Wireguard: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
Zeile 259: | Zeile 259: | ||
VPN_ID=wg0 | VPN_ID=wg0 | ||
IP_SERVER=10.10.100.1/16 | IP_SERVER=10.10.100.1/16 | ||
IP_PUBLIC=139.44.33.91 | |||
DNS_SERVER=9.9.9.9 | |||
HOST=$(hostname) | HOST=$(hostname) | ||
PORT=51820 | PORT=51820 | ||
./BuildServer $VPN_ID $IP_SERVER $HOST $PORT | ./BuildServer $VPN_ID $IP_SERVER $IP_PUBLIC $HOST $PORT $DNS_SERVER | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Version vom 2. April 2023, 08:02 Uhr
Links
Installation
apt install wireguard resolvconf
Zentrale einrichten
Ablauf der Konfiguration
- Scripts erzeugen: Kapitel "Scripts erstellen"
- Server konfigurieren: Kapitel "Konfiguration Server"
- Beliebig viele Clients konfigurieren: "Konfiguration existierender Client (Public Key bekannt)" oder "Erzeugen Client (Keys werden erzeugt)"
- Wireguard-Konfiguration erzeugen: Kapitel "Wireguard Konfiguration erzeugen"
- Client löschen:
- db/<vpn-id>/clients/<client>.conf löschen
- Kapitel "Wireguard Konfiguration erzeugen"
- Client ändern (z.B. erlaubte Netze)
- db/<vpn-id>/clients/<client>.conf ändern
- Kapitel "Wireguard Konfiguration erzeugen"
- neuer Client:
- "Konfiguration existierender Client (Public Key bekannt)" oder "Erzeugen Client (Keys werden erzeugt)"
- Wireguard-Konfiguration erzeugen: Kapitel "Wireguard Konfiguration erzeugen"
Scripts erstellen
Script für Initialisierung: Build
FN_SCRIPT=/etc/wireguard/Build
cat <<'ESCRIPT' >$FN_SCRIPT
#! /bin/bash
VPN_ID=$1
function Server(){
source db/$VPN_ID/server.conf
cat <<EOS >$VPN_ID.conf
[Interface]
Address = $IP_SERVER
ListenPort = $PORT
PrivateKey = $PRIVATE_KEY
EOS
echo "= created: $VPN_ID.conf"
}
function Client(){
local config=$1
source $config
local fn=$VPN_ID.conf
cat <<EOS >>$fn
[Peer]
# client $CLIENT
PublicKey = $PUB_KEY
AllowedIPs = $ALLOWED_IPS
EOS
}
function Usage(){
echo "Usage: Build VPN_ID"
echo "Example: Build wg0"
echo "+++ $*"
}
if [ -z "$VPN_ID" ]; then
Usage "missing VPN_ID"
elif [ ! -d db/$VPN_ID ]; then
Usage "VPN_ID not defined: $VPN_ID"
echo "= available:"
for dir in db/*; do
test -d $dir/clients && echo $(basename $dir)
done
else
Server
for client in db/$VPN_ID/clients/*.conf; do
Client $client
done
fi
ESCRIPT
echo "created: $FN_SCRIPT"
chmod +x $FN_SCRIPT
Script zum Server konfigurieren
FN_SCRIPT=/etc/wireguard/BuildServer
cat <<'SCRIPT' >$FN_SCRIPT
#! /bin/bash
VPN_ID=$1
IP_SERVER=$2
IP_PUBLIC=$3
HOST=$4
PORT=$5
DNS_SERVER=$6
test -z "$HOST" && HOST=$(hostname)
test -z "$PORT" && PORT=51820
test -z "$DNS_SERVER" && DNS_SERVER=9.9.9.9
function Usage(){
echo "Usage BuildServer VPN_ID IP_VPN IP_PUBLIC [HOST [PORT [DNS_SERVER]]]"
echo "Example: BuildServer wg0 10.10.100.1/24 207.180.255.91 dragon 51820 9.9.9.9"
echo "+++ $*"
}
function Create(){
mkdir -p db/$VPN_ID/clients
local fnPrivateKey=db/$VPN_ID/private.key
if [ ! -e $fnPrivateKey ]; then
wg genkey > $fnPrivateKey
chmod go= $fnPrivateKey
echo "= created: $fnPrivateKey"
fi
local fnPublicKey=db/$VPN_ID/public.key
if [ ! -e $fnPublicKey ]; then
wg <$fnPrivateKey pubkey >$fnPublicKey
echo "= created: $fnPublicKey"
fi
local fnConfig=db/$VPN_ID/server.conf
cat <<EOS >$fnConfig
VPN_ID=$VPN_ID
IP_SERVER=$IP_SERVER
PORT=$PORT
DNS_SERVER=$DNS_SERVER
IP_PUBLIC=$IP_PUBLIC
PRIVATE_KEY=$(cat $fnPrivateKey)
PUBLIC_KEY=$(cat $fnPublicKey)
EOS
chmod og= $fnConfig
echo "= created: $fnConfig"
}
if [ -z "$IP_SERVER" ]; then
Usage "missing IP_SERVER"
elif [ ${1/\//} != $1 ]; then
Usage "wrong IP_SERVER: $IP_SERVER"
else
Create
fi
SCRIPT
chmod +x $FN_SCRIPT
echo "= created: $FN_SCRIPT"
Script zur Clientkonfiguration: ImportClient
Zur Anwendung dieses Scripts ist der Public Key schon vorhanden.
FN_SCRIPT=/etc/wireguard/ImportClient
#! /bin/bash
cat <<'SCRIPT' >$FN_SCRIPT
VPN_ID=$1
CLIENT=$2
PUBLIC_KEY=$3
IP_CLIENT=$4
ALLOWED_IPS=$5
function Usage(){
echo "Usage: ImportClient VPN_ID CLIENT_NAME IP_CLIENT PUB_KEY ALLOWED_IDS"
echo "Example: ImportClient wg0 joe 10.10.100.44/32 0fajdkafkdla02jiw902902= 10.10.100.0/24,10.10.101.0/24"
echo "+++ $*"
}
function Create(){
mkdir -p db/$VPN_ID/clients
local fnConfig=db/$VPN_ID/clients/$CLIENT.conf
cat <<EOS >$fnConfig
CLIENT=$CLIENT
PUB_KEY=$PUBLIC_KEY
ALLOWED_IPS=$ALLOWED_IPS
EOS
echo "= created: $fnConfig"
}
if [ -z "$ALLOWED_IPS" ]; then
Usage "missing arguments"
elif [ ! -d db/$VPN_ID ]; then
Usage "unknown VPN_ID: $VPN_ID"
else
Create
fi
SCRIPT
chmod +x $FN_SCRIPT
echo "= created: $FN_SCRIPT"
Script zur Clientkonfiguration: ExportClient
Erzeugt Konfiguration für neuen Client (inklusive Erzeugung der Schlüssel).
FN_SCRIPT=/etc/wireguard/ExportClient
cat <<'SCRIPT' >$FN_SCRIPT
#! /bin/bash
VPN_ID=$1
CLIENT=$2
IP_CLIENT=$3
ALLOWED_IPS=$4
function Usage(){
echo "Usage: ExportClient VPN_ID CLIENT_NAME IP_CLIENT ALLOWED_IDS"
echo "Example: ExportClient wg0 joe 10.10.100.44/32 10.10.100.0/24,10.10.101.0/24"
echo "+++ $*"
}
function CreateIntern(){
mkdir -p db/$VPN_ID/clients
local fnConfig=db/$VPN_ID/clients/$CLIENT.conf
cat <<EOS >$fnConfig
CLIENT=$CLIENT
PUB_KEY=$PUBLIC_KEY_CLIENT
ALLOWED_IPS=$ALLOWED_IPS
EOS
echo "= created: $fnConfig"
fnConfig=exported/$VPN_ID.$CLIENT.conf
mkdir -p $(dirname $fnConfig)
cat <<EOS >$fnConfig
EOS
}
function CreateExport(){
local fnConfig=export/$VPN_ID.$CLIENT.conf
mkdir -p $(dirname $fnConfig)
source db/$VPN_ID/server.conf
local privateKey=$(wg genkey)
PUBLIC_KEY_CLIENT=$(echo $privateKey | wg pubkey)
cat <<EOS >$fnConfig
VPN_ID=$VPN_ID
DNS_SERVER=$DNS_SERVER
IP_SERVER=$IP_PUBLIC
IP_CLIENT=$IP_CLIENT
PORT_SERVER=$PORT
ALLOWED_IPS=$ALLOWED_IDS
PRIV_KEY=$privateKey
PUB_KEY=$PUBLIC_KEY_CLIENT
PUBKEY_SERVER=$(cat /etc/wireguard/db/$VPN_ID/public.key)
EOS
echo "= created: $fnConfig"
}
fnConfig=exported/$VPN_ID.$CLIENT.conf
if [ -z "$ALLOWED_IPS" ]; then
Usage "missing arguments"
elif [ ! -d db/$VPN_ID ]; then
Usage "unknown VPN_ID: $VPN_ID"
else
CreateExport
CreateIntern
fi
SCRIPT
chmod +x $FN_SCRIPT
echo "= created: $FN_SCRIPT"
Wireguard-Konfiguration erzeugen
cd /etc/wireguard
VPN_ID=wg0
./Build $VPN_ID
Konfiguration Server
cd /etc/wireguard
VPN_ID=wg0
IP_SERVER=10.10.100.1/16
IP_PUBLIC=139.44.33.91
DNS_SERVER=9.9.9.9
HOST=$(hostname)
PORT=51820
./BuildServer $VPN_ID $IP_SERVER $IP_PUBLIC $HOST $PORT $DNS_SERVER
Konfiguration existierender Client (Public Key bekannt)
VPN_ID=wg0
CLIENT=joe
IP_CLIENT=10.58.1.10/32
PUB_KEY=0fajdkafkdla02jiw902902=
ALLOWED_IPS=10.58.1.0/24
./ImportClient $VPN_ID $CLIENT $IP_CLIENT $PUB_KEY $ALLOWED_IPS
Erzeugen Client (Keys werden erzeugt)
cd /etc/wireguard
VPN_ID=wg0
CLIENT=joe
IP_CLIENT=10.58.1.10/32
ALLOWED_IPS=10.58.1.0/24
./ExportClient $VPN_ID $CLIENT $IP_CLIENT $ALLOWED_IPS
Linux Client einrichten
apt install wireguard-tools
Script erzeugen
FN_SCRIPT=/etc/wireguard/Import
cat <<'SCRIPT' >$FN_SCRIPT
#! /bin/bash
CONFIG=$1
function Usage(){
echo "Usage: Import IMPORT_FILE"
echo "Example: Import db/wg0.joe.conf"
echo "+++ $*"
}
function Create(){
local fn=$1
source $fn
if [ -z "$VPN_ID" -o -z "$DNS_SERVER" -o -z "$IP_SERVER" -o -z "$IP_CLIENT" ]; then
echo "+++ wrong import data in $fn: vpn: $VPN_ID dns: $DNS_SERVER ip: $IP_SERVER ipcl: $IP_CLIENT"
elif [ -z "$PORT_SERVER" -o -z "$ALLOWED_IPS" ]; then
echo "+++ wrong import data: port: $PORT_SERVER allowed: $ALLOWED_IPS"
elif [ -z "$PRIV_KEY" -o -z "$PUB_KEY" -o -z "$PUBKEY_SERVER" ]; then
echo "+++ wrong import data: pub: $PUB_KEY priv: $PRIV_KEY pub-sv: $PUBKEY_SERVER"
else
local fnPrivate=/etc/wireguard/db/$VPN_ID.private.key
echo $PUB_KEY > db/$VPN_ID.public.key
echo $PRIV_KEY > $fnPrivate
chmod og= $fnPrivate
local config=/etc/wireguard/$VPN_ID.conf
cat <<EOS >$config
[Interface]
Address = $IP_CLIENT
DNS = $DNS_SERVER
# Load your privatekey from file
PostUp = wg set %i private-key $fnPrivate
# Also ping the vpn server to ensure the tunnel is initialized
PostUp = ping -c1 $IP_SERVER
[Peer]
PublicKey = $PUBKEY_SERVER
Endpoint = $IP_SERVER:$PORT_SERVER
AllowedIPs = $ALLOWED_IPS
PersistentKeepalive = 15
EOS
echo "= created: $config"
fi
}
if [ -z "$CONFIG" ]; then
Usage "Missing parameter CONFIG_FILE"
elif [ ! -e $CONFIG ]; then
Usage "Missing configuration file $CONFIG"
else
Create $CONFIG
fi
SCRIPT
Importieren der Daten
mkdir -p /etc/wireguard
cd /etc/wireguard
CONFIG=/Downloads/wg0.joe.conf
./Import $CONFIG