WireGuard VPN 配置完全指南

# Ubuntu 20.04+ / Debian 11+
sudo apt update
sudo apt install wireguard

# 如果内核版本低于 5.6，需要安装内核模块
sudo apt install wireguard-dkms

# 安装命令行工具（通常已包含）
sudo apt install wireguard-tools

# CentOS 8+ / Rocky Linux 8+ / AlmaLinux 8+
sudo dnf install elrepo-release epel-release
sudo dnf install kmod-wireguard wireguard-tools

# RHEL 9 / Rocky Linux 9+（内核 5.14 内置支持）
sudo dnf install wireguard-tools

# 检查 WireGuard 内核模块
sudo modprobe wireguard
lsmod | grep wireguard

# 检查工具版本
wg --version

# 生成私钥（并设置安全权限）
wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod 600 /etc/wireguard/private.key

# 从私钥导出公钥
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

# 一行命令同时生成并显示
# 私钥保存到文件，公钥输出到终端
umask 077
wg genkey | tee /etc/wireguard/private.key | wg pubkey | tee /etc/wireguard/public.key

# 临时启用
sudo sysctl -w net.ipv4.ip_forward=1

# 永久启用
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# 使用 Homebrew 安装
brew install wireguard-tools

# 客户端配置文件可放在任意位置
# 然后通过 macOS WireGuard 应用导入或命令行启动
sudo wg-quick up /path/to/wg0.conf

# 安装 qrencode
sudo apt install qrencode

# 生成客户端配置文件的二维码
qrencode -t ansiutf8 < /etc/wireguard/client.conf

# 使用 wg-quick 启动（推荐）
sudo wg-quick up wg0

# 使用 systemd 管理（wg0 接口对应 wg-quick@wg0）
sudo systemctl start wg-quick@wg0
sudo systemctl enable wg-quick@wg0   # 开机自启
sudo systemctl status wg-quick@wg0

# 查看所有 WireGuard 接口状态
sudo wg show

# 查看特定接口的详细信息
sudo wg show wg0

# 查看传输统计
sudo wg show wg0 transfer

# 停止接口
sudo wg-quick down wg0

# 禁用开机自启
sudo systemctl disable wg-quick@wg0

# 完全删除接口
sudo ip link delete wg0

# 生成预共享密钥（每个 Peer 对可配置不同 PSK）
wg genpsk > /etc/wireguard/psk-peer-a.key

# 允许 WireGuard UDP 端口
sudo iptables -A INPUT -p udp --dport 51820 -j ACCEPT

# 允许 VPN 子网间的转发（Hub 模式）
sudo iptables -A FORWARD -i wg0 -j ACCEPT
sudo iptables -A FORWARD -o wg0 -j ACCEPT

# 允许 WireGuard 端口
sudo ufw allow 51820/udp

# 如果使用全流量隧道，允许转发
sudo sed -i 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
sudo ufw reload

# 查看当前 UDP 接收/发送缓冲区大小
sysctl net.core.rmem_default net.core.wmem_default

# 建议生产环境增大缓冲区（减少丢包）
sudo sysctl -w net.core.rmem_max=26214400
sudo sysctl -w net.core.wmem_max=26214400

# 永久生效
echo "net.core.rmem_max = 26214400" | sudo tee -a /etc/sysctl.conf
echo "net.core.wmem_max = 26214400" | sudo tee -a /etc/sysctl.conf

# 绑定到指定 CPU 核心
echo "2" | sudo tee /sys/class/net/wg0/queues/rx-0/rps_cpus
echo "2" | sudo tee /sys/class/net/wg0/queues/tx-0/xps_cpus

# 实时查看 WireGuard 日志
sudo journalctl -f -u wg-quick@wg0

# 测试端口连通性（从客户端）
nc -uv 203.0.113.10 51820
# 输入任意字符后按 Ctrl+C，服务端应显示握手

# 抓包调试
sudo tcpdump -i eth0 udp port 51820 -n

# 查看路由表
ip route show table all | grep wg0

#!/bin/bash
# WireGuard 服务端一键部署脚本
# 适用于 Ubuntu 20.04+ / Debian 11+

set -e

# 配置
VPN_SUBNET="10.0.0.0/24"
SERVER_VPN_IP="10.0.0.1/24"
SERVER_PUBLIC_INTERFACE=$(ip route get 8.8.8.8 | awk '{print $5}' | head -n1)
WG_PORT=51820

echo "=== WireGuard 服务端部署 ==="

# 1. 安装
echo "[1/5] 安装 WireGuard..."
apt update -qq
apt install -y wireguard qrencode

# 2. 启用 IP 转发
echo "[2/5] 启用 IP 转发..."
sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

# 3. 生成密钥
echo "[3/5] 生成服务端密钥对..."
umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey | tee /etc/wireguard/server.pub

# 4. 生成配置
echo "[4/5] 生成服务端配置..."
cat > /etc/wireguard/wg0.conf << EOF
[Interface]
Address = ${SERVER_VPN_IP}
ListenPort = ${WG_PORT}
PrivateKey = $(cat /etc/wireguard/server.key)
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ${SERVER_PUBLIC_INTERFACE} -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ${SERVER_PUBLIC_INTERFACE} -j MASQUERADE
EOF

# 5. 启动并启用
echo "[5/5] 启动 WireGuard..."
systemctl start wg-quick@wg0
systemctl enable wg-quick@wg0

echo "=== 部署完成 ==="
echo "服务端公钥: $(cat /etc/wireguard/server.pub)"
echo "服务端地址: $(curl -s ifconfig.me):${WG_PORT}"
echo ""
echo "客户端配置示例："
cat << EOF
[Interface]
Address = 10.0.0.2/24
PrivateKey = <客户端私钥>
DNS = 1.1.1.1

[Peer]
PublicKey = $(cat /etc/wireguard/server.pub)
Endpoint = $(curl -s ifconfig.me):${WG_PORT}
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF