WireGuard 内网穿透之基础环境搭建

IPv4 的存量越来越少了, 总感觉电信在某一天会悄摸收回我的IPv4公网地址, 所以提前准备一下内网穿透, 我使用了我香港 CN2 的服务器, 去程还是很优秀的, PING 值稳定在 36ms 左右

现在直接开始在服务器上安装wireguard

apt update
apt install -y wireguard

再为wireguard生成秘钥

umask 077
wg genkey > /etc/wireguard/hk223-private.key
wg pubkey < /etc/wireguard/hk223-private.key > /etc/wireguard/hk223-public.key

然后记录一下服务器的公钥, 后面会用到

cat /etc/wireguard/hk223-public.key
cat /etc/wireguard/hk223-private.key

配置一下配置文件nano /etc/wireguard/wg_hk223.conf

[Interface]
Address = 10.251.0.1/30
ListenPort = 51820
MTU = 1400
PrivateKey = <服务器私钥>
SaveConfig = false

[Peer]
# OpenWrt
PublicKey = <OpenWrt公钥> #这个需要后面再填写
AllowedIPs = 10.251.0.2/32

然后控制下文件权限

chmod 600 /etc/wireguard/wg_hk223.conf
chmod 600 /etc/wireguard/hk223-private.key

随后在/etc/sysctl.d/99-wireguard-forward.conf写入net.ipv4.ip_forward=1并应用sysctl --system即开启 IPv4 转发, 并在ufw中放行我们刚刚配置的 51820 端口, 要不然客户端是连不上的

设置服务的开机自启动

systemctl enable --now wg-quick@wg_hk223

接下来联入OpenWRT的 SSH 来对客户端进行配置

opkg update
opkg install wireguard-tools luci-proto-wireguard

创建一个秘钥

umask 077

OW_PRIVATE=$(wg genkey)
OW_PUBLIC=$(printf '%s' "$OW_PRIVATE" | wg pubkey)

printf '%s\n' "$OW_PUBLIC"

这里的输出就是我们服务器上要填写的<OpenWrt公钥>这个字段

接下来我们为Wireguard创建一个新接口

uci set network.wg_hk223='interface'
uci set network.wg_hk223.proto='wireguard'
uci set network.wg_hk223.private_key="$OW_PRIVATE"
uci set network.wg_hk223.addresses='10.251.0.2/30'
uci set network.wg_hk223.mtu='1400'

然后把服务器添加进去

uci set network.hk223_vps='wireguard_wg_hk223'
uci set network.hk223_vps.description='HK x.x.x.x'
uci set network.hk223_vps.public_key='<香港公钥>'
uci set network.hk223_vps.endpoint_host='x.x.x.x'
uci set network.hk223_vps.endpoint_port='51820'
uci set network.hk223_vps.allowed_ips='0.0.0.0/0'
uci set network.hk223_vps.route_allowed_ips='0'
uci set network.hk223_vps.persistent_keepalive='25'

保存并重载

uci commit network
/etc/init.d/network reload

然后就是防火墙配置

uci set firewall.wg_hk223='zone'
uci set firewall.wg_hk223.name='wg_hk223'
uci set firewall.wg_hk223.network='wg_hk223'
uci set firewall.wg_hk223.input='REJECT'
uci set firewall.wg_hk223.output='ACCEPT'
uci set firewall.wg_hk223.forward='REJECT'
uci set firewall.wg_hk223.masq='1'
uci set firewall.wg_hk223.mtu_fix='1'

uci set firewall.lan_to_wg_hk223='forwarding'
uci set firewall.lan_to_wg_hk223.src='lan'
uci set firewall.lan_to_wg_hk223.dest='wg_hk223'

uci set firewall.wg_hk223_to_lan='forwarding'
uci set firewall.wg_hk223_to_lan.src='wg_hk223'
uci set firewall.wg_hk223_to_lan.dest='lan'

依然和上面一样保存并重载

接下来我们检验一下有没有打通

root@ImmortalWrt:~# wg show wg_hk223
interface: wg_hk223
  public key: v************
  private key: (hidden)
  listening port: 54963

peer: ************
  endpoint: x.x.x.x:51820
  allowed ips: 0.0.0.0/0
  latest handshake: 12 seconds ago
  transfer: 17.45 MiB received, 2.44 MiB sent
  persistent keepalive: every 25 seconds
root@ImmortalWrt:~# ping -I wg_hk223 -c 3 10.251.0.1
PING 10.251.0.1 (10.251.0.1): 56 data bytes
64 bytes from 10.251.0.1: seq=0 ttl=64 time=93.015 ms
64 bytes from 10.251.0.1: seq=1 ttl=64 time=92.563 ms
64 bytes from 10.251.0.1: seq=2 ttl=64 time=92.628 ms

--- 10.251.0.1 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 92.563/92.735/93.015 ms
root@ImmortalWrt:~#