Wireguard est un logiciel client-serveur moderne permettant de créer simplement un tunnel VPN fonctionnant sur UDP entre 2 machines. Il se veut plus simple et plus performant qu'OpenVPN, mais aussi plus limité dans ses fonctionnalités.

Installer wireguard et les wireguard-tools sur le serveur.

https://docs.pi-hole.net/guides/vpn/wireguard/client/

Mais en un script :

#! /usr/bin/env bash
echo "Attention script non testé"
 
[[ $# -ne 2 ]] && { echo 'Usage: ./gen_client.sh "annas-android" 6'; exit 1; }
 
mask 077
 
srv_pub="mondns.perso:51820"    # DNS du serveur (public) et port du service wireguard
allowed_IPs="192.168.0.0/24, 8.8.8.8/32"  # IPs LANs et IP pub de la box (pour le hairpinning)
net_priv="10.10.0."   # adressage des tunnels
DNS="192.168.0.10"     # DNS perso
 
ipv4="$net_priv$2"
serv4="${net_priv}1"
name="$1"
 
wg genkey | tee "${name}.key" | wg pubkey > "${name}.pub"
wg genpsk > "${name}.psk"
 
echo "# $name" >> /etc/wireguard/wg0.conf
echo "[Peer]" >> /etc/wireguard/wg0.conf
echo "PublicKey = $(cat "${name}.pub")" >> /etc/wireguard/wg0.conf
echo "PresharedKey = $(cat "${name}.psk")" >> /etc/wireguard/wg0.conf
echo "AllowedIPs = $ipv4/32" >> /etc/wireguard/wg0.conf
echo "" >> /etc/wireguard/wg0.conf
 
echo "[Interface]" > "${name}.conf"
echo "Address = $ipv4/32" >> "${name}.conf"
echo "DNS = ${DNS}" >> "${name}.conf"
echo "PrivateKey = $(cat "${name}.key")" >> "${name}.conf"
echo "" >> "${name}.conf"
echo "[Peer]" >> "${name}.conf"
echo "PublicKey = $(cat server.pub)" >> "${name}.conf"
echo "PresharedKey = $(cat "${name}.psk")" >> "${name}.conf"
echo "Endpoint = $srv_pub" >> "${name}.conf"
echo "AllowedIPs = ${serv4}/32, $allowed_IPs" >> "${name}.conf"
# echo "AllowedIPs = ${1}0/24, ${2}/64" >> "${name}.conf" # clients can see each other
#echo "PersistentKeepalive = 25" >> "${name}.conf"
 
# Print QR code scanable by the Wireguard mobile app on screen
qrencode -t ansiutf8 < "${name}.conf"
 
wg syncconf wg0 <(wg-quick strip wg0)
# au cas ou: systemctl restart wg-quick@wg0