[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6},"actionData","errors","routes/tags.$tag",{"_7":8,"_9":10,"_11":12},"tag","wireguard","docs",[13],"count",1,{"_14":15,"_16":17,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27},"slug","setup-wireguard-on-alpine","title","WireGuard 配置指南","date","2023-11-13","description","在 Ubuntu 上安装和配置 WireGuard VPN","content","

WireGuard 是一个现代化的 VPN 协议，以简洁、高效和安全著称。

安装依赖

# 更新软件源（可选，使用国内镜像）\nsed -i 's@//.*archive.ubuntu.com@//mirrors.ustc.edu.cn@g' /etc/apt/sources.list\n\n# 安装 WireGuard\napt update\napt install wireguard curl resolvconf\n

启用 IP 转发

编辑 /etc/sysctl.conf：

net.ipv4.ip_forward=1\nnet.ipv6.conf.all.forwarding=1\n

应用配置：

sysctl -p\n

获取网络信息

ip route\n

示例输出：

default via 192.168.1.1 dev eth0 metric 202\n192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.99\n

记录本机 IP（如 192.168.1.99）和网关地址（如 192.168.1.1）。

配置 WireGuard

创建 /etc/wireguard/wg.conf：

[Interface]\nPrivateKey = <privateKey>\nAddress = 172.16.0.2/32\nDNS = 114.114.114.114\nMTU = 1280\n\nPostUp = ip rule add table 200 from <ip>\nPostUp = ip route add table 200 default via <gateway>\nPreDown = ip rule delete table 200 from <ip>\nPreDown = ip route delete table 200 default via <gateway>\n\n[Peer]\nPublicKey = <publicKey>\nAllowedIPs = 0.0.0.0/0\nEndpoint = engage.cloudflareclient.com:2408\n

配置说明：

PrivateKey: WireGuard 私钥，使用 wg genkey 生成
Address: VPN 内网地址
PostUp/PreDown: 路由规则，确保流量正确路由
AllowedIPs: 0.0.0.0/0 表示所有流量都走 VPN
Endpoint: 服务器端点地址

生成密钥

# 生成私钥\nwg genkey | tee privatekey | wg pubkey > publickey\n

启动和管理

# 启动 WireGuard\nwg-quick up wg\n\n# 停止 WireGuard\nwg-quick down wg\n\n# 查看连接状态\nwg show\n

使用 nftables 配置 NAT

如果需要将其他设备流量转发到 WireGuard，使用 nftables 配置 NAT：

chain natpostrouting {\n    type nat hook postrouting priority 100; policy accept;\n    iifname $wg_iface oifname $pub_iface masquerade\n}\n

\n
参考: How To Set Up WireGuard on Ubuntu 20.04
\n

","toc",[30,31,32,33,34,35,36],"tags",[28,8,29],"vpn","network",{"_37":45,"_39":58,"_41":42,"_43":59},{"_37":55,"_39":56,"_41":42,"_43":57},{"_37":45,"_39":53,"_41":42,"_43":54},{"_37":50,"_39":51,"_41":42,"_43":52},{"_37":45,"_39":48,"_41":42,"_43":49},{"_37":45,"_39":46,"_41":42,"_43":47},{"_37":38,"_39":40,"_41":42,"_43":44},"id","-nftables-nat","text","使用 nftables 配置 NAT","depth",2,"children",[],"","启动和管理",[],"生成密钥",[],"-wireguard","配置 WireGuard",[],"获取网络信息",[],"-ip-","启用 IP 转发",[],"安装依赖",[]]