Projet

Général

Profil

Wireguard » Historique » Version 21

xavier, 28/07/2019 20:02
toc

1 21 xavier
{{>toc}}
2
3 1 sacha
# Wireguard
4
5 14 sacha
Le VPN Kiss, utilisant les dernières règles de l'art, construit pour être audité & performant ! au revoir IPSec & OpenVPN !
6 20 xavier
7 19 xavier
Dans le Kernel Linux via DKMS pour l'instant (2018-10-10) et en userspace écrit en GO (en cours de migration en Rust) sur les autres plateformes (*BSD, OpenWRT, Android, Windows).
8
9 20 xavier
Pour Debian stable, « Stretch » 9.8 puis « Buster » 10.0, des paquets `wireguard{,-dkms,-modules}` sont installables depuis le dépôt `unstable` (uniquement).  Les mises à jour y sont fréquentes, par exemple les versions disponibles au 2019-03-07 étaient les 0.0.20190227-1, celles disponibles au 2019-07-19 étaient les 0.0.20190702-1.
10 19 xavier
11 1 sacha
## Installation
12
13
https://www.wireguard.com/install/
14
15
## Configuration
16
17
### Serveur
18
19
~~~
20
umask 077
21
wg genkey > /etc/wireguard/private
22
wg genkey | tee /etc/wireguard/private | wg pubkey > /etc/wireguard/publickey
23
wg set wg0 private-key /etc/wireguard/private
24
ip link set wg0 up
25
26
cat << EOF > /etc/wireguard/wireguard.conf
27
[Interface]
28
ListenPort = 50000 
29
PrivateKey = `cat /etc/wireguard/private`
30
31
[Peer]
32
PublicKey = Va0X1zOpRc9471Aa3DEUUy7UkAv5aq5SojtIPqOSqwg=
33
AllowedIPs = 10.33.33.0/24
34
Endpoint = 185.233.100.19:50000
35
EOF
36
37
~~~
38
39
### Client
40
41
~~~
42
umask 077
43
wg genkey | tee /etc/wireguard/private | wg pubkey > /etc/wireguard/publickey
44
wg set wg0 private-key /etc/wireguard/private
45 17 stephanie.vieville
ip link add dev wg0 type wireguard
46 1 sacha
ip link set wg0 up
47 17 stephanie.vieville
48 1 sacha
~~~
49 2 sacha
50 12 louis.leveque
### Config serveur (Hypnos)
51
52
~~~
53
#!/bin/bash
54
55
set -x -e
56
57
# Creating the wireguard interface
58
ip link add dev wg0 type wireguard
59
60
# Setting the IP on the wireguard interface
61
ip address add dev wg0 185.233.101.127/24
62
63
# Configuring the wireguard server
64
wg set wg0 listen-port 50000 private-key /etc/wireguard/private
65
66
# Starting up the wireguard interface
67
ip link set up dev wg0
68
69
# Add Client
70
wg set wg0 peer W/iRbRNZhftkcmkfS/pUNcyDJ1YHB0cBEDigzed6+B0= allowed-ips 185.233.101.126/32
71
72
# Create the static route for the client
73
ip route add 185.233.101.126/32 dev wg0 proto static
74
~~~
75
76
### Config client
77
78
~~~
79
#!/bin/bash
80
81
set -e -x
82
83
# Creating the wireguard interface
84
ip link add dev wg0 type wireguard
85
86
# Setting the IP on the wireguard interface
87
ip address add dev wg0 185.233.101.126/24
88
89
# Configuring wireguard
90
wg set wg0 private-key ./private
91
92
# Starting up the wireguard interface
93
ip link set up dev wg0
94
95
# Connect to the server
96
wg set wg0 peer 'XRhI4WqBipwY21pxPZ9Q7EWkypnQCKKtJjqu2tUUTVo=' allowed-ips 0.0.0.0/0 endpoint 185.233.100.9:50000
97
~~~
98
99 4 sacha
### 1er test: @Sacha's Home (Fibre Bouygues) --> @Hypnos (VM Aquilenet)
100 3 sacha
101 2 sacha
~~~
102
103
root@hypnos:/etc/wireguard# iperf3 -s
104
-----------------------------------------------------------
105
Server listening on 5201
106
-----------------------------------------------------------
107
Accepted connection from 10.33.33.2, port 60038
108
[  5] local 10.33.33.1 port 5201 connected to 10.33.33.2 port 60040
109
[ ID] Interval           Transfer     Bandwidth
110
[  5]   0.00-1.00   sec  15.1 MBytes   127 Mbits/sec                  
111
[  5]   1.00-2.00   sec  19.9 MBytes   167 Mbits/sec                  
112
[  5]   2.00-3.00   sec  20.1 MBytes   169 Mbits/sec                  
113
[  5]   3.00-4.00   sec  20.1 MBytes   169 Mbits/sec                  
114
[  5]   4.00-5.00   sec  19.7 MBytes   166 Mbits/sec                  
115
[  5]   5.00-6.00   sec  20.0 MBytes   168 Mbits/sec                  
116
[  5]   6.00-7.00   sec  20.2 MBytes   169 Mbits/sec                  
117
[  5]   7.00-8.00   sec  20.2 MBytes   170 Mbits/sec                  
118
[  5]   8.00-9.00   sec  20.1 MBytes   169 Mbits/sec                  
119
[  5]   9.00-10.00  sec  20.2 MBytes   169 Mbits/sec                  
120
[  5]  10.00-10.03  sec   566 KBytes   165 Mbits/sec                  
121
- - - - - - - - - - - - - - - - - - - - - - - - -
122
[ ID] Interval           Transfer     Bandwidth
123
[  5]   0.00-10.03  sec  0.00 Bytes  0.00 bits/sec                  sender
124
[  5]   0.00-10.03  sec   196 MBytes   164 Mbits/sec                  receiver
125
-----------------------------------------------------------
126
Server listening on 5201
127
-----------------------------------------------------------
128
~~~
129
130
131
~~~
132
root@hypnos:/etc/wireguard# wg
133
interface: wg0
134
  public key: Va0X1zOpRc9471Aa3DEUUy7UkAv5aq5SojtIPqOSqwg=
135
  private key: (hidden)
136
  listening port: 50000
137
138
peer: VEfmgnq/aXPX3qBB7Q2fgxAawQdfUYZDRKEQSPC8tnA=
139
  endpoint: 5.51.0.155:3418
140
  allowed ips: 10.33.33.0/24
141
  latest handshake: 4 minutes, 30 seconds ago
142
  transfer: 208.75 MiB received, 6.68 MiB sent
143
~~~
144 5 sacha
145
## InstallDebian sur Apu2
146
147
https://blog.pgeiser.com/posts/2017/04/installing-debian-stretch-on-a-machine-without-a-graphic-card/
148 6 sacha
149 18 xavier
~~~
150
aptitude install aptitude \ # Hmm?
151
     dhcpd resolvconf \
152
     curl dnsutils htop iperf3 tcpdump tmux whois \
153 1 sacha
     debian-security-support debsums needrestart
154 18 xavier
~~~
155 8 sacha
156
~~~
157
#!/bin/bash
158
gw=`ip  route | awk '/default/ { print $3 }'`
159 9 sacha
sysctl -w net.ipv4.ip_forward=1
160 8 sacha
ip link add dev wg0 type wireguard
161
ip address add dev wg0 10.33.33.2/24
162
ip link set up dev wg0
163
ip route add 185.233.100.19/32 via $gw dev enp1s0
164
ip route del default
165
ip route add default dev wg0
166
wg setconf wg0 /etc/wireguard/wg0.conf
167
~~~
168 10 sacha
169
https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick.8
170
https://git.zx2c4.com/WireGuard/about/src/tools/wg.8
171 16 sacha
172
https://vincent.bernat.ch/fr/blog/2018-vpn-wireguard-route