Wireguard | @sskaje

dnsmasq & systemd-resolve

By @sskaje
Link: https://sskaje.me/2021/07/dnsmasq-systemd-resolve/

Ubuntu 20.04。试图继续搭建一个 WireGuard Hub，但是这次考虑到 DNS 转发的性能问题，决定在Hub上搭一个 dnsmasq ，这样 DNS 解析结果可以被缓存下来，能够提升访问性能。

不记得从哪个版本起，Ubuntu 不再默认安装 dnsmasq ，而靠 systemd-resolve 协调管理本机的 DNS 解析。我只用 Ubuntu 当 Server，所以一般直接读 VPS 或者云服务商的 DNS 列表，干掉 systemd-resolve，安装 dnsmasq 接管解析。

但是这次我不想管系统的设置，只希望 dnsmasq 纯转发 WireGuard 接口的 DNS 请求。于是遇到了一个奇怪的问题，当我启动 dnsmasq 时，本机 DNS 解析挂了。dnsmasq 配置如下

no-resolv
no-hosts

cache-size=10000
strict-order

server=192.168.15.1
listen-address=192.168.14.11
#bind-dynamic
bind-interfaces
interface=wg0
except-interface=lo

no-resolv

no-hosts

cache-size=10000

strict-order

server=192.168.15.1

listen-address=192.168.14.11

#bind-dynamic

bind-interfaces

interface=wg0

except-interface=lo

仔细观察，结果发现，默认的时候 resolve.conf 里 nameserver=127.0.0.53，而dnsmasq启动后变成了 127.0.0.1。但是我 dnsmasq 根本没有接管 127.0.0.1。

排查了 systemd-resolve 的设置，没有相关的选项。

回过头来看resolvconf，结果在 /etc/resolvconf/update.d/dnsmasq 里看到了更新 resolv.conf 的代码。但是出于系统完整性和可维护性考虑，这个脚本肯定是不能动的，而这个脚本里也没有提供任何方法终止执行，只能再去别的地方找。

dnsmasq 是我在 WireGuard PostUp / PreDown 里调用启动和停止的。所以看启动脚本 /etc/init.d/dnsmasq 。里边有 start_resolvconf 方法。

start_resolvconf()
{
# If interface "lo" is explicitly disabled in /etc/default/dnsmasq
# Then dnsmasq won't be providing local DNS, so don't add it to
# the resolvconf server set.
        for interface in $DNSMASQ_EXCEPT
        do
                &#91; $interface = lo ] &amp;&amp; return
        done

# Also skip this if DNS functionality is disabled in /etc/dnsmasq.conf
        if grep -qs '^port=0' /etc/dnsmasq.conf; then
                return
        fi

        if &#91; -x /sbin/resolvconf ] ; then
                echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.$NAME
        fi
        return 0
}

start_resolvconf()

{

# If interface "lo" is explicitly disabled in /etc/default/dnsmasq

# Then dnsmasq won't be providing local DNS, so don't add it to

# the resolvconf server set.

for interface in $DNSMASQ_EXCEPT

[ $interface = lo ] && return

done

# Also skip this if DNS functionality is disabled in /etc/dnsmasq.conf

if grep -qs '^port=0' /etc/dnsmasq.conf; then

return

if [ -x /sbin/resolvconf ] ; then

echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.$NAME

return 0

}

显然，只有让第一个 for 的块能退出，才能解决问题。后边两个 if 都不能碰。

解决方案是，在 /etc/default/dnsmasq 里加入 DNSMASQ_EXCEPT=no 。

此外，这个脚本里还有一个 IGNORE_RESOLVCONF，单加没用，我是两个都加了。

~# cat /etc/wireguard/scripts/wg0-postup.sh 
#!/bin/bash

# 。。。。。。。

echo "IGNORE_RESOLVCONF=yes" > /etc/default/dnsmasq
echo "DNSMASQ_EXCEPT=lo" >> /etc/default/dnsmasq

/etc/init.d/dnsmasq start

exit 0

~# cat /etc/wireguard/scripts/wg0-postup.sh

#!/bin/bash

# 。。。。。。。

echo "IGNORE_RESOLVCONF=yes" > /etc/default/dnsmasq

echo "DNSMASQ_EXCEPT=lo" >> /etc/default/dnsmasq

/etc/init.d/dnsmasq start

exit 0

有点简单粗暴，因为我 dnsmasq 本身default里没有加任何设置，所以不怕被覆盖。

dnsmasq & systemd-resolve by @sskaje: https://sskaje.me/2021/07/dnsmasq-systemd-resolve/

WireGuard as a “Switch”

By @sskaje
Link: https://sskaje.me/2019/11/wireguard-as-a-switch/

Not really a switch, but similar. If you want to exchange data from two network using a host on Internet, this post helps.

In this case, Router 1 want to use Router 2 as gateway for some destinations. All 3 Nodes here have Internet public IP address.

I set-up a network, 192.168.20.0/24, using WireGuard. Our work are all on the Server in the middle.

&#91;Interface]
Address = 192.168.20.100/24
PrivateKey = KEY
ListenPort = 51820

&#91;Peer]
PublicKey = RT1PUBKEY
AllowedIPs = 192.168.20.200/32,192.168.10.0/24
Endpoint = RT1:51820

&#91;Peer]
PublicKey = RT2PUBKEY
AllowedIPs = 0.0.0.0/0
Endpoint = RT2:51820

[Interface]

Address = 192.168.20.100/24

PrivateKey = KEY

ListenPort = 51820

[Peer]

PublicKey = RT1PUBKEY

AllowedIPs = 192.168.20.200/32,192.168.10.0/24

Endpoint = RT1:51820

[Peer]

PublicKey = RT2PUBKEY

AllowedIPs = 0.0.0.0/0

Endpoint = RT2:51820

If I put such config to /etc/wireguard/wg0.conf and run wg-quick up wg0, then I may lost connection to the server, because of the default route.

Now, add a route table to your system and change wg0.conf, let’s name it wgswitch and table id 201.

# if you're not on Ubuntu, echo "201 wgswitch" >> /etc/iproute2/rt_tables
echo "201 wgswitch" >> /etc/iproute2/rt_tables.d/wg_switch.conf

1 2	# if you're not on Ubuntu, echo "201 wgswitch" >> /etc/iproute2/rt_tables echo "201 wgswitch" >> /etc/iproute2/rt_tables.d/wg_switch.conf

Then modify wg0.conf.

&#91;Interface]
Address = 192.168.20.100/24
PrivateKey = KEY
ListenPort = 51820
Table = 201

[Interface]

Address = 192.168.20.100/24

PrivateKey = KEY

ListenPort = 51820

Table = 201

Now when you establish connections, you’ll be able to ping from router1 to router2 using 192.168.20.0/24 network.

But if you want to try a custom network, that’s not enough, you need extra route and ip rule for your network

# PostUp

/sbin/ip route add ROUTE_TO_ROUTER1/16 via LOCAL_GW dev eth0 table 201
/sbin/ip route add ROUTE_TO_ROUTER2/16 via LOCAL_GW dev eth0 table 201
/sbin/ip route add LOCAL_INTERFACE_IP/24 dev eth0 table 201

/sbin/ip route add 192.168.10.0/24 dev wg0

/sbin/ip rule add iif wg0 lookup 201

/bin/ping -c 1 192.168.201.1
/bin/ping -c 1 192.168.201.20

# PostUp

/sbin/ip route add ROUTE_TO_ROUTER1/16 via LOCAL_GW dev eth0 table 201

/sbin/ip route add ROUTE_TO_ROUTER2/16 via LOCAL_GW dev eth0 table 201

/sbin/ip route add LOCAL_INTERFACE_IP/24 dev eth0 table 201

/sbin/ip route add 192.168.10.0/24 dev wg0

/sbin/ip rule add iif wg0 lookup 201

/bin/ping -c 1 192.168.201.1

/bin/ping -c 1 192.168.201.20

WireGuard as a “Switch” by @sskaje: https://sskaje.me/2019/11/wireguard-as-a-switch/

Incoming search terms:

使用WireGuard为阿里云专有网络主机提供外网访问

By @sskaje
Link: https://sskaje.me/2018/02/aliyun-vpc-hosts-access-internet-using-wireguard/

前言

我的阿里云服务器网络处于混合过度模式，逐步从经典网络往专有网络迁移。

之前每台经典网络主机都申请了公网IP和带宽，实际上对于大多数主机的业务而言，并不需要对外提供网络服务，只需要能访问外网即可。
所以这次新加的主机部分都没有去加弹性公网IP。

于是带来了问题：内网主机如何访问外网？

阿里云的dnat方案太贵了。不考虑。

尝试过本地配置网关，但是实验证明，阿里云的VPC交换机不是一个纯粹的二层交换，也许是设计有问题，也许是刻意阻止用户自己拿一台能访问公网的主机当内网网关。

所以这次使用WireGuard实现网络架构调整。

阿里云的经典网络主机里加了几条默认的路由：

10.0.0.0/8
172.16.0.0/12
100.64.0.0/10

10.0.0.0/8

172.16.0.0/12

100.64.0.0/10

前两个都好说，第三个是运营商级的NAT网络地址，之前在 OpenVPN Site-to-Site VPN between Asus Merlin And Ubnt EdgeRouter 里提过贵州电信的光纤网络对外就是这个地址段。

WireGuard的配置过程参考之前的文章，此处不多解释，只贴配置。

Continue reading “使用WireGuard为阿里云专有网络主机提供外网访问” »

使用WireGuard为阿里云专有网络主机提供外网访问 by @sskaje: https://sskaje.me/2018/02/aliyun-vpc-hosts-access-internet-using-wireguard/

Incoming search terms:

EdgeRouter 部署 WireGuard

By @sskaje
Link: https://sskaje.me/2017/06/deploy-wireguard-on-edgerouter/

安装

从 https://github.com/Lochnair/vyatta-wireguard/releases 下载对应的包
ERL, ER等 mips架构的，下载 octeon 版本
ERX 下载 ralink版本。

可以选择上传到路由上，或者ssh登录路由，sudo su到root，执行类似如下的命令

curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-octeon-0.0.20170612-2.deb -o wireguard-octeon-0.0.20170612-2.deb

1	curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-octeon-0.0.20170612-2.deb -o wireguard-octeon-0.0.20170612-2.deb

或

curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-ralink-0.0.20170612-2.deb -o wireguard-ralink-0.0.20170612-2.deb

1	curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-ralink-0.0.20170612-2.deb -o wireguard-ralink-0.0.20170612-2.deb

下载完成后

dpkg -i xxx.deb

1	dpkg -i xxx.deb

配置

执行下列命令生成私钥、共享密钥，公钥

wg genkey > /config/auth/wg.private
wg genpsk > /config/auth/wg.psk
chmod 0600 /config/auth/wg.*
wg pubkey < /config/auth/wg.private

wg genkey > /config/auth/wg.private

wg genpsk > /config/auth/wg.psk

chmod 0600 /config/auth/wg.*

wg pubkey < /config/auth/wg.private

将最后一个命令的输出复制下来，配置到服务器端

获取服务器端的公钥，替换下文的“公钥”并执行命令

configure
set interfaces wireguard wg0 address 192.168.10.40/24
set interfaces wireguard wg0 listen-port 本地端口
set interfaces wireguard wg0 peer 公钥 allowed-ips 0.0.0.0/0
set interfaces wireguard wg0 peer 公钥 endpoint '服务器IP:端口'
set interfaces wireguard wg0 peer 公钥 preshared-key /config/auth/wg-eos.psk
set interfaces wireguard wg0 private-key /config/auth/wg.private
set interfaces wireguard wg0 route-allowed-ips false
commit
save

configure

set interfaces wireguard wg0 address 192.168.10.40/24

set interfaces wireguard wg0 listen-port 本地端口

set interfaces wireguard wg0 peer 公钥 allowed-ips 0.0.0.0/0

set interfaces wireguard wg0 peer 公钥 endpoint '服务器IP:端口'

set interfaces wireguard wg0 peer 公钥 preshared-key /config/auth/wg-eos.psk

set interfaces wireguard wg0 private-key /config/auth/wg.private

set interfaces wireguard wg0 route-allowed-ips false

commit

save

配置好设备后，配置nat服务

configure
set service nat rule 5032 outbound-interface wg0
set service nat rule 5032 type masquerade
commit 
save

configure

set service nat rule 5032 outbound-interface wg0

set service nat rule 5032 type masquerade

commit

save

剩下就是配置路由规则了，可以参考我的其他blog.

EdgeRouter 部署 WireGuard by @sskaje: https://sskaje.me/2017/06/deploy-wireguard-on-edgerouter/

Incoming search terms:

Ubuntu部署WireGuard

By @sskaje
Link: https://sskaje.me/2017/06/deploy-wireguard-on-ubuntu/

安装WireGuard

按照官方说明，可以使用下列命令装依赖，不够的自己看着装

apt-get install libmnl-dev linux-headers-$(uname -r) build-essential pkg-config

1	apt-get install libmnl-dev linux-headers-$(uname -r) build-essential pkg-config

直接从git里拉。

git clone https://git.zx2c4.com/WireGuard

1	git clone https://git.zx2c4.com/WireGuard

直接make就行

cd WireGuard/src
make
make install

cd WireGuard/src

make

make install

配置

参考前一篇文章“WireGuard wg-quick PostUp的高级玩法”，可以直接无视官方和其他各种第三方给的教程。

前文给了一个参考的配置。

[Interface]
Address = 192.168.10.1/24
MTU = 1500
PrivateKey = xxx
PostUp = echo -n "hello" > /dev/udp/192.168.1.1/80; echo -n "hello" > /dev/udp/192.168.2.1/80
 
[Peer]
PublicKey = xxx
AllowedIPs = 192.168.10.40/32, 192.168.1.0/24
Endpoint = 2.2.2.2:12345
 
[Peer]
PublicKey = xxx
AllowedIPs = 192.168.10.50/32, 192.168.2.0/24
Endpoint = 3.3.3.3:12345

[Interface]

Address = 192.168.10.1/24

MTU = 1500

PrivateKey = xxx

PostUp = echo -n "hello" > /dev/udp/192.168.1.1/80; echo -n "hello" > /dev/udp/192.168.2.1/80

[Peer]

PublicKey = xxx

AllowedIPs = 192.168.10.40/32, 192.168.1.0/24

Endpoint = 2.2.2.2:12345

[Peer]

PublicKey = xxx

AllowedIPs = 192.168.10.50/32, 192.168.2.0/24

Endpoint = 3.3.3.3:12345

按上述配置，假定的网络环境如下：
服务器：IP 1.1.1.1，WireGuard内网 IP 192.168.10.1，公网环境
节点1: IP 2.2.2.2，WireGuard内网 IP 192.168.10.40，LAN IP 192.168.1.0/24
节点2: IP 3.3.3.3，WireGuard内网 IP 192.168.10.50，LAN IP 192.168.2.0/24

此处，服务器、节点1、节点2均有公网IP。

如果节点IP不固定，或者是没有公网IP，那就改为如下配置

[Interface]
Address = 192.168.10.1/24
MTU = 1500
PrivateKey = xxx
ListenPort = 54321
 
[Peer]
PublicKey = xxx
AllowedIPs = 192.168.10.40/32, 192.168.1.0/24
 
[Peer]
PublicKey = xxx
AllowedIPs = 192.168.10.50/32, 192.168.2.0/24

[Interface]

Address = 192.168.10.1/24

MTU = 1500

PrivateKey = xxx

ListenPort = 54321

[Peer]

PublicKey = xxx

AllowedIPs = 192.168.10.40/32, 192.168.1.0/24

[Peer]

PublicKey = xxx

AllowedIPs = 192.168.10.50/32, 192.168.2.0/24

VPS上，将配置文件保存为 /etc/wireguard/wg0.conf，执行下列命令，启用Wireguard：

wg-quick up wg0

1	wg-quick up wg0

为了让网络正常工作，还需要在VPS的公网接口上启用NAT

iptables -F FORWARD
iptables -A FORWARD -j ACCEPT
 
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE

iptables -F FORWARD

iptables -A FORWARD -j ACCEPT

iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE

修改 /etc/sysctl.conf，启用 ‘net.ipv4.ip_forward=1‘，然后执行 ‘sysctl -p‘

接下来是大招

You are not authorised to read all content in this post.

Please login…

Ubuntu部署WireGuard by @sskaje: https://sskaje.me/2017/06/deploy-wireguard-on-ubuntu/