pteuz Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
======Wireguard======

Wireguard est un logiciel client-serveur moderne permettant de créer simplement un tunnel VPN fonctionnant sur UDP entre 2 machines. Il se veut plus simple et plus performant qu'OpenVPN, mais aussi plus limité dans ses fonctionnalités.

Installer **wireguard** et les **wireguard-tools** sur le serveur.

=====Ajouter des clients=====

https://docs.pi-hole.net/guides/vpn/wireguard/client/

Mais en un script :
<code bash>
#! /usr/bin/env bash
echo "Attention script non testé"

[[ $# -ne 2 ]] && { echo 'Usage: ./gen_client.sh "annas-android" 6'; exit 1; }

mask 077

srv_pub="mondns.perso:51820"    # DNS du serveur (public) et port du service wireguard
allowed_IPs="192.168.0.0/24, 8.8.8.8/32"  # IPs LANs et IP pub de la box (pour le hairpinning)
net_priv="10.10.0."   # adressage des tunnels
DNS="192.168.0.10"     # DNS perso

ipv4="$net_priv$2"
serv4="${net_priv}1"
name="$1"

wg genkey | tee "${name}.key" | wg pubkey > "${name}.pub"
wg genpsk > "${name}.psk"

echo "# $name" >> /etc/wireguard/wg0.conf
echo "[Peer]" >> /etc/wireguard/wg0.conf
echo "PublicKey = $(cat "${name}.pub")" >> /etc/wireguard/wg0.conf
echo "PresharedKey = $(cat "${name}.psk")" >> /etc/wireguard/wg0.conf
echo "AllowedIPs = $ipv4/32" >> /etc/wireguard/wg0.conf
echo "" >> /etc/wireguard/wg0.conf

echo "[Interface]" > "${name}.conf"
echo "Address = $ipv4/32" >> "${name}.conf"
echo "DNS = ${DNS}" >> "${name}.conf"
echo "PrivateKey = $(cat "${name}.key")" >> "${name}.conf"
echo "" >> "${name}.conf"
echo "[Peer]" >> "${name}.conf"
echo "PublicKey = $(cat server.pub)" >> "${name}.conf"
echo "PresharedKey = $(cat "${name}.psk")" >> "${name}.conf"
echo "Endpoint = $srv_pub" >> "${name}.conf"
echo "AllowedIPs = ${serv4}/32, $allowed_IPs" >> "${name}.conf"
# echo "AllowedIPs = ${1}0/24, ${2}/64" >> "${name}.conf" # clients can see each other
#echo "PersistentKeepalive = 25" >> "${name}.conf"

# Print QR code scanable by the Wireguard mobile app on screen
qrencode -t ansiutf8 < "${name}.conf"

wg syncconf wg0 <(wg-quick strip wg0)
# au cas ou: systemctl restart wg-quick@wg0
</code>