>
DNS = 10.200.200.1
[Peer]
PublicKey = <copy public key from wg-server-public.key>
AllowedIPs = 0.0.0.0/0
Endpoint = edgewalker:51820
ื ืื ืขื ืืขื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืืฃ ืื ืืึทืคึผืืึทืคึผ, ืืขืจ ืืขืืขืคืึธื ืืืื ื ืืฆื ืืื ืืืขืจ ืืืคึผื ืกืขืจืืืขืจ ืืื ืื ืื ืก ืกืขืจืืืขืจ (ืืื ืืข DNS), ืืื ืืืื ืคืึธืจื ืึทืืข ืคืึทืจืงืขืจ ืืืจื ืื ืืืคึผื ืืื ืขื (AllowedIPs = 0.0.0.0/0).
ืึทื ืฉืืึธื ืงืึทืคึผืืื ื ืื ืืขืงืข ืฆื ืืืื ืจืืจืขืืืืืง ืืืื, ืืืจ ืงืขื ืขื ืืขืจ ืขืก ืฆื ืึท QR ืงืึธื:
$ sudo apt install qrencode
$ qrencode -t ansiutf8 < mobile.confืื QR ืงืึธื ืืืขื ืึทืจืืืกืคืืจื ืฆื ืื ืงืึทื ืกืึธืื ืืื ASCII. ืขืก ืงืขื ืขื ืืืื ืกืงืึทื ื ืคึฟืื ืื ืึทื ืืจืืื ืืืคึผื ืึทืคึผ ืืื ืืืขื ืืืืืึธืืึทืืืฉ ืฉืืขืื ืึท ืืืคึผื ืืื ืขื.
ืจืขืืืืืึทื
ืืึทืฉืืขืืืงื WireGuard ืืื ืคืฉืื ืืึทืืืฉืืงืึทื ืงืึทืืคึผืขืจื ืืื OpenVPN.
ืืงืืจ: www.habr.com