「WireGuard」の版間の差分

PresharedKey

$ wg genkey > privatekey

$ wg pubkey < privatekey > publickey

$ wg genkey | tee privatekey | wg pubkey > publickey

# wg genpsk > preshared

# ip link add dev wg0 type wireguard
# ip addr add 10.0.0.1/24 dev wg0
# wg set wg0 listen-port 48574 private-key ./privatekey
# wg set wg0 peer [Peer B public key] persistent-keepalive 25 allowed-ips 10.0.0.2/32 endpoint 10.10.10.2:39814
# ip link set wg0 up

# ip link add dev wg0 type wireguard
# ip addr add 10.0.0.2/24 dev wg0
# wg set wg0 listen-port 39814 private-key ./privatekey
# wg set wg0 peer [Peer A public key] persistent-keepalive 25 allowed-ips 10.0.0.1/32 endpoint 10.10.10.1:48574
# ip link set wg0 up

peer-a$ wg
interface: wg0
  public key: UguPyBThx/+xMXeTbRYkKlP0Wh/QZT3vTLPOVaaXTD8=
  private key: (hidden)
  listening port: 48574

peer: 9jalV3EEBnVXahro0pRMQ+cHlmjE33Slo9tddzCVtCw=
  endpoint: 10.10.10.2:39814
  allowed ips: 10.0.0.2/32

 peer-a$ ping 10.0.0.2

# wg showconf wg0 > /etc/wireguard/wg0.conf
# wg setconf wg0 /etc/wireguard/wg0.conf

/etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.1/32
PrivateKey = [CLIENT PRIVATE KEY]
MTU = 1420

[Peer]
PublicKey = [SERVER PUBLICKEY]
AllowedIPs = 10.0.0.0/24, 10.123.45.0/24, 1234:4567:89ab::/48
Endpoint = [SERVER ENDPOINT]:51820
PersistentKeepalive = 25
/etc/systemd/network/30-wg0.netdev
[NetDev]
Name = wg0
Kind = wireguard
Description = Wireguard

[WireGuard]
PrivateKey = [CLIENT PRIVATE KEY]

[WireGuardPeer]
PublicKey = [SERVER PUBLIC KEY]
PresharedKey = [PRE SHARED KEY]
AllowedIPs = 10.0.0.0/24
Endpoint = [SERVER ENDPOINT]:51820
PersistentKeepalive = 25
/etc/systemd/network/30-wg0.network
[Match]
Name = wg0

[Network]
Address = 10.0.0.3/32
DNS = 10.0.0.1

[Route]
Gateway = 10.0.0.1
Destination = 10.0.0.0/24
# sysctl net.ipv4.ip_forward=1

/etc/wireguard/wg0.conf
[Interface]
Address = 10.200.200.1/24
SaveConfig = true
ListenPort = 51820
PrivateKey = [SERVER PRIVATE KEY]
MTU = 1420

# note - substitute eth0 in the following lines to match the Internet-facing interface
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# client foo
PublicKey = [FOO's PUBLIC KEY]
PresharedKey = [PRE-SHARED KEY]
AllowedIPs = 10.200.200.2/32

[Peer]
# client bar
PublicKey = [BAR's PUBLIC KEY]
PresharedKey = [PRE-SHARED KEY]
AllowedIPs = 10.200.200.3/32
# systemctl start wg-quick@wg0

foo.conf
[Interface]
Address = 10.200.200.2/24
PrivateKey = [FOO's PRIVATE KEY]
DNS = 10.200.200.1
MTU = 1420

[Peer]
PublicKey = [SERVER PUBLICKEY]
PresharedKey = [PRE-SHARED KEY]
AllowedIPs = 0.0.0.0/0
Endpoint = my.ddns.address.com:51820
bar.conf
[Interface]
Address = 10.200.200.3/24
PrivateKey = [BAR's PRIVATE KEY]
DNS = 10.200.200.1
MTU = 1420

[Peer]
PublicKey = [SERVER PUBLICKEY]
PresharedKey = [PRE-SHARED KEY]
AllowedIPs = 0.0.0.0/0
Endpoint = my.ddns.address.com:51820
$ qrencode -t ansiutf8 < foo.conf

$ nc -vvlnp 2222

$ dd if=/dev/zero bs=1024K count=1024 | nc -v 10.0.0.203 2222

# wg
interface: wg0
  public key: UguPyBThx/+xMXeTbRYkKlP0Wh/QZT3vTLPOVaaXTD8=
  private key: (hidden)
  listening port: 51820

peer: 9jalV3EEBnVXahro0pRMQ+cHlmjE33Slo9tddzCVtCw=
  preshared key: (hidden)
  endpoint: 192.168.1.216:53207
  allowed ips: 10.0.0.0/0
  latest handshake: 1 minutes, 17 seconds ago
  transfer: 56.43 GiB received, 1.06 TiB sent
PostUp = wg set %i private-key <(su user -c "export PASSWORD_STORE_DIR=/path/to/your/store/; pass WireGuard/private-keys/%i")

/etc/systemd/system/wireguard_reresolve-dns.timer
[Unit]
Description=Periodically reresolve DNS of all WireGuard endpoints

[Timer]
OnCalendar=*:*:0/30

[Install]
WantedBy=timers.target
/etc/systemd/system/wireguard_reresolve-dns.service
[Unit]
Description=Reresolve DNS of all WireGuard endpoints
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=/bin/sh -c 'for i in /etc/wireguard/*.conf; do /usr/share/wireguard/examples/reresolve-dns/reresolve-dns.sh "\$i"; done'
$ qrencode -t ansiutf8 -r client.conf

# modprobe wireguard
# echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control

# wg syncconf ${WGNET} <(wg-quick strip ${WGNET})

/etc/NetworkManager/conf.d/unmanaged.conf
[keyfile]
unmanaged-devices=interface-name:wg0
foo.config
[Interface]
Address = 10.200.200.2/24
MTU = 1420
PrivateKey = PEER_FOO_PRIVATE_KEY
DNS = 10.200.200.1
# wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
Key is not the correct length or format: `/path/example.key'
Configuration parsing error
[#] ip link delete dev wg0

# Set the persistent-keepalive via command line (temporarily)
[#] wg set wg0 peer $PUBKEY persistent-keepalive 25

ip route add <endpoint ip> via <gateway> dev <network interface>

ip route add 203.0.113.102 via 192.168.0.1 dev eth0

/etc/NetworkManager/dispatcher.d/50-wg0.sh
#!/bin/sh
case $2 in
  up)
    wg-quick up wg0
    ip route add <endpoint ip> via $IP4_GATEWAY dev $DEVICE_IP_IFACE
    ;;
  pre-down)
    wg-quick down wg0
    ;;
esac
/etc/NetworkManager/conf.d/rc-manager.conf
[main]
rc-manager=resolvconf
/etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.2/24  # The client IP from wg0server.conf with the same subnet mask
PrivateKey = [CLIENT PRIVATE KEY]
PostUp = resolvectl domain %i "~."; resolvectl dns %i 10.0.0.1; resolvectl dnssec %i yes
MTU = 1420

[Peer]
PublicKey = [SERVER PUBLICKEY]
AllowedIPs = 0.0.0.0/0, ::0/0
Endpoint = [SERVER ENDPOINT]:51820
PersistentKeepalive = 25

@@ 355行目: / 355行目: @@
  # echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control
+=== ピア(サーバー)設定の再読み込み ===
-=== Reload peer (server) configuration ===
+WireGuard ピア（主にサーバ）が設定から他のピアを追加または削除し、アクティブなセッションを停止せずに再読み込みしたい場合、次のコマンドを実行することができます:
-In case the WireGuard peer (mostly server) adding or removing another peers from its configuration and wants to reload it without stopping any active sessions, one can execute the following command to do it:
  # wg syncconf ${WGNET} <(wg-quick strip ${WGNET})
-Where {{ic|$WGNET}} is WireGuard interface name or configuration base name, for example {{ic|wg0}} (for server) or {{ic|client}} (without the ''.conf'' extension, for client).
+ここで、{{ic|$WGNET}} は WireGuard インターフェース名または設定ベース名です。例えば、{{ic|wg0}}(サーバー用) または {{ic|client}} です。(クライアント用には ''.conf'' という拡張子をつけません)。
 {{Expansion|Show how to do this with other network managers from [[#Persistent configuration]].}}

	Peer A	Peer B
外部 IP アドレス	10.10.10.1/24	10.10.10.2/24
内部 IP アドレス	10.0.0.1/24	10.0.0.2/24
wireguard 使用ポート	UDP/48574	UDP/39814

「WireGuard」の版間の差分

2023年3月8日 (水) 12:12時点における版

目次

インストール

グラフィカルクライアント

コマンドラインツール

使用方法

鍵の生成

手動設定

Peer A の設定

Peer B の設定

基本チェック

設定の永続化

ピア設定例

systemd-networkd の設定例

特定のユースケース: VPN サーバー

サーバー

鍵の生成

サーバーの設定

クライアントの設定

トンネルのテスト

ヒントとテクニック

秘密鍵を暗号化して保存

IP が変わるエンドポイント

Generate QR code

デバッグログを有効にする

ピア(サーバー)設定の再読み込み

トラブルシューティング

ルートが定期的にリセットされる

Broken DNS resolution

Low MTU

Key is not the correct length or format

Unable to establish a persistent connection behind NAT / firewall

Loop routing

NetworkManager で切断される

resolvconf を使う

dnsmasq を使う

systemd-resolved を使う

参照

案内メニュー

検索