Projet

Général

Profil

Wireguard » Historique » Version 17

stephanie.vieville, 21/01/2019 13:27

1 1 sacha
# Wireguard
2
3 14 sacha
Le VPN Kiss, utilisant les dernières règles de l'art, construit pour être audité & performant ! au revoir IPSec & OpenVPN !
4 15 sacha
Dans le Kernel Linux via DKMS pour l'instant (10/10/18) et en userspace écrit en GO (en cours de migration en Rust) sur les autres plateformes (*BSD, OpenWRT, Android, Windows).
5 1 sacha
6
## Installation
7
8
https://www.wireguard.com/install/
9
10
## Configuration
11
12
### Serveur
13
14
~~~
15
umask 077
16
wg genkey > /etc/wireguard/private
17
wg genkey | tee /etc/wireguard/private | wg pubkey > /etc/wireguard/publickey
18
wg set wg0 private-key /etc/wireguard/private
19
ip link set wg0 up
20
21
cat << EOF > /etc/wireguard/wireguard.conf
22
[Interface]
23
ListenPort = 50000 
24
PrivateKey = `cat /etc/wireguard/private`
25
26
[Peer]
27
PublicKey = Va0X1zOpRc9471Aa3DEUUy7UkAv5aq5SojtIPqOSqwg=
28
AllowedIPs = 10.33.33.0/24
29
Endpoint = 185.233.100.19:50000
30
EOF
31
32
~~~
33
34
### Client
35
36
~~~
37
umask 077
38
wg genkey | tee /etc/wireguard/private | wg pubkey > /etc/wireguard/publickey
39
wg set wg0 private-key /etc/wireguard/private
40 17 stephanie.vieville
ip link add dev wg0 type wireguard
41 1 sacha
ip link set wg0 up
42 17 stephanie.vieville
43 1 sacha
~~~
44 2 sacha
45 12 louis.leveque
### Config serveur (Hypnos)
46
47
~~~
48
#!/bin/bash
49
50
set -x -e
51
52
# Creating the wireguard interface
53
ip link add dev wg0 type wireguard
54
55
# Setting the IP on the wireguard interface
56
ip address add dev wg0 185.233.101.127/24
57
58
# Configuring the wireguard server
59
wg set wg0 listen-port 50000 private-key /etc/wireguard/private
60
61
# Starting up the wireguard interface
62
ip link set up dev wg0
63
64
# Add Client
65
wg set wg0 peer W/iRbRNZhftkcmkfS/pUNcyDJ1YHB0cBEDigzed6+B0= allowed-ips 185.233.101.126/32
66
67
# Create the static route for the client
68
ip route add 185.233.101.126/32 dev wg0 proto static
69
~~~
70
71
### Config client
72
73
~~~
74
#!/bin/bash
75
76
set -e -x
77
78
# Creating the wireguard interface
79
ip link add dev wg0 type wireguard
80
81
# Setting the IP on the wireguard interface
82
ip address add dev wg0 185.233.101.126/24
83
84
# Configuring wireguard
85
wg set wg0 private-key ./private
86
87
# Starting up the wireguard interface
88
ip link set up dev wg0
89
90
# Connect to the server
91
wg set wg0 peer 'XRhI4WqBipwY21pxPZ9Q7EWkypnQCKKtJjqu2tUUTVo=' allowed-ips 0.0.0.0/0 endpoint 185.233.100.9:50000
92
~~~
93
94 4 sacha
### 1er test: @Sacha's Home (Fibre Bouygues) --> @Hypnos (VM Aquilenet)
95 3 sacha
96 2 sacha
~~~
97
98
root@hypnos:/etc/wireguard# iperf3 -s
99
-----------------------------------------------------------
100
Server listening on 5201
101
-----------------------------------------------------------
102
Accepted connection from 10.33.33.2, port 60038
103
[  5] local 10.33.33.1 port 5201 connected to 10.33.33.2 port 60040
104
[ ID] Interval           Transfer     Bandwidth
105
[  5]   0.00-1.00   sec  15.1 MBytes   127 Mbits/sec                  
106
[  5]   1.00-2.00   sec  19.9 MBytes   167 Mbits/sec                  
107
[  5]   2.00-3.00   sec  20.1 MBytes   169 Mbits/sec                  
108
[  5]   3.00-4.00   sec  20.1 MBytes   169 Mbits/sec                  
109
[  5]   4.00-5.00   sec  19.7 MBytes   166 Mbits/sec                  
110
[  5]   5.00-6.00   sec  20.0 MBytes   168 Mbits/sec                  
111
[  5]   6.00-7.00   sec  20.2 MBytes   169 Mbits/sec                  
112
[  5]   7.00-8.00   sec  20.2 MBytes   170 Mbits/sec                  
113
[  5]   8.00-9.00   sec  20.1 MBytes   169 Mbits/sec                  
114
[  5]   9.00-10.00  sec  20.2 MBytes   169 Mbits/sec                  
115
[  5]  10.00-10.03  sec   566 KBytes   165 Mbits/sec                  
116
- - - - - - - - - - - - - - - - - - - - - - - - -
117
[ ID] Interval           Transfer     Bandwidth
118
[  5]   0.00-10.03  sec  0.00 Bytes  0.00 bits/sec                  sender
119
[  5]   0.00-10.03  sec   196 MBytes   164 Mbits/sec                  receiver
120
-----------------------------------------------------------
121
Server listening on 5201
122
-----------------------------------------------------------
123
~~~
124
125
126
~~~
127
root@hypnos:/etc/wireguard# wg
128
interface: wg0
129
  public key: Va0X1zOpRc9471Aa3DEUUy7UkAv5aq5SojtIPqOSqwg=
130
  private key: (hidden)
131
  listening port: 50000
132
133
peer: VEfmgnq/aXPX3qBB7Q2fgxAawQdfUYZDRKEQSPC8tnA=
134
  endpoint: 5.51.0.155:3418
135
  allowed ips: 10.33.33.0/24
136
  latest handshake: 4 minutes, 30 seconds ago
137
  transfer: 208.75 MiB received, 6.68 MiB sent
138
~~~
139 5 sacha
140
## InstallDebian sur Apu2
141
142
https://blog.pgeiser.com/posts/2017/04/installing-debian-stretch-on-a-machine-without-a-graphic-card/
143 6 sacha
144 13 sacha
aptitude install dhcpd tmux whois aptitude dnsutils curl htop resolvconf
145 8 sacha
146
147
~~~
148
#!/bin/bash
149
gw=`ip  route | awk '/default/ { print $3 }'`
150 9 sacha
sysctl -w net.ipv4.ip_forward=1
151 8 sacha
ip link add dev wg0 type wireguard
152
ip address add dev wg0 10.33.33.2/24
153
ip link set up dev wg0
154
ip route add 185.233.100.19/32 via $gw dev enp1s0
155
ip route del default
156
ip route add default dev wg0
157
wg setconf wg0 /etc/wireguard/wg0.conf
158
~~~
159 10 sacha
160
https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick.8
161
https://git.zx2c4.com/WireGuard/about/src/tools/wg.8
162 16 sacha
163
https://vincent.bernat.ch/fr/blog/2018-vpn-wireguard-route