simple setup

simple setup


MAIN

$UDP_SERVERUDP_PORT - The port on which the client will establish a connection with the server (should be opened by a firewall and/or forwarded through NAT).

$WHITE_IP_OR_DOMAIN_YOUR_SERVER - Зublic (white) address of the server to which clients will connect to create a tunnel.

192.168.200.XXX - Network addressing inside the tunnel (gray network), you can change it to your own or leave it as it is, the main thing is that there is no other network with the same addressing from both the server side and the client side.

PersistentKeepalive - Ф parameter indicating how often the client should exchange heartbeats with the server, in the absence of other traffic it helps them not to "lose" each other.

AllowedIPs - A list of host or network addresses AVAILABLE for routing through the tunnel, by default wg creates a route for available networks by itself. You can list on multiple lines or separated by commas. If you don't want wireguard to create routes according to AllowedIPs you can set Table = off in the [Interface] section (usually required on the client side). Regardless of how many and which routes you have added here, do not forget to specify the address of the gray network inside the tunnel. On the server, client addresses are specified with the /32 mask.

wg0 - The name of the configuration file will also be used by the systemd service to run, and will also become the name of the network interface. You can replace it with any other convenient for you.

DO NOT use the same private/public key pair for different clients!

Server

gen keys

wg genkey | tee privatekey | wg pubkey > publickey

this create 2 files, with private and public server keys

create config

/etc/wireguard/wg0.conf

[Interface]
Address = 192.168.200.1/24
PostUp = iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -o $UPLINK_DEV -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 192.168.200.0/24 -o $UPLINK_DEV -j MASQUERADE
ListenPort = $UDP_SERVERUDP_PORT
PrivateKey = $SERVER_PRIVATE_KEY

# Client_1
[Peer]
PublicKey = $CLIENT_1_PUBLIC_KEY
AllowedIPs = 192.168.200.2/32
PersistentKeepalive = 3

# Client_2
[Peer]
PublicKey = $CLIENT_2_PUBLIC_KEY
AllowedIPs = 192.168.200.3/32
PersistentKeepalive = 3

Client

gen keys

wg genkey | tee privatekey | wg pubkey > publickey

this create 2 files, with private and public client keys

create config

/etc/wireguard/wg0.conf

[Interface]
Address = 192.168.200.2/24
PrivateKey = $SERVER_PUBLIC_KEY

[Peer]
PublicKey = $SERVER_PUBLIC_KEY
AllowedIPs = 192.168.200.0/24
AllowedIPs = XXX.XXX.XXX.XXX/XX
AllowedIPs = YYY.YYY.YYY.YYY/YY


Endpoint = $WHITE_IP_OR_DOMAIN_YOUR_SERVER:$UDP_SERVER_PORT
PersistentKeepalive = 3

Run

systemctl enable --now wg-quick@wg0.service

TIPS

You can add all public (white) ip from this list:

0.0.0.0/5
8.0.0.0/7
11.0.0.0/8
12.0.0.0/6
16.0.0.0/4
32.0.0.0/3
64.0.0.0/2
128.0.0.0/3
160.0.0.0/5
168.0.0.0/6
172.0.0.0/12
172.32.0.0/11
172.64.0.0/10
172.128.0.0/9
173.0.0.0/8
174.0.0.0/7
176.0.0.0/4
192.0.0.0/9
192.128.0.0/11
192.160.0.0/13
192.169.0.0/16
192.170.0.0/15
192.172.0.0/14
192.176.0.0/12
192.192.0.0/10
193.0.0.0/8
194.0.0.0/7
196.0.0.0/6
200.0.0.0/5
208.0.0.0/4

Содержание