Bearbeiten von „Wireguard“

= Links =
* [[Wireguard-ui]]

= Installation =
<syntaxhighlight lang="bash">
apt install wireguard resolvconf
</syntaxhighlight>

== Zentrale einrichten ==
=== Ablauf der Konfiguration ===
* Scripts erzeugen: Kapitel "Scripts erstellen"
* Server konfigurieren: Kapitel "Konfiguration Server"
* Beliebig viele Clients konfigurieren: "Konfiguration existierender Client (Public Key bekannt)" oder "Erzeugen Client (Keys werden erzeugt)"
* Wireguard-Konfiguration erzeugen: Kapitel "Wireguard Konfiguration erzeugen"

* Client löschen:
** db/<vpn-id>/clients/<client>.conf löschen
** Kapitel "Wireguard Konfiguration erzeugen"
* Client ändern (z.B. erlaubte Netze)
** db/<vpn-id>/clients/<client>.conf ändern
** Kapitel "Wireguard Konfiguration erzeugen"
* neuer Client:
** "Konfiguration existierender Client (Public Key bekannt)" oder "Erzeugen Client (Keys werden erzeugt)"
** Wireguard-Konfiguration erzeugen: Kapitel "Wireguard Konfiguration erzeugen"

=== Scripts erstellen ===
==== Script für Initialisierung: Build ====
<syntaxhighlight lang="bash">
FN_SCRIPT=/etc/wireguard/Build
cat <<'ESCRIPT' >$FN_SCRIPT
#! /bin/bash
VPN_ID=$1

function Server(){
  source db/$VPN_ID/server.conf
  cat <<EOS >$VPN_ID.conf
[Interface]
Address = $IP_SERVER 
ListenPort = $PORT
PrivateKey = $PRIVATE_KEY

EOS
  echo "= created: $VPN_ID.conf"
}

function Client(){
  local config=$1
  source $config
  local fn=$VPN_ID.conf
  cat <<EOS >>$fn
[Peer]
# client $CLIENT
PublicKey = $PUB_KEY
AllowedIPs = $ALLOWED_IPS

EOS
}
function Usage(){
  echo "Usage: Build VPN_ID"
  echo "Example: Build wg0"
  echo "+++ $*"
}
if [ -z "$VPN_ID" ]; then
  Usage "missing VPN_ID"
elif [ ! -d db/$VPN_ID ]; then
  Usage "VPN_ID not defined: $VPN_ID"
  echo "= available:"
  for dir in db/*; do
    test -d $dir/clients && echo $(basename $dir)
  done
else
  Server
  for client in db/$VPN_ID/clients/*.conf; do
    Client $client
  done
fi
ESCRIPT
echo "created: $FN_SCRIPT"
chmod +x $FN_SCRIPT
</syntaxhighlight>

==== Script zum Server konfigurieren ====
<syntaxhighlight lang="bash">
FN_SCRIPT=/etc/wireguard/BuildServer
cat <<'SCRIPT' >$FN_SCRIPT
#! /bin/bash
VPN_ID=$1
IP_SERVER=$2
IP_PUBLIC=$3
HOST=$3
PORT=$4
DNS_SERVER=$5

test -z "$HOST" && HOST=$(hostname)
test -z "$PORT" && PORT=51820
test -z "$DNS_SERVER" && DNS_SERVER=9.9.9.9

function Usage(){
  echo "Usage BuildServer VPN_ID IP_VPN IP_PUBLIC [HOST [PORT [DNS_SERVER]]]"
  echo "Example: BuildServer wg0 10.10.100.1/24 207.180.255.91 dragon 51820 9.9.9.9"
  echo "+++ $*"
}

function Create(){
  mkdir -p db/$VPN_ID/clients
  local fnPrivateKey=db/$VPN_ID/private.key
  if [ ! -e $fnPrivateKey ]; then
    wg genkey > $fnPrivateKey
    chmod go= $fnPrivateKey
    echo "= created: $fnPrivateKey"
  fi
  local fnPublicKey=db/$VPN_ID/public.key
  if [ ! -e $fnPublicKey ]; then
    wg <$fnPrivateKey pubkey >$fnPublicKey
    echo "= created: $fnPublicKey" 
  fi
  local fnConfig=db/$VPN_ID/server.conf
  cat <<EOS >$fnConfig
VPN_ID=$VPN_ID
IP_SERVER=$IP_SERVER
PORT=$PORT
DNS_SERVER=$DNS_SERVER
IP_PUBLIC=$IP_PUBLIC
PRIVATE_KEY=$(cat $fnPrivateKey)
PUBLIC_KEY=$(cat $fnPublicKey)
EOS
  chmod og= $fnConfig
  echo "= created: $fnConfig"
}

if [ -z "$IP_SERVER" ]; then
  Usage "missing IP_SERVER"
elif [ ${1/\//} != $1 ]; then
  Usage "wrong IP_SERVER: $IP_SERVER"
else
  Create
fi
SCRIPT
chmod +x $FN_SCRIPT
echo "= $FN_SCRIPT erstellt"
</syntaxhighlight>

==== Script zur Clientkonfiguration: ImportClient ====
Zur Anwendung dieses Scripts ist der Public Key schon vorhanden.
<syntaxhighlight lang="bash">
FN_SCRIPT=/etc/wireguard/ImportClient
#! /bin/bash
cat <<'SCRIPT' >$FN_SCRIPT
VPN_ID=$1
CLIENT=$2
PUBLIC_KEY=$3
IP_CLIENT=$4
ALLOWED_IPS=$5

function Usage(){
  echo "Usage: BuildClient VPN_ID CLIENT_NAME IP_CLIENT PUB_KEY ALLOWED_IDS"
  echo "Example: BuildClient wg0 joe 10.10.100.44/32 0fajdkafkdla02jiw902902= 10.10.100.0/24,10.10.101.0/24"
  echo "+++ $*"
}

function Create(){
  mkdir -p db/$VPN_ID/clients
  local fnConfig=db/$VPN_ID/clients/$CLIENT.conf
  cat <<EOS >$fnConfig
CLIENT=$CLIENT
PUB_KEY=$PUBLIC_KEY
ALLOWED_IPS=$ALLOWED_IPS
EOS
  echo "= created: $fnConfig"
}

if [ -z "$ALLOWED_IPS" ]; then
  Usage "missing arguments"
elif [ ! -d db/$VPN_ID ]; then
  Usage "unknown VPN_ID: $VPN_ID"
else
  Create
fi
SCRIPT
chmod +x $FN_SCRIPT
echo "= $FN_SCRIPT erstellt"
</syntaxhighlight>

==== Script zur Clientkonfiguration: ExportClient ====
Erzeugt Konfiguration für neuen Client (inklusive Erzeugung der Schlüssel).
<syntaxhighlight lang="bash">
FN_SCRIPT=/etc/wireguard/ExportClient
cat <<'SCRIPT' >$FN_SCRIPT
#! /bin/bash
VPN_ID=$1
CLIENT=$2
IP_CLIENT=$3
ALLOWED_IPS=$4

function Usage(){
  echo "Usage: ExportClient VPN_ID CLIENT_NAME IP_CLIENT ALLOWED_IDS"
  echo "Example: ExportClient wg0 joe 10.10.100.44/32 10.10.100.0/24,10.10.101.0/24"
  echo "+++ $*"
}

function CreateIntern(){
  mkdir -p db/$VPN_ID/clients
  local fnConfig=db/$VPN_ID/clients/$CLIENT.conf
  cat <<EOS >$fnConfig
CLIENT=$CLIENT
PUB_KEY=$PUBLIC_KEY_CLIENT
ALLOWED_IPS=$ALLOWED_IPS
EOS
  echo "= created: $fnConfig"
  fnConfig=exported/$VPN_ID.$CLIENT.conf
  mkdir -p $(dirname $fnConfig)
  cat <<EOS >$fnConfig
EOS
}

function CreateExport(){
  local fnConfig=export/$VPN_ID.$CLIENT.conf
  mkdir -p $(dirname $fnConfig)
  source db/$VPN_ID/server.conf
  local privateKey=$(wg genkey)
  PUBLIC_KEY_CLIENT=$(echo $privateKey | wg pubkey)
  cat <<EOS >$fnConfig
VPN_ID=$VPN_ID
DNS_SERVER=$DNS_SERVER
IP_SERVER=$IP_PUBLIC
IP_CLIENT=$IP_CLIENT
PORT_SERVER=$PORT
ALLOWED_IPS=$ALLOWED_IDS
PRIV_KEY=$privateKey
PUB_KEY=$PUBLIC_KEY_CLIENT
PUBKEY_SERVER=$(cat /etc/wireguard/db/$VPN_ID/public.key)
EOS
  echo "= created: $fnConfig"
}
  fnConfig=exported/$VPN_ID.$CLIENT.conf
if [ -z "$ALLOWED_IPS" ]; then
  Usage "missing arguments"
elif [ ! -d db/$VPN_ID ]; then
  Usage "unknown VPN_ID: $VPN_ID"
else
  CreateExport
  CreateIntern
fi
SCRIPT
chmod +x $FN_SCRIPT
echo "= created: $FN_SCRIPT"
</syntaxhighlight>

=== Wireguard-Konfiguration erzeugen ===
<syntaxhighlight lang="bash">
cd /etc/wireguard
VPN_ID=wg0
./Build $VPN_ID
</syntaxhighlight>

=== Konfiguration Server ===
<syntaxhighlight lang="bash">
cd /etc/wireguard
VPN_ID=wg0
IP_SERVER=10.10.100.1/16
HOST=$(hostname)
PORT=51820
./BuildServer $VPN_ID $IP_SERVER $HOST $PORT
</syntaxhighlight>

=== Konfiguration existierender Client (Public Key bekannt) ===
<syntaxhighlight lang="bash">
VPN_ID=wg0
CLIENT=joe
IP_CLIENT=10.58.1.10/32
PUB_KEY=0fajdkafkdla02jiw902902=
ALLOWED_IPS=10.58.1.0/24
./ImportClient $VPN_ID $CLIENT $IP_CLIENT $PUB_KEY $ALLOWED_IPS
</syntaxhighlight>

=== Erzeugen Client (Keys werden erzeugt) ===
<syntaxhighlight lang="bash">
cd /etc/wireguard
VPN_ID=wg0
CLIENT=joe
IP_CLIENT=10.58.1.10/32
ALLOWED_IPS=10.58.1.0/24
./ExportClient $VPN_ID $CLIENT $IP_CLIENT $ALLOWED_IPS
</syntaxhighlight>

== Linux Client einrichten ==
<syntaxhighlight lang="bash">
apt install wireguard-tools
</syntaxhighlight>
=== Script erzeugen ===
<syntaxhighlight lang="bash">
FN_SCRIPT=/etc/wireguard/Import
cat <<'SCRIPT' >$FN_SCRIPT
#! /bin/bash
CONFIG=$1

function Usage(){
  echo "Usage: Import IMPORT_FILE"
  echo "Example: Import db/wg0.joe.conf"
  echo "+++ $*"
}

function Create(){
  local fn=$1
  source $fn
  if [ -z "$VPN_ID" -o -z "$DNS_SERVER" -o -z "$IP_SERVER" -o -z "$IP_CLIENT" ]; then
    echo "+++ wrong import data in $fn: vpn: $VPN_ID dns: $DNS_SERVER ip: $IP_SERVER ipcl: $IP_CLIENT"
  elif [ -z "$PORT_SERVER" -o -z "$ALLOWED_IPS" ]; then
    echo "+++ wrong import data: port: $PORT_SERVER allowed: $ALLOWED_IPS"
  elif [ -z "$PRIV_KEY" -o -z "$PUB_KEY" -o -z "$PUBKEY_SERVER" ]; then
    echo "+++ wrong import data: pub: $PUB_KEY priv: $PRIV_KEY pub-sv: $PUBKEY_SERVER"
  else
    local fnPrivate=/etc/wireguard/db/$VPN_ID.private.key
    echo $PUB_KEY > db/$VPN_ID.public.key
    echo $PRIV_KEY > $fnPrivate
    chmod og= $fnPrivate 
    local config=/etc/wireguard/$VPN_ID.conf
    cat <<EOS >$config
[Interface]
Address = $IP_CLIENT
DNS = $DNS_SERVER
# Load your privatekey from file
PostUp = wg set %i private-key $fnPrivate
# Also ping the vpn server to ensure the tunnel is initialized
PostUp = ping -c1 $IP_SERVER

[Peer]
PublicKey = $PUBKEY_SERVER
Endpoint = $IP_SERVER:$PORT_SERVER
AllowedIPs = $ALLOWED_IPS
PersistentKeepalive = 15
EOS
    echo "= created: $config"
  fi
}
if [ -z "$CONFIG" ]; then
  Usage "Missing parameter CONFIG_FILE"
elif [ ! -e $CONFIG ]; then
  Usage "Missing configuration file $CONFIG"
else
  Create $CONFIG
fi
SCRIPT
</syntaxhighlight>

=== Importieren der Daten ===
<syntaxhighlight lang="bash">
mkdir -p /etc/wireguard
cd /etc/wireguard
CONFIG=/Downloads/wg0.joe.conf
./Import $CONFIG
</syntaxhighlight>