chchang/hugo_backup
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

update some content

Browse Source
This commit is contained in:
Eric Chang
2021-10-28 14:13:06 +08:00
parent 97eb780aa4
commit 4f99455d8f
242 changed files with 1826 additions and 2616 deletions
Download Patch File Download Diff File Expand all files Collapse all files

82
public/post/wireguard-pihole-in-ubuntu-20.04/index.html
View File

@@ -11,9 +11,9 @@
"@id": "https:\/\/h.cowbay.org"
},
"articleSection" : "post",
"name" : "[筆記] 在 ubuntu 20.04 上安裝 wireguard \x2b pihole 作 AD Blocking\/install wireguard and pihole to do ad block in ubuntu 20.04 ",
"headline" : "[筆記] 在 ubuntu 20.04 上安裝 wireguard \x2b pihole 作 AD Blocking\/install wireguard and pihole to do ad block in ubuntu 20.04 ",
"description" : "\x3cp\x3e手機上的廣告越來越討厭了\x3c\/p\x3e\n\x3cp\x3e但是用手機看頁面、影片的機會越來越高\x3c\/p\x3e\n\x3cp\x3e所以一直想看看有沒有什麼方式可以解決這個問題\x3c\/p\x3e\n\x3cp\x3e不只可以用在safari 上，連APP 裡面的廣告最好都能夠擋掉\x3c\/p\x3e\n\x3cp\x3e在github上面看到有個專案是 wireguard \x2b pihole\x3c\/p\x3e\n\x3cp\x3e滿有趣的，就來研究一下\x3c\/p\x3e",
"name" : "[筆記] 在 ubuntu 20.04 上安裝 wireguard \u002b pihole 作 AD Blocking\/install wireguard and pihole to do ad block in ubuntu 20.04 ",
"headline" : "[筆記] 在 ubuntu 20.04 上安裝 wireguard \u002b pihole 作 AD Blocking\/install wireguard and pihole to do ad block in ubuntu 20.04 ",
"description" : "\u003cp\u003e手機上的廣告越來越討厭了\u003c\/p\u003e\n\u003cp\u003e但是用手機看頁面、影片的機會越來越高\u003c\/p\u003e\n\u003cp\u003e所以一直想看看有沒有什麼方式可以解決這個問題\u003c\/p\u003e\n\u003cp\u003e不只可以用在safari 上，連APP 裡面的廣告最好都能夠擋掉\u003c\/p\u003e\n\u003cp\u003e在github上面看到有個專案是 wireguard \u002b pihole\u003c\/p\u003e\n\u003cp\u003e滿有趣的，就來研究一下\u003c\/p\u003e",
"inLanguage" : "en",
"author" : "Eric Chang",
"creator" : "Eric Chang",
@@ -21,8 +21,8 @@
"accountablePerson" : "Eric Chang",
"copyrightHolder" : "Eric Chang",
"copyrightYear" : "2020",
"datePublished": "2020-08-13 14:22:05 \x2b0800 CST",
"dateModified" : "2020-08-13 14:22:05 \x2b0800 CST",
"datePublished": "2020-08-13 14:22:05 \u002b0800 CST",
"dateModified" : "2020-08-13 14:22:05 \u002b0800 CST",
"url" : "https:\/\/h.cowbay.org\/post\/wireguard-pihole-in-ubuntu-20.04\/",
"wordCount" : "686",
"image" : "https://h.cowbay.orghttps://h.cowbay.org/images/post-default-16.jpg"",
@@ -45,9 +45,9 @@
<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.3.1/css/all.css" integrity="sha384-mzrmE5qonljUremFsqc01SB46JvROS7bZs3IO2EmfFsd15uHvIt+Y8vEf7N7fWAU" crossorigin="anonymous">
<link href="https://h.cowbay.org/css/style.css?v=1632901489" rel="stylesheet" id="theme-stylesheet" type='text/css' media='all'>
<link href="https://h.cowbay.org/css/style.css?v=1634607506" rel="stylesheet" id="theme-stylesheet" type='text/css' media='all'>
<link href="https://h.cowbay.org/css/custom.css?v=1632901489" rel="stylesheet" type='text/css' media='all'>
<link href="https://h.cowbay.org/css/custom.css?v=1634607506" rel="stylesheet" type='text/css' media='all'>
<link rel="shortcut icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
<link rel="icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
@@ -320,48 +320,48 @@ if (!doNotTrack) {
<hr>
<h4 id="安裝基本套件">安裝基本套件</h4>
<p>因為是選擇 ubuntu 20.04 minimal 所以有很多套件都沒有，要先安裝這些基本套件</p>
<pre><code>sudo apt update &amp;&amp; sudo apt install -y vim git net-tools software-properties-common iptables python3-pip qrencode
<pre tabindex="0"><code>sudo apt update &amp;&amp; sudo apt install -y vim git net-tools software-properties-common iptables python3-pip qrencode
</code></pre><h4 id="取得安裝script">取得安裝script</h4>
<pre><code>mkdir git &amp;&amp; cd git
<pre tabindex="0"><code>mkdir git &amp;&amp; cd git
git clone https://github.com/racbart/wireguard-pihole
</code></pre><h4 id="修改-installsh">修改 install.sh</h4>
<p>因為我的目的是只想要把DNS 查詢透過wireguard 丟去 pihole</p>
<p>而不是把所有流量都轉給wireguard</p>
<p>所以要修改一下剛剛clone 下來的 script</p>
<pre><code>cd wireguard-pihole
<pre tabindex="0"><code>cd wireguard-pihole
vim install.sh
</code></pre><p>有點忘了改了哪些東西，就大概說一下吧</p>
<h5 id="ipv4_address">IPV4_ADDRESS</h5>
<p>原本的判斷VPS WAN IP 的指令在GCE上會抓到private ip</p>
<p>所以要改一下，在 install.sh 中找到底下這行註解掉，並修改成其他指令</p>
<pre><code>#IPV4_ADDRESS=$(ip addr list &quot;$INTERFACE&quot; | grep &quot;inet &quot; | xargs | cut -d &quot; &quot; -f 2)
<pre tabindex="0"><code>#IPV4_ADDRESS=$(ip addr list &quot;$INTERFACE&quot; | grep &quot;inet &quot; | xargs | cut -d &quot; &quot; -f 2)
IPV4_ADDRESS=$(dig +short myip.opendns.com @resolver1.opendns.com)
</code></pre><h5 id="install-wireguard-in-ubuntu-2004">install wireguard in ubuntu 20.04</h5>
<p>ubuntu 20.04 安裝wireguard 的方式和 18.04 有點差別，需要多裝一個 wireguard-dkms</p>
<p>找到底下這行，註解掉，改成我們要的指令，python-pip 我們用 python3-pip 取代</p>
<p>在一開始就已經先裝了，所以這邊不需要再裝一次</p>
<pre><code>#apt install -y wireguard python-pip
<pre tabindex="0"><code>#apt install -y wireguard python-pip
apt install -y wireguard wireguard-dkms
</code></pre><h5 id="啟用query-logging">啟用query logging</h5>
<p>找到底下這行，註解掉，改成啟用 query logging</p>
<pre><code>#QUERY_LOGGING=false
<pre tabindex="0"><code>#QUERY_LOGGING=false
QUERY_LOGGING=true
</code></pre><p>存檔後離開</p>
<p>然後執行</p>
<pre><code>sudo ./install.sh
<pre tabindex="0"><code>sudo ./install.sh
</code></pre><p>開始進行安裝，基本上是全自動的，應該沒有錯誤，可以順利跑完 (應該啦&hellip;)</p>
<hr>
<p>接著來依照我自己的需求來修改一下 add-client.sh</p>
<h5 id="修改-ipv4_address">修改 IPV4_ADDRESS</h5>
<p>找到底下這行註解掉，並修改成其他指令</p>
<pre><code>#IPV4_ADDRESS=$(ip addr list &quot;$INTERFACE&quot; | grep &quot;inet &quot; | xargs | cut -d &quot; &quot; -f 2)
<pre tabindex="0"><code>#IPV4_ADDRESS=$(ip addr list &quot;$INTERFACE&quot; | grep &quot;inet &quot; | xargs | cut -d &quot; &quot; -f 2)
IPV4_ADDRESS=$(dig +short myip.opendns.com @resolver1.opendns.com)
</code></pre><h5 id="改一下-port">改一下 port</h5>
<pre><code>#SERVER_PORT=$(cat /etc/wireguard/wg0.conf | grep ListenPort | rev | cut -d &quot; &quot; -f 1 | rev)
<pre tabindex="0"><code>#SERVER_PORT=$(cat /etc/wireguard/wg0.conf | grep ListenPort | rev | cut -d &quot; &quot; -f 1 | rev)
SERVER_PORT=12000
</code></pre><h5 id="display-client-and-save-conf">display client and save conf</h5>
<p>找到底下這一段</p>
<pre><code>echo &quot;
<pre tabindex="0"><code>echo &quot;
[Interface]
PrivateKey = ${CLIENT_PRIVKEY}
Address = ${NEXT_IP}/32
@@ -372,7 +372,7 @@ AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = ${SERVER_ADDRESS}:${SERVER_PORT}
&quot;
</code></pre><p>改成</p>
<pre><code># Display client config
<pre tabindex="0"><code># Display client config
echo &quot;
[Interface]
@@ -387,7 +387,7 @@ AllowedIPs = 10.10.0.1/32
Endpoint = ${SERVER_ADDRESS}:${SERVER_PORT}&quot;|tee ${CLIENT_NAME}.conf &amp;&amp; qrencode -t ansiutf8 -l L &lt; ${CLIENT_NAME}.conf
</code></pre><p>之後要新增 client</p>
<p>就只要輸入</p>
<pre><code>sudo bash add-client.sh &quot;CLIENT_NAME&quot;
<pre tabindex="0"><code>sudo bash add-client.sh &quot;CLIENT_NAME&quot;
</code></pre><p>就會在當前目錄底下產生 ${CLIENT_NAME}.conf 的設定檔，並顯示 qrcode</p>
<p>而且也不用去管 client ip 發到哪了，script 會自己去計算</p>
<p>再次強調，這只會把手機上的 dns 查詢透過wireguard指向到 pihole</p>
@@ -395,7 +395,7 @@ Endpoint = ${SERVER_ADDRESS}:${SERVER_PORT}&quot;|tee ${CLIENT_NAME}.conf &amp;&
<p>如果要改成都走wireguard 出去，那就把最後一段的 Endpoint 後面改成 0.0.0.0/0</p>
<p>PC的話，wireguard 連上之後，要去手動修改DNS</p>
<p>成功的話，在PC上可以看到這樣的查詢結果</p>
<pre><code>peer: mVRp+fjHKW1/n/j5Cwn9zOlLsgtHsvoiNHPSn4bHLHg=
<pre tabindex="0"><code>peer: mVRp+fjHKW1/n/j5Cwn9zOlLsgtHsvoiNHPSn4bHLHg=
endpoint: 23.34.45.67:12000
allowed ips: 10.10.0.1/32
latest handshake: 1 hour, 48 minutes, 39 seconds ago
@@ -427,44 +427,44 @@ www.google.com.tw. 297 IN A 64.233.177.94
</code></pre><h3 id="update">UPDATE</h3>
<p>更新一下開啟 pihole DOT (DNS Over TLS) 的方式</p>
<h5 id="安裝並建立相關目錄">安裝並建立相關目錄</h5>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">sudo apt update
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">sudo apt update
sudo apt install stubby
sudo mkdir /var/cache/stubby
</code></pre></div><h5 id="修改-etcstubbystubbyyml">修改 /etc/stubby/stubby.yml</h5>
<p>編輯 /etc/stubby/stubby.yml 改成以下內容</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-yaml" data-lang="yaml"><span style="color:#66d9ef">resolution_type</span>: GETDNS_RESOLUTION_STUB
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-yaml" data-lang="yaml"><span style="color:#f92672">resolution_type</span>: <span style="color:#ae81ff">GETDNS_RESOLUTION_STUB</span>
<span style="color:#66d9ef">dns_transport_list</span>:
- GETDNS_TRANSPORT_TLS
<span style="color:#f92672">dns_transport_list</span>:
- <span style="color:#ae81ff">GETDNS_TRANSPORT_TLS</span>
<span style="color:#66d9ef">tls_authentication</span>: GETDNS_AUTHENTICATION_REQUIRED
<span style="color:#f92672">tls_authentication</span>: <span style="color:#ae81ff">GETDNS_AUTHENTICATION_REQUIRED</span>
<span style="color:#66d9ef">tls_query_padding_blocksize</span>: <span style="color:#ae81ff">128</span>
<span style="color:#f92672">tls_query_padding_blocksize</span>: <span style="color:#ae81ff">128</span>
<span style="color:#66d9ef">edns_client_subnet_private </span>: <span style="color:#ae81ff">1</span>
<span style="color:#f92672">edns_client_subnet_private </span>: <span style="color:#ae81ff">1</span>
<span style="color:#66d9ef">round_robin_upstreams</span>: <span style="color:#ae81ff">1</span>
<span style="color:#f92672">round_robin_upstreams</span>: <span style="color:#ae81ff">1</span>
<span style="color:#66d9ef">idle_timeout</span>: <span style="color:#ae81ff">10000</span>
<span style="color:#f92672">idle_timeout</span>: <span style="color:#ae81ff">10000</span>
<span style="color:#66d9ef">tls_connection_retries</span>: <span style="color:#ae81ff">5</span>
<span style="color:#f92672">tls_connection_retries</span>: <span style="color:#ae81ff">5</span>
<span style="color:#66d9ef">xtls_ca_path</span>: <span style="color:#e6db74">&#34;/etc/ssl/certs/&#34;</span>
<span style="color:#f92672">xtls_ca_path</span>: <span style="color:#e6db74">&#34;/etc/ssl/certs/&#34;</span>
<span style="color:#75715e">################################ LISTEN ADDRESS ################################</span>
<span style="color:#75715e"># Set the listen addresses for the stubby DAEMON. This specifies localhost IPv4</span>
<span style="color:#75715e"># and IPv6. It will listen on port 53 by default. Use &lt;IP_address&gt;@&lt;port&gt; to</span>
<span style="color:#75715e"># specify a different port</span>
<span style="color:#66d9ef">listen_addresses</span>:
<span style="color:#f92672">listen_addresses</span>:
- <span style="color:#ae81ff">127.0.0.1</span>@<span style="color:#ae81ff">5453</span>
<span style="color:#66d9ef">appdata_dir</span>: <span style="color:#e6db74">&#34;/var/cache/stubby&#34;</span>
<span style="color:#f92672">appdata_dir</span>: <span style="color:#e6db74">&#34;/var/cache/stubby&#34;</span>
<span style="color:#66d9ef">upstream_recursive_servers</span>:
- <span style="color:#66d9ef">address_data</span>: <span style="color:#ae81ff">145.100.185.15</span>
<span style="color:#66d9ef">tls_auth_name</span>: <span style="color:#e6db74">&#34;dnsovertls.sinodun.com&#34;</span>
- <span style="color:#66d9ef">address_data</span>: <span style="color:#ae81ff">1.1.1.1</span>
<span style="color:#66d9ef">tls_auth_name</span>: <span style="color:#e6db74">&#34;cloudflare-dns.com&#34;</span>
<span style="color:#f92672">upstream_recursive_servers</span>:
- <span style="color:#f92672">address_data</span>: <span style="color:#ae81ff">145.100.185.15</span>
<span style="color:#f92672">tls_auth_name</span>: <span style="color:#e6db74">&#34;dnsovertls.sinodun.com&#34;</span>
- <span style="color:#f92672">address_data</span>: <span style="color:#ae81ff">1.1.1.1</span>
<span style="color:#f92672">tls_auth_name</span>: <span style="color:#e6db74">&#34;cloudflare-dns.com&#34;</span>
<span style="color:#75715e">## Quad 9 &#39;secure&#39; service - Filters, does DNSSEC, doesn&#39;t send ECS</span>
<span style="color:#75715e"># - address_data: 9.9.9.9</span>
@@ -497,11 +497,11 @@ sudo mkdir /var/cache/stubby
<span style="color:#75715e"># tls_auth_name: &#34;dns.google&#34;</span>
</code></pre></div><p>重啟 stubby service</p>
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">sudo service tubby restart
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">sudo service tubby restart
</code></pre></div><h5 id="修改pihole-相關設定">修改pihole 相關設定</h5>
<p>開啟 pihole web 管理界面 settings -&gt; dns -&gt; 左邊預設的DNS 都不要選，在右邊的 custom 1(IPV4) 填入</p>
<p>存檔後離開</p>
<pre><code>127.0.0.1#5453
<pre tabindex="0"><code>127.0.0.1#5453
</code></pre>
</article>
</div>
@@ -793,7 +793,7 @@ title="pinterest icon"></i>
</div>
<script src="https://h.cowbay.org/js/jquery.min.js"></script>
<script src="https://h.cowbay.org/js/jquerymigrate.js"></script>
<script src="https://h.cowbay.org/js/production.min.js?v=1632901489"></script>
<script src="https://h.cowbay.org/js/production.min.js?v=1634607506"></script>
</body>
</html>