Wireguard » History » Version 22
sacha, 08/12/2019 07:00 PM
1 | 21 | xavier | {{>toc}} |
---|---|---|---|
2 | |||
3 | 1 | sacha | # Wireguard |
4 | |||
5 | 14 | sacha | Le VPN Kiss, utilisant les dernières règles de l'art, construit pour être audité & performant ! au revoir IPSec & OpenVPN ! |
6 | 20 | xavier | |
7 | 19 | xavier | Dans le Kernel Linux via DKMS pour l'instant (2018-10-10) et en userspace écrit en GO (en cours de migration en Rust) sur les autres plateformes (*BSD, OpenWRT, Android, Windows). |
8 | |||
9 | 20 | xavier | Pour Debian stable, « Stretch » 9.8 puis « Buster » 10.0, des paquets `wireguard{,-dkms,-modules}` sont installables depuis le dépôt `unstable` (uniquement). Les mises à jour y sont fréquentes, par exemple les versions disponibles au 2019-03-07 étaient les 0.0.20190227-1, celles disponibles au 2019-07-19 étaient les 0.0.20190702-1. |
10 | 19 | xavier | |
11 | 1 | sacha | ## Installation |
12 | |||
13 | https://www.wireguard.com/install/ |
||
14 | |||
15 | ## Configuration |
||
16 | |||
17 | ### Serveur |
||
18 | |||
19 | ~~~ |
||
20 | umask 077 |
||
21 | wg genkey > /etc/wireguard/private |
||
22 | wg genkey | tee /etc/wireguard/private | wg pubkey > /etc/wireguard/publickey |
||
23 | wg set wg0 private-key /etc/wireguard/private |
||
24 | ip link set wg0 up |
||
25 | |||
26 | cat << EOF > /etc/wireguard/wireguard.conf |
||
27 | [Interface] |
||
28 | ListenPort = 50000 |
||
29 | PrivateKey = `cat /etc/wireguard/private` |
||
30 | |||
31 | [Peer] |
||
32 | PublicKey = Va0X1zOpRc9471Aa3DEUUy7UkAv5aq5SojtIPqOSqwg= |
||
33 | AllowedIPs = 10.33.33.0/24 |
||
34 | Endpoint = 185.233.100.19:50000 |
||
35 | EOF |
||
36 | |||
37 | ~~~ |
||
38 | |||
39 | ### Client |
||
40 | |||
41 | ~~~ |
||
42 | umask 077 |
||
43 | wg genkey | tee /etc/wireguard/private | wg pubkey > /etc/wireguard/publickey |
||
44 | wg set wg0 private-key /etc/wireguard/private |
||
45 | 17 | stephanie.vieville | ip link add dev wg0 type wireguard |
46 | 1 | sacha | ip link set wg0 up |
47 | 17 | stephanie.vieville | |
48 | 1 | sacha | ~~~ |
49 | 2 | sacha | |
50 | 12 | louis.leveque | ### Config serveur (Hypnos) |
51 | |||
52 | ~~~ |
||
53 | #!/bin/bash |
||
54 | |||
55 | set -x -e |
||
56 | |||
57 | # Creating the wireguard interface |
||
58 | ip link add dev wg0 type wireguard |
||
59 | |||
60 | # Setting the IP on the wireguard interface |
||
61 | ip address add dev wg0 185.233.101.127/24 |
||
62 | |||
63 | # Configuring the wireguard server |
||
64 | wg set wg0 listen-port 50000 private-key /etc/wireguard/private |
||
65 | |||
66 | # Starting up the wireguard interface |
||
67 | ip link set up dev wg0 |
||
68 | |||
69 | # Add Client |
||
70 | wg set wg0 peer W/iRbRNZhftkcmkfS/pUNcyDJ1YHB0cBEDigzed6+B0= allowed-ips 185.233.101.126/32 |
||
71 | |||
72 | # Create the static route for the client |
||
73 | ip route add 185.233.101.126/32 dev wg0 proto static |
||
74 | ~~~ |
||
75 | |||
76 | ### Config client |
||
77 | |||
78 | ~~~ |
||
79 | #!/bin/bash |
||
80 | |||
81 | set -e -x |
||
82 | |||
83 | # Creating the wireguard interface |
||
84 | ip link add dev wg0 type wireguard |
||
85 | |||
86 | # Setting the IP on the wireguard interface |
||
87 | ip address add dev wg0 185.233.101.126/24 |
||
88 | |||
89 | # Configuring wireguard |
||
90 | wg set wg0 private-key ./private |
||
91 | |||
92 | # Starting up the wireguard interface |
||
93 | ip link set up dev wg0 |
||
94 | |||
95 | # Connect to the server |
||
96 | wg set wg0 peer 'XRhI4WqBipwY21pxPZ9Q7EWkypnQCKKtJjqu2tUUTVo=' allowed-ips 0.0.0.0/0 endpoint 185.233.100.9:50000 |
||
97 | ~~~ |
||
98 | |||
99 | 4 | sacha | ### 1er test: @Sacha's Home (Fibre Bouygues) --> @Hypnos (VM Aquilenet) |
100 | 3 | sacha | |
101 | 2 | sacha | ~~~ |
102 | |||
103 | root@hypnos:/etc/wireguard# iperf3 -s |
||
104 | ----------------------------------------------------------- |
||
105 | Server listening on 5201 |
||
106 | ----------------------------------------------------------- |
||
107 | Accepted connection from 10.33.33.2, port 60038 |
||
108 | [ 5] local 10.33.33.1 port 5201 connected to 10.33.33.2 port 60040 |
||
109 | [ ID] Interval Transfer Bandwidth |
||
110 | [ 5] 0.00-1.00 sec 15.1 MBytes 127 Mbits/sec |
||
111 | [ 5] 1.00-2.00 sec 19.9 MBytes 167 Mbits/sec |
||
112 | [ 5] 2.00-3.00 sec 20.1 MBytes 169 Mbits/sec |
||
113 | [ 5] 3.00-4.00 sec 20.1 MBytes 169 Mbits/sec |
||
114 | [ 5] 4.00-5.00 sec 19.7 MBytes 166 Mbits/sec |
||
115 | [ 5] 5.00-6.00 sec 20.0 MBytes 168 Mbits/sec |
||
116 | [ 5] 6.00-7.00 sec 20.2 MBytes 169 Mbits/sec |
||
117 | [ 5] 7.00-8.00 sec 20.2 MBytes 170 Mbits/sec |
||
118 | [ 5] 8.00-9.00 sec 20.1 MBytes 169 Mbits/sec |
||
119 | [ 5] 9.00-10.00 sec 20.2 MBytes 169 Mbits/sec |
||
120 | [ 5] 10.00-10.03 sec 566 KBytes 165 Mbits/sec |
||
121 | - - - - - - - - - - - - - - - - - - - - - - - - - |
||
122 | [ ID] Interval Transfer Bandwidth |
||
123 | [ 5] 0.00-10.03 sec 0.00 Bytes 0.00 bits/sec sender |
||
124 | [ 5] 0.00-10.03 sec 196 MBytes 164 Mbits/sec receiver |
||
125 | ----------------------------------------------------------- |
||
126 | Server listening on 5201 |
||
127 | ----------------------------------------------------------- |
||
128 | ~~~ |
||
129 | |||
130 | |||
131 | ~~~ |
||
132 | root@hypnos:/etc/wireguard# wg |
||
133 | interface: wg0 |
||
134 | public key: Va0X1zOpRc9471Aa3DEUUy7UkAv5aq5SojtIPqOSqwg= |
||
135 | private key: (hidden) |
||
136 | listening port: 50000 |
||
137 | |||
138 | peer: VEfmgnq/aXPX3qBB7Q2fgxAawQdfUYZDRKEQSPC8tnA= |
||
139 | endpoint: 5.51.0.155:3418 |
||
140 | allowed ips: 10.33.33.0/24 |
||
141 | latest handshake: 4 minutes, 30 seconds ago |
||
142 | transfer: 208.75 MiB received, 6.68 MiB sent |
||
143 | ~~~ |
||
144 | 5 | sacha | |
145 | ## InstallDebian sur Apu2 |
||
146 | |||
147 | https://blog.pgeiser.com/posts/2017/04/installing-debian-stretch-on-a-machine-without-a-graphic-card/ |
||
148 | 6 | sacha | |
149 | 18 | xavier | ~~~ |
150 | 22 | sacha | apt-get install aptitude \ |
151 | 18 | xavier | dhcpd resolvconf \ |
152 | curl dnsutils htop iperf3 tcpdump tmux whois \ |
||
153 | 1 | sacha | debian-security-support debsums needrestart |
154 | 18 | xavier | ~~~ |
155 | 8 | sacha | |
156 | ~~~ |
||
157 | #!/bin/bash |
||
158 | gw=`ip route | awk '/default/ { print $3 }'` |
||
159 | 9 | sacha | sysctl -w net.ipv4.ip_forward=1 |
160 | 8 | sacha | ip link add dev wg0 type wireguard |
161 | ip address add dev wg0 10.33.33.2/24 |
||
162 | ip link set up dev wg0 |
||
163 | ip route add 185.233.100.19/32 via $gw dev enp1s0 |
||
164 | ip route del default |
||
165 | ip route add default dev wg0 |
||
166 | wg setconf wg0 /etc/wireguard/wg0.conf |
||
167 | ~~~ |
||
168 | 10 | sacha | |
169 | https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick.8 |
||
170 | https://git.zx2c4.com/WireGuard/about/src/tools/wg.8 |
||
171 | 16 | sacha | |
172 | https://vincent.bernat.ch/fr/blog/2018-vpn-wireguard-route |