Search Results for wireguard

使用WireGuard为阿里云专有网络主机提供外网访问

前言我的阿里云服务器网络处于混合过度模式，逐步从经典网络往专有网络迁移。之前每台经典网络主机都申请了公网IP和带宽，实际上对于大多数主机的业务而言，并不需要对外提供网络服务，只需要能访问外网即可。所以这次新加的主机部分都没有去加弹性公网IP。于是带来了问题：内网主机如何访问外网？阿里云的dnat方案太贵了。不考虑。尝试过本地配置网关，但是实验证明，阿里云的VPC交换机不是一个纯粹的二层交换，也许是设计有问题，也许是刻意阻止用户自己拿一台能访问公网的主机当内网网关。所以这次使用WireGuard实现网络架构调整。阿里云的经典网络主机里加了几条默认的路由：

10.0.0.0/8
172.16.0.0/12
100.64.0.0/10

10.0.0.0/8

172.16.0.0/12

100.64.0.0/10

前两个都好说，第三个是运营商级的NAT网络地址，之前在 OpenVPN Site-to-Site VPN between Asus Merlin And Ubnt EdgeRouter 里提过贵州电信的光纤网络对外就是这个地址段。 WireGuard的配置过程参考之前的文章，此处不多解释，只贴配置。 Link to this post!

EdgeRouter 部署 WireGuard

安装从 https://github.com/Lochnair/vyatta-wireguard/releases 下载对应的包 ERL, ER等 mips架构的，下载 octeon 版本 ERX 下载 ralink版本。可以选择上传到路由上，或者ssh登录路由，sudo su到root，执行类似如下的命令

curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-octeon-0.0.20170612-2.deb -o wireguard-octeon-0.0.20170612-2.deb

1	curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-octeon-0.0.20170612-2.deb -o wireguard-octeon-0.0.20170612-2.deb

或

curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-ralink-0.0.20170612-2.deb -o wireguard-ralink-0.0.20170612-2.deb

1	curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-ralink-0.0.20170612-2.deb -o wireguard-ralink-0.0.20170612-2.deb

下载完成后

dpkg -i xxx.deb

1	dpkg -i xxx.deb

配置执行下列命令生成私钥、共享密钥，公钥

wg genkey > /config/auth/wg.private
wg genpsk > /config/auth/wg.psk
chmod 0600 /config/auth/wg.*
wg pubkey < /config/auth/wg.private

wg genkey > /config/auth/wg.private

wg genpsk > /config/auth/wg.psk

chmod 0600 /config/auth/wg.*

wg pubkey < /config/auth/wg.private

将最后一个命令的输出复制下来，配置到服务器端获取服务器端的公钥，替换下文的“公钥”并执行命令

configure
set interfaces wireguard wg0 address 192.168.10.40/24
set interfaces wireguard wg0 listen-port 本地端口
set interfaces wireguard wg0 peer 公钥 allowed-ips 0.0.0.0/0
set interfaces wireguard wg0 peer 公钥 endpoint '服务器IP:端口'
set interfaces wireguard wg0 peer 公钥 preshared-key /config/auth/wg-eos.psk
set interfaces wireguard wg0 private-key /config/auth/wg.private
set interfaces wireguard wg0 route-allowed-ips false
commit
save

configure

set interfaces wireguard wg0 address 192.168.10.40/24

set interfaces wireguard wg0 listen-port 本地端口

set interfaces wireguard wg0 peer 公钥 allowed-ips 0.0.0.0/0

set interfaces wireguard wg0 peer 公钥 endpoint '服务器IP:端口'

set interfaces wireguard wg0 peer 公钥 preshared-key /config/auth/wg-eos.psk

set interfaces wireguard wg0 private-key /config/auth/wg.private

set interfaces wireguard wg0 route-allowed-ips false

commit

save

配置好设备后，配置nat服务

configure
set service nat rule 5032 outbound-interface wg0
set service nat rule 5032 type masquerade
commit 
save

configure

set service nat rule 5032 outbound-interface wg0

set service nat rule 5032 type masquerade

commit

save

剩下就是配置路由规则了，可以参考我的其他blog. Incoming search terms:wireguardedgerouter 4 wireguardwg genkey > /config/auth/wg private wg genpsk > /config/auth/wg psk chmod 0600 /config/auth/wg * wg pubkey < /config/auth/wg privatewireguard address 192 168 10 … Continue reading “EdgeRouter 部署 WireGuard”

Ubuntu部署WireGuard

安装WireGuard 按照官方说明，可以使用下列命令装依赖，不够的自己看着装

apt-get install libmnl-dev linux-headers-$(uname -r) build-essential pkg-config

1	apt-get install libmnl-dev linux-headers-$(uname -r) build-essential pkg-config

直接从git里拉。

git clone https://git.zx2c4.com/WireGuard

1	git clone https://git.zx2c4.com/WireGuard

直接make就行

cd WireGuard/src
make
make install

cd WireGuard/src

make

make install

配置参考前一篇文章“WireGuard wg-quick PostUp的高级玩法”，可以直接无视官方和其他各种第三方给的教程。前文给了一个参考的配置。

[Interface]
Address = 192.168.10.1/24
MTU = 1500
PrivateKey = xxx
PostUp = echo -n "hello" > /dev/udp/192.168.1.1/80; echo -n "hello" > /dev/udp/192.168.2.1/80
 
[Peer]
PublicKey = xxx
AllowedIPs = 192.168.10.40/32, 192.168.1.0/24
Endpoint = 2.2.2.2:12345
 
[Peer]
PublicKey = xxx
AllowedIPs = 192.168.10.50/32, 192.168.2.0/24
Endpoint = 3.3.3.3:12345

[Interface]

Address = 192.168.10.1/24

MTU = 1500

PrivateKey = xxx

PostUp = echo -n "hello" > /dev/udp/192.168.1.1/80; echo -n "hello" > /dev/udp/192.168.2.1/80

[Peer]

PublicKey = xxx

AllowedIPs = 192.168.10.40/32, 192.168.1.0/24

Endpoint = 2.2.2.2:12345

[Peer]

PublicKey = xxx

AllowedIPs = 192.168.10.50/32, 192.168.2.0/24

Endpoint = 3.3.3.3:12345

按上述配置，假定的网络环境如下：服务器：IP 1.1.1.1，WireGuard内网 IP 192.168.10.1，公网环境节点1: IP 2.2.2.2，WireGuard内网 IP 192.168.10.40，LAN IP 192.168.1.0/24 节点2: IP 3.3.3.3，WireGuard内网 IP 192.168.10.50，LAN IP 192.168.2.0/24 此处，服务器、节点1、节点2均有公网IP。如果节点IP不固定，或者是没有公网IP，那就改为如下配置

[Interface]
Address = 192.168.10.1/24
MTU = 1500
PrivateKey = xxx
ListenPort = 54321
 
[Peer]
PublicKey = xxx
AllowedIPs = 192.168.10.40/32, 192.168.1.0/24
 
[Peer]
PublicKey = xxx
AllowedIPs = 192.168.10.50/32, 192.168.2.0/24

[Interface]

Address = 192.168.10.1/24

MTU = 1500

PrivateKey = xxx

ListenPort = 54321

[Peer]

PublicKey = xxx

AllowedIPs = 192.168.10.40/32, 192.168.1.0/24

[Peer]

PublicKey = xxx

AllowedIPs = 192.168.10.50/32, 192.168.2.0/24

VPS上，将配置文件保存为 /etc/wireguard/wg0.conf，执行下列命令，启用Wireguard：

wg-quick up wg0

1	wg-quick up wg0

为了让网络正常工作，还需要在VPS的公网接口上启用NAT

iptables -F FORWARD
iptables -A FORWARD -j ACCEPT
 
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE

iptables -F FORWARD

iptables -A FORWARD -j ACCEPT

iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE

修改 /etc/sysctl.conf，启用 ‘net.ipv4.ip_forward=1‘，然后执行 ‘sysctl -p‘ 接下来是大招 You are not authorised to read all content in … Continue reading “Ubuntu部署WireGuard”

WireGuard wg-quick PostUp的高级玩法

真的很高级。 wg-quick是WireGuard用来启动网络设备的**脚本**。注意了，迄今为止，wg-quick是用bash写的一个脚本，不知道未来会不会变，至少目前shebang是

!#/bin/bash

1	!#/bin/bash

Link to this post!

kexec 更新Linux内核

线上的CentOS7，没有跑什么服务，但是挂了个wireguard，用来解决内网服务器访问外网的需求。更新CentOS 7的时候发现现有内核版本太老了，wireguard出了点错，手工dkms：

[root@e squid]# dkms install -m wireguard -v 0.0.20180531
Kernel preparation unnecessary for this kernel.  Skipping...
Building module:
cleaning build area...
make -j2 KERNELRELEASE=3.10.0-693.17.1.el7.x86_64 -C /lib/modules/3.10.0-693.17.1.el7.x86_64/build M=/var/lib/dkms/wireguard/0.0.20180531/build...(bad exit status: 2)
Error! Bad return status for module build on kernel: 3.10.0-693.17.1.el7.x86_64 (x86_64)
Consult /var/lib/dkms/wireguard/0.0.20180531/build/make.log for more information.
[root@e squid]# 
[root@e squid]# 
[root@e squid]# more /var/lib/dkms/wireguard/0.0.20180531/build/make.log
DKMS make.log for wireguard-0.0.20180531 for kernel 3.10.0-693.17.1.el7.x86_64 (x86_64)
Fri Jun  1 14:31:48 CST 2018
make: Entering directory `/usr/src/kernels/3.10.0-693.17.1.el7.x86_64'
  LD      /var/lib/dkms/wireguard/0.0.20180531/build/built-in.o
  CC [M]  /var/lib/dkms/wireguard/0.0.20180531/build/main.o
  CC [M]  /var/lib/dkms/wireguard/0.0.20180531/build/noise.o
In file included from /var/lib/dkms/wireguard/0.0.20180531/build/main.c:9:0:
/var/lib/dkms/wireguard/0.0.20180531/build/queueing.h: 在函数‘skb_reset’中:
/var/lib/dkms/wireguard/0.0.20180531/build/queueing.h:78:2: 错误：隐式声明函数‘skb_reset_tc’ [-Werror=implicit-function-declaration]
  skb_reset_tc(skb);
  ^
In file included from /var/lib/dkms/wireguard/0.0.20180531/build/noise.c:10:0:
/var/lib/dkms/wireguard/0.0.20180531/build/queueing.h: 在函数‘skb_reset’中:
/var/lib/dkms/wireguard/0.0.20180531/build/queueing.h:78:2: 错误：隐式声明函数‘skb_reset_tc’ [-Werror=implicit-function-declaration]
  skb_reset_tc(skb);
  ^
cc1: some warnings being treated as errors
cc1: some warnings being treated as errors
make[1]: *** [/var/lib/dkms/wireguard/0.0.20180531/build/main.o] 错误 1
make[1]: *** 正在等待未完成的任务....
make[1]: *** [/var/lib/dkms/wireguard/0.0.20180531/build/noise.o] 错误 1
make: *** [_module_/var/lib/dkms/wireguard/0.0.20180531/build] Error 2
make: Leaving directory `/usr/src/kernels/3.10.0-693.17.1.el7.x86_64'

[root@e squid]# dkms install -m wireguard -v 0.0.20180531

Kernel preparation unnecessary for this kernel. Skipping...

Building module:

cleaning build area...

make -j2 KERNELRELEASE=3.10.0-693.17.1.el7.x86_64 -C /lib/modules/3.10.0-693.17.1.el7.x86_64/build M=/var/lib/dkms/wireguard/0.0.20180531/build...(bad exit status: 2)

Error! Bad return status for module build on kernel: 3.10.0-693.17.1.el7.x86_64 (x86_64)

Consult /var/lib/dkms/wireguard/0.0.20180531/build/make.log for more information.

[root@e squid]#

[root@e squid]# more /var/lib/dkms/wireguard/0.0.20180531/build/make.log

DKMS make.log for wireguard-0.0.20180531 for kernel 3.10.0-693.17.1.el7.x86_64 (x86_64)

Fri Jun 1 14:31:48 CST 2018

make: Entering directory `/usr/src/kernels/3.10.0-693.17.1.el7.x86_64'

LD /var/lib/dkms/wireguard/0.0.20180531/build/built-in.o

CC [M] /var/lib/dkms/wireguard/0.0.20180531/build/main.o

CC [M] /var/lib/dkms/wireguard/0.0.20180531/build/noise.o

In file included from /var/lib/dkms/wireguard/0.0.20180531/build/main.c:9:0:

/var/lib/dkms/wireguard/0.0.20180531/build/queueing.h: 在函数‘skb_reset’中:

/var/lib/dkms/wireguard/0.0.20180531/build/queueing.h:78:2: 错误：隐式声明函数‘skb_reset_tc’ [-Werror=implicit-function-declaration]

skb_reset_tc(skb);

In file included from /var/lib/dkms/wireguard/0.0.20180531/build/noise.c:10:0:

/var/lib/dkms/wireguard/0.0.20180531/build/queueing.h: 在函数‘skb_reset’中:

/var/lib/dkms/wireguard/0.0.20180531/build/queueing.h:78:2: 错误：隐式声明函数‘skb_reset_tc’ [-Werror=implicit-function-declaration]

skb_reset_tc(skb);

cc1: some warnings being treated as errors

make[1]: *** [/var/lib/dkms/wireguard/0.0.20180531/build/main.o] 错误 1

make[1]: *** 正在等待未完成的任务....

make[1]: *** [/var/lib/dkms/wireguard/0.0.20180531/build/noise.o] 错误 1

make: *** [_module_/var/lib/dkms/wireguard/0.0.20180531/build] Error 2

make: Leaving directory `/usr/src/kernels/3.10.0-693.17.1.el7.x86_64'

所以想更新一下内核。没有找到靠谱的hot upgrade，所以试了试 kexec，参考 Kernel patching with kexec: updating a CentOS 7 kernel without a full reboot

# kexec -u
# kexec -l /boot/vmlinuz-3.10.0-862.3.2.el7.x86_64 --initrd=/boot/initramfs-3.10.0-862.3.2.el7.x86_64.img --reuse-cmdline
# systemctl kexec

# kexec -u

# kexec -l /boot/vmlinuz-3.10.0-862.3.2.el7.x86_64 --initrd=/boot/initramfs-3.10.0-862.3.2.el7.x86_64.img --reuse-cmdline

# systemctl kexec

执行完，ssh就断了，然后过了一会儿就ping通了，好像没比reboot快多少。 Link to this post!