Projet

Général

Profil

Wireguard » Historique » Version 20

xavier, 19/07/2019 03:58
info depots debian

1 1 sacha
# Wireguard
2
3 14 sacha
Le VPN Kiss, utilisant les dernières règles de l'art, construit pour être audité & performant ! au revoir IPSec & OpenVPN !
4 20 xavier
5 19 xavier
Dans le Kernel Linux via DKMS pour l'instant (2018-10-10) et en userspace écrit en GO (en cours de migration en Rust) sur les autres plateformes (*BSD, OpenWRT, Android, Windows).
6
7 20 xavier
Pour Debian stable, « Stretch » 9.8 puis « Buster » 10.0, des paquets `wireguard{,-dkms,-modules}` sont installables depuis le dépôt `unstable` (uniquement).  Les mises à jour y sont fréquentes, par exemple les versions disponibles au 2019-03-07 étaient les 0.0.20190227-1, celles disponibles au 2019-07-19 étaient les 0.0.20190702-1.
8 19 xavier
9 1 sacha
## Installation
10
11
https://www.wireguard.com/install/
12
13
## Configuration
14
15
### Serveur
16
17
~~~
18
umask 077
19
wg genkey > /etc/wireguard/private
20
wg genkey | tee /etc/wireguard/private | wg pubkey > /etc/wireguard/publickey
21
wg set wg0 private-key /etc/wireguard/private
22
ip link set wg0 up
23
24
cat << EOF > /etc/wireguard/wireguard.conf
25
[Interface]
26
ListenPort = 50000 
27
PrivateKey = `cat /etc/wireguard/private`
28
29
[Peer]
30
PublicKey = Va0X1zOpRc9471Aa3DEUUy7UkAv5aq5SojtIPqOSqwg=
31
AllowedIPs = 10.33.33.0/24
32
Endpoint = 185.233.100.19:50000
33
EOF
34
35
~~~
36
37
### Client
38
39
~~~
40
umask 077
41
wg genkey | tee /etc/wireguard/private | wg pubkey > /etc/wireguard/publickey
42
wg set wg0 private-key /etc/wireguard/private
43 17 stephanie.vieville
ip link add dev wg0 type wireguard
44 1 sacha
ip link set wg0 up
45 17 stephanie.vieville
46 1 sacha
~~~
47 2 sacha
48 12 louis.leveque
### Config serveur (Hypnos)
49
50
~~~
51
#!/bin/bash
52
53
set -x -e
54
55
# Creating the wireguard interface
56
ip link add dev wg0 type wireguard
57
58
# Setting the IP on the wireguard interface
59
ip address add dev wg0 185.233.101.127/24
60
61
# Configuring the wireguard server
62
wg set wg0 listen-port 50000 private-key /etc/wireguard/private
63
64
# Starting up the wireguard interface
65
ip link set up dev wg0
66
67
# Add Client
68
wg set wg0 peer W/iRbRNZhftkcmkfS/pUNcyDJ1YHB0cBEDigzed6+B0= allowed-ips 185.233.101.126/32
69
70
# Create the static route for the client
71
ip route add 185.233.101.126/32 dev wg0 proto static
72
~~~
73
74
### Config client
75
76
~~~
77
#!/bin/bash
78
79
set -e -x
80
81
# Creating the wireguard interface
82
ip link add dev wg0 type wireguard
83
84
# Setting the IP on the wireguard interface
85
ip address add dev wg0 185.233.101.126/24
86
87
# Configuring wireguard
88
wg set wg0 private-key ./private
89
90
# Starting up the wireguard interface
91
ip link set up dev wg0
92
93
# Connect to the server
94
wg set wg0 peer 'XRhI4WqBipwY21pxPZ9Q7EWkypnQCKKtJjqu2tUUTVo=' allowed-ips 0.0.0.0/0 endpoint 185.233.100.9:50000
95
~~~
96
97 4 sacha
### 1er test: @Sacha's Home (Fibre Bouygues) --> @Hypnos (VM Aquilenet)
98 3 sacha
99 2 sacha
~~~
100
101
root@hypnos:/etc/wireguard# iperf3 -s
102
-----------------------------------------------------------
103
Server listening on 5201
104
-----------------------------------------------------------
105
Accepted connection from 10.33.33.2, port 60038
106
[  5] local 10.33.33.1 port 5201 connected to 10.33.33.2 port 60040
107
[ ID] Interval           Transfer     Bandwidth
108
[  5]   0.00-1.00   sec  15.1 MBytes   127 Mbits/sec                  
109
[  5]   1.00-2.00   sec  19.9 MBytes   167 Mbits/sec                  
110
[  5]   2.00-3.00   sec  20.1 MBytes   169 Mbits/sec                  
111
[  5]   3.00-4.00   sec  20.1 MBytes   169 Mbits/sec                  
112
[  5]   4.00-5.00   sec  19.7 MBytes   166 Mbits/sec                  
113
[  5]   5.00-6.00   sec  20.0 MBytes   168 Mbits/sec                  
114
[  5]   6.00-7.00   sec  20.2 MBytes   169 Mbits/sec                  
115
[  5]   7.00-8.00   sec  20.2 MBytes   170 Mbits/sec                  
116
[  5]   8.00-9.00   sec  20.1 MBytes   169 Mbits/sec                  
117
[  5]   9.00-10.00  sec  20.2 MBytes   169 Mbits/sec                  
118
[  5]  10.00-10.03  sec   566 KBytes   165 Mbits/sec                  
119
- - - - - - - - - - - - - - - - - - - - - - - - -
120
[ ID] Interval           Transfer     Bandwidth
121
[  5]   0.00-10.03  sec  0.00 Bytes  0.00 bits/sec                  sender
122
[  5]   0.00-10.03  sec   196 MBytes   164 Mbits/sec                  receiver
123
-----------------------------------------------------------
124
Server listening on 5201
125
-----------------------------------------------------------
126
~~~
127
128
129
~~~
130
root@hypnos:/etc/wireguard# wg
131
interface: wg0
132
  public key: Va0X1zOpRc9471Aa3DEUUy7UkAv5aq5SojtIPqOSqwg=
133
  private key: (hidden)
134
  listening port: 50000
135
136
peer: VEfmgnq/aXPX3qBB7Q2fgxAawQdfUYZDRKEQSPC8tnA=
137
  endpoint: 5.51.0.155:3418
138
  allowed ips: 10.33.33.0/24
139
  latest handshake: 4 minutes, 30 seconds ago
140
  transfer: 208.75 MiB received, 6.68 MiB sent
141
~~~
142 5 sacha
143
## InstallDebian sur Apu2
144
145
https://blog.pgeiser.com/posts/2017/04/installing-debian-stretch-on-a-machine-without-a-graphic-card/
146 6 sacha
147 18 xavier
~~~
148
aptitude install aptitude \ # Hmm?
149
     dhcpd resolvconf \
150
     curl dnsutils htop iperf3 tcpdump tmux whois \
151 1 sacha
     debian-security-support debsums needrestart
152 18 xavier
~~~
153 8 sacha
154
~~~
155
#!/bin/bash
156
gw=`ip  route | awk '/default/ { print $3 }'`
157 9 sacha
sysctl -w net.ipv4.ip_forward=1
158 8 sacha
ip link add dev wg0 type wireguard
159
ip address add dev wg0 10.33.33.2/24
160
ip link set up dev wg0
161
ip route add 185.233.100.19/32 via $gw dev enp1s0
162
ip route del default
163
ip route add default dev wg0
164
wg setconf wg0 /etc/wireguard/wg0.conf
165
~~~
166 10 sacha
167
https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick.8
168
https://git.zx2c4.com/WireGuard/about/src/tools/wg.8
169 16 sacha
170
https://vincent.bernat.ch/fr/blog/2018-vpn-wireguard-route