|
|
<!DOCTYPE html>
|
|
|
<html lang="en-us">
|
|
|
<head><meta charset="utf-8">
|
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
|
<script type="application/ld+json">
|
|
|
{
|
|
|
"@context" : "http://schema.org",
|
|
|
"@type" : "BlogPosting",
|
|
|
"mainEntityOfPage": {
|
|
|
"@type": "WebPage",
|
|
|
"@id": "https:\/\/h.cowbay.org"
|
|
|
},
|
|
|
"articleSection" : "post",
|
|
|
"name" : "[筆記] 在edgerouter上用wireguard 建立site to site VPN \/ Site to Site Vpn Using Wireguard in Two Edgerouters",
|
|
|
"headline" : "[筆記] 在edgerouter上用wireguard 建立site to site VPN \/ Site to Site Vpn Using Wireguard in Two Edgerouters",
|
|
|
"description" : "\x3cp\x3e之前總部和分公司之間 是用buffalo 的小AP 灌 openwrt\x3c\/p\x3e\n\n\x3cp\x3e然後用strongswan 來打 IPSEC site to site VPN\x3c\/p\x3e\n\n\x3cp\x3econfig 看起來不是很難 (只是看起來)\x3c\/p\x3e\n\n\x3cp\x3e但是實際上已經找不到當初的文件\x3c\/p\x3e\n\n\x3cp\x3e所以要維護很困難(光那些RSA KEY 就不知道為何、如何產生)\x3c\/p\x3e\n\n\x3cp\x3e後來採購了兩台edgerouter X 做測試\x3c\/p\x3e\n\n\x3cp\x3e也用openvpn 成功的建立了 site to site VPN\x3c\/p\x3e\n\n\x3cp\x3e本來想說 openvpn 已經夠簡單了\x3c\/p\x3e\n\n\x3cp\x3e今天看到文章說用wireguard 可以更簡單\x3c\/p\x3e\n\n\x3cp\x3e於是研究了一下，發現還真的很簡單！\x3c\/p\x3e",
|
|
|
"inLanguage" : "en",
|
|
|
"author" : "Eric Chang",
|
|
|
"creator" : "Eric Chang",
|
|
|
"publisher": "Eric Chang",
|
|
|
"accountablePerson" : "Eric Chang",
|
|
|
"copyrightHolder" : "Eric Chang",
|
|
|
"copyrightYear" : "2019",
|
|
|
"datePublished": "2019-08-06 17:14:17 \x2b0800 CST",
|
|
|
"dateModified" : "2019-08-06 17:14:17 \x2b0800 CST",
|
|
|
"url" : "https:\/\/h.cowbay.org\/post\/site-to-site-vpn-using-wireguard-in-two-edgerouters\/",
|
|
|
"wordCount" : "757",
|
|
|
"image" : "https://h.cowbay.orghttps://h.cowbay.org/images/post-default-5.jpg"",
|
|
|
"keywords" : [ ""vpn"",""edgerouter"","Blog" ]
|
|
|
}
|
|
|
</script>
|
|
|
|
|
|
|
|
|
<title>[筆記] 在edgerouter上用wireguard 建立site to site VPN / Site to Site Vpn Using Wireguard in Two Edgerouters </title>
|
|
|
|
|
|
|
|
|
<meta name="description" content="some articles about job,food,passion sisters" />
|
|
|
|
|
|
|
|
|
|
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
|
<meta name="robots" content="all,follow">
|
|
|
<meta name="googlebot" content="index,follow,snippet,archive">
|
|
|
<link rel="stylesheet" id="ct-tracks-google-fonts-css" href="https://fonts.googleapis.com/css?family=Raleway%3A400%2C700&subset=latin%2Clatin-ext&ver=4.7.2" type="text/css" media="all">
|
|
|
|
|
|
<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.3.1/css/all.css" integrity="sha384-mzrmE5qonljUremFsqc01SB46JvROS7bZs3IO2EmfFsd15uHvIt+Y8vEf7N7fWAU" crossorigin="anonymous">
|
|
|
|
|
|
<link href="https://h.cowbay.org/css/style.css?v=1626744134" rel="stylesheet" id="theme-stylesheet" type='text/css' media='all'>
|
|
|
|
|
|
<link href="https://h.cowbay.org/css/custom.css?v=1626744134" rel="stylesheet" type='text/css' media='all'>
|
|
|
<link rel="shortcut icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
|
|
|
<link rel="icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
|
|
|
|
|
|
|
|
|
<script type="application/javascript">
|
|
|
var doNotTrack = false;
|
|
|
if (!doNotTrack) {
|
|
|
window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date;
|
|
|
ga('create', 'UA-138954876-1', 'auto');
|
|
|
|
|
|
ga('send', 'pageview');
|
|
|
}
|
|
|
</script>
|
|
|
<script async src='https://www.google-analytics.com/analytics.js'></script>
|
|
|
|
|
|
</head>
|
|
|
|
|
|
|
|
|
<body class="post-template-default single single-post single-format-standard ct-body singular singular-post not-front standard">
|
|
|
|
|
|
<div id="overflow-container" class="overflow-container">
|
|
|
<a class="skip-content" href="#main">Skip to content</a>
|
|
|
<header id="site-header" class="site-header" role="banner">
|
|
|
<div class='top-navigation'>
|
|
|
<div class='container'>
|
|
|
|
|
|
<div id="menu-secondary" class="menu-container menu-secondary" role="navigation">
|
|
|
<button id="toggle-secondary-navigation" class="toggle-secondary-navigation"><i class="fas fa-plus"></i></button>
|
|
|
|
|
|
<div class="menu">
|
|
|
|
|
|
<ul id="menu-secondary-items" class="menu-secondary-items">
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/"></a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/ansible">ansible</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/linux">linux</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/proxmox">proxmox</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/ps">ps</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E7%A2%8E%E5%BF%B5">碎念</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E7%AD%86%E8%A8%98">筆記</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E7%BE%A4%E6%9A%89">群暉</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E9%9B%9C%E5%BF%B5">雜念</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
<ul class="social-media-icons">
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20Social%20profile%20url%20in%20facebook" data-animate-hover="pulse" class="facebook" target="_blank">
|
|
|
<i class="fab fa-facebook-square" title="facebook"></i>
|
|
|
<span class="screen-reader-text">facebook</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20googleplus" data-animate-hover="pulse" class="gplus" target="_blank">
|
|
|
<i class="fab fa-google-plus-g" title="googleplus"></i>
|
|
|
<span class="screen-reader-text">googleplus</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" data-animate-hover="pulse" class="twitter" target="_blank">
|
|
|
<i class="fab fa-twitter-square" title="twitter"></i>
|
|
|
<span class="screen-reader-text">twitter</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" data-animate-hover="pulse" class="instagram" target="_blank">
|
|
|
<i class="fab fa-instagram" title="instagram"></i>
|
|
|
<span class="screen-reader-text">instagram</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="mailto:mc@hotshraingmy.info" data-animate-hover="pulse" class="email">
|
|
|
<i class="fas fa-envelope" title="email"></i>
|
|
|
<span class="screen-reader-text">email</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20linkedin" data-animate-hover="pulse" class="linkedin" target="_blank">
|
|
|
<i class="fab fa-linkedin-in" title="linkedin"></i>
|
|
|
<span class="screen-reader-text">linkedin</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20stackoverflow" data-animate-hover="pulse" class="stackoverflow" target="_blank">
|
|
|
<i class="fab fa-stack-overflow" title="stackoverflow"></i>
|
|
|
<span class="screen-reader-text">stackoverflow</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="changchichung" data-animate-hover="pulse" class="github" target="_blank">
|
|
|
<i class="fab fa-github" title="github"></i>
|
|
|
<span class="screen-reader-text">github</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20pinterest" data-animate-hover="pulse" class="pinterest" target="_blank">
|
|
|
<i class="fab fa-pinterest" title="pinterest"></i>
|
|
|
<span class="screen-reader-text">pinterest</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="https://h.cowbay.org/index.xml" data-animate-hover="pulse" class="rss" target="_blank">
|
|
|
<i class="fas fa-rss" title="rss"></i>
|
|
|
<span class="screen-reader-text">rss</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
</ul></div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="container">
|
|
|
<div id="title-info" class="title-info">
|
|
|
<div id='site-title' class='site-title'>
|
|
|
|
|
|
<a href="/"> MC部落 </a>
|
|
|
</div>
|
|
|
</div>
|
|
|
<button id="toggle-navigation" class="toggle-navigation">
|
|
|
<i class="fas fa-bars"></i>
|
|
|
</button>
|
|
|
|
|
|
<div id="menu-primary-tracks" class="menu-primary-tracks"></div>
|
|
|
<div id="menu-primary" class="menu-container menu-primary" role="navigation">
|
|
|
|
|
|
<p class="site-description">What’s the Worst That Could Happen?</p>
|
|
|
|
|
|
|
|
|
<div class="menu">
|
|
|
<ul id="menu-primary-items" class="menu-primary-items">
|
|
|
|
|
|
|
|
|
<li class='menu-item menu-item-type-custom menu-item-object-custom '>
|
|
|
<a href="https://h.cowbay.org/">Home</a>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class='menu-item menu-item-type-post_type menu-item-object-page '>
|
|
|
<a href="https://h.cowbay.org/about/">About</a>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class='menu-item menu-item-type-post_type menu-item-object-page '>
|
|
|
<a href="https://h.cowbay.org/contact/">Get in touch</a>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
</header>
|
|
|
|
|
|
<div id="main" class="main" role="main">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<div id="loop-container" class="loop-container">
|
|
|
|
|
|
<div class="post type-post status-publish format-standard has-post-thumbnail hentry category-design tag-design tag-standard-2 tag-tagalicious tag-travel entry full-without-featured odd excerpt-1">
|
|
|
|
|
|
<div class='featured-image lazy lazy-bg-image' data-background="https://h.cowbay.org/images/post-default-5.jpg">
|
|
|
</div>
|
|
|
|
|
|
<div class="entry-meta">
|
|
|
<span class="date">06 August</span> <span> / </span>
|
|
|
|
|
|
<span class="author">
|
|
|
<a href="https://github.com/changchichung" title="Posts by Eric Chang" rel="author">Eric Chang</a>
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
<span class="category">
|
|
|
<span> / </span>
|
|
|
|
|
|
<a href="/categories/%E7%AD%86%E8%A8%98">筆記</a>
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
<div class='entry-header'>
|
|
|
<h1 class='entry-title'> [筆記] 在edgerouter上用wireguard 建立site to site VPN / Site to Site Vpn Using Wireguard in Two Edgerouters</h1>
|
|
|
</div>
|
|
|
<div class="entry-container">
|
|
|
<div class="entry-content">
|
|
|
<article>
|
|
|
<p>之前總部和分公司之間 是用buffalo 的小AP 灌 openwrt</p>
|
|
|
|
|
|
<p>然後用strongswan 來打 IPSEC site to site VPN</p>
|
|
|
|
|
|
<p>config 看起來不是很難 (只是看起來)</p>
|
|
|
|
|
|
<p>但是實際上已經找不到當初的文件</p>
|
|
|
|
|
|
<p>所以要維護很困難(光那些RSA KEY 就不知道為何、如何產生)</p>
|
|
|
|
|
|
<p>後來採購了兩台edgerouter X 做測試</p>
|
|
|
|
|
|
<p>也用openvpn 成功的建立了 site to site VPN</p>
|
|
|
|
|
|
<p>本來想說 openvpn 已經夠簡單了</p>
|
|
|
|
|
|
<p>今天看到文章說用wireguard 可以更簡單</p>
|
|
|
|
|
|
<p>於是研究了一下，發現還真的很簡單！</p>
|
|
|
|
|
|
<h3 id="download-deb-for-your-edgerouter">download deb for your edgerouter</h3>
|
|
|
|
|
|
<h4 id="go-check-https-github-com-lochnair-vyatta-wireguard-first">go check <a href="https://github.com/Lochnair/vyatta-wireguard">https://github.com/Lochnair/vyatta-wireguard</a> first</h4>
|
|
|
|
|
|
<pre><code>curl -L -O https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20190702-1/wireguard-v2.0-e50-0.0.20190702-1.deb
|
|
|
dpkg -i wireguard-v2.0-e50-0.0.20190702-1.deb
|
|
|
</code></pre>
|
|
|
|
|
|
<p>process log</p>
|
|
|
|
|
|
<pre><code>root@ubnt112:~# dpkg -i wireguard-v2.0-e50-0.0.20190702-1.deb
|
|
|
Selecting previously unselected package wireguard.
|
|
|
(Reading database ... 37024 files and directories currently installed.)
|
|
|
Preparing to unpack wireguard-v2.0-e50-0.0.20190702-1.deb ...
|
|
|
Adding 'diversion of /opt/vyatta/share/perl5/Vyatta/Interface.pm to /opt/vyatta/share/perl5/Vyatta/Interface.pm.vyatta by wireguard'
|
|
|
Adding 'diversion of /opt/vyatta/share/vyatta-cfg/templates/firewall/options/mss-clamp/interface-type/node.def to /opt/vyatta/share/vyatta-cfg/templates/firewall/options/mss-clamp/interface-type/node.def.vyatta by wireguard'
|
|
|
Unpacking wireguard (0.0.20190702-1) ...
|
|
|
Setting up wireguard (0.0.20190702-1) ...
|
|
|
</code></pre>
|
|
|
|
|
|
<h4 id="generate-private-public-key-in-left-router">generate private/public key in left router</h4>
|
|
|
|
|
|
<pre><code>wg genkey | tee /dev/tty | wg pubkey
|
|
|
</code></pre>
|
|
|
|
|
|
<p>first one in private key and the next one is public key of this router</p>
|
|
|
|
|
|
<pre><code>QGAUHJSDFAdkfjskdjo1DP8H1NuLTrXH6kue6kphaQk/iAkc=
|
|
|
ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU=
|
|
|
</code></pre>
|
|
|
|
|
|
<h4 id="configure-left-site-edgerouter">configure left site edgerouter</h4>
|
|
|
|
|
|
<pre><code>configure
|
|
|
set interfaces wireguard wg0 address 192.168.99.1/24
|
|
|
set interfaces wireguard wg0 listen-port 51820
|
|
|
set interfaces wireguard wg0 route-allowed-ips true
|
|
|
### paster your private key which was just been generate
|
|
|
set interfaces wireguard wg0 private-key QGAUHJSDFAdkfjskdjo1DP8H1NuLTrXH6kue6kphaQk/iAkc=
|
|
|
</code></pre>
|
|
|
|
|
|
<h4 id="generate-private-public-key-in-right-router">generate private/public key in right router</h4>
|
|
|
|
|
|
<pre><code>wg genkey | tee /dev/tty | wg pubkey
|
|
|
</code></pre>
|
|
|
|
|
|
<p>first one in private key and the next one is public key of this router</p>
|
|
|
|
|
|
<pre><code>UBzmPabcdefghijklmnopqrlbi5tnsQqjoJ4+H4=
|
|
|
tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk=
|
|
|
</code></pre>
|
|
|
|
|
|
<h4 id="configure-right-site-edgerouter">configure right site edgerouter</h4>
|
|
|
|
|
|
<pre><code>configure
|
|
|
set interfaces wireguard wg0 address 192.168.99.2/24
|
|
|
set interfaces wireguard wg0 listen-port 51820
|
|
|
set interfaces wireguard wg0 route-allowed-ips true
|
|
|
### paster your private key which was just been generate
|
|
|
set interfaces wireguard wg0 private-key UBzmPabcdefghijklmnopqrlbi5tnsQqjoJ4+H4=
|
|
|
</code></pre>
|
|
|
|
|
|
<p>now , configure both router to talk to each other</p>
|
|
|
|
|
|
<h4 id="configure-in-left-router">configure in left router</h4>
|
|
|
|
|
|
<pre><code>### use the right router public key here
|
|
|
set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= allowed-ips 192.168.99.0/16
|
|
|
set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= endpoint 222.222.222.222:51820
|
|
|
set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= persistent-keepalive 15
|
|
|
</code></pre>
|
|
|
|
|
|
<h4 id="configre-in-right-router">configre in right router</h4>
|
|
|
|
|
|
<pre><code>### use the left router public key here
|
|
|
set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= allowed-ips 192.168.99.0/16
|
|
|
set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= endpoint 111.111.111.111:51280
|
|
|
set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= persistent-keepalive 15
|
|
|
</code></pre>
|
|
|
|
|
|
<h4 id="configure-firewall-policy-in-left-site-router">configure firewall policy in left site router</h4>
|
|
|
|
|
|
<pre><code>### change 40 to your own rule number
|
|
|
set firewall name WAN_LOCAL rule 40 source port 51820
|
|
|
set firewall name WAN_LOCAL rule 40 destination port 51820
|
|
|
</code></pre>
|
|
|
|
|
|
<h4 id="configure-firewall-policy-in-right-site-router">configure firewall policy in right site router</h4>
|
|
|
|
|
|
<pre><code>### change 40 to your own rule number
|
|
|
set firewall name WAN_LOCAL rule 40 source port 51820
|
|
|
set firewall name WAN_LOCAL rule 40 destination port 51820
|
|
|
</code></pre>
|
|
|
|
|
|
<p>then finally , commit these changes on both side router</p>
|
|
|
|
|
|
<pre><code>commit
|
|
|
### and save if you want
|
|
|
save
|
|
|
</code></pre>
|
|
|
|
|
|
<h4 id="oops-one-more-step-add-static-route">oops , one more step , add static route</h4>
|
|
|
|
|
|
<h5 id="manually-add-static-route-in-left-router">manually add static route in left router</h5>
|
|
|
|
|
|
<pre><code>ip route add 192.168.111.0/24 dev wg0
|
|
|
</code></pre>
|
|
|
|
|
|
<h5 id="manually-add-static-route-in-right-router">manually add static route in right router</h5>
|
|
|
|
|
|
<pre><code>ip route add 192.168.112.0/24 dev wg0
|
|
|
</code></pre>
|
|
|
|
|
|
<h4 id="check-wireguard-status-in-both-router">check wireguard status in both router</h4>
|
|
|
|
|
|
<h5 id="left">left</h5>
|
|
|
|
|
|
<pre><code> root@ubnt112:~# sudo wg
|
|
|
interface: wg0
|
|
|
public key: ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU=
|
|
|
private key: (hidden)
|
|
|
listening port: 51820
|
|
|
|
|
|
peer: tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk=
|
|
|
endpoint: 111.111.111.111:51820
|
|
|
allowed ips: 192.168.99.0/16
|
|
|
latest handshake: 1 minute, 19 seconds ago
|
|
|
transfer: 7.49 MiB received, 195.86 MiB sent
|
|
|
persistent keepalive: every 15 seconds
|
|
|
root@ubnt112:~#
|
|
|
</code></pre>
|
|
|
|
|
|
<h5 id="right">right</h5>
|
|
|
|
|
|
<pre><code>interface: wg0
|
|
|
public key: tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk=
|
|
|
private key: (hidden)
|
|
|
listening port: 51820
|
|
|
|
|
|
peer: ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU=
|
|
|
endpoint: 222.222.222.222:51820
|
|
|
allowed ips: 192.168.99.0/16
|
|
|
latest handshake: 1 minute, 48 seconds ago
|
|
|
transfer: 195.60 MiB received, 8.07 MiB sent
|
|
|
persistent keepalive: every 15 seconds
|
|
|
root@ubnt111:~#
|
|
|
</code></pre>
|
|
|
|
|
|
<h3 id="need-more-edgerouter-and-lease-line-to-try-multiple-site-to-site-vpn-using-wideguard">need more edgerouter and lease line to try multiple site to site VPN using wideguard</h3>
|
|
|
|
|
|
<h5 id="need-to-study-about-allowed-ips">need to study about allowed-ips</h5>
|
|
|
|
|
|
<h3 id="sort-out-scripts">sort out scripts</h3>
|
|
|
|
|
|
<h5 id="left-router">left router</h5>
|
|
|
|
|
|
<pre><code>wg genkey | tee /dev/tty | wg pubkey
|
|
|
QGAUHJSDFAdkfjskdjo1DP8H1NuLTrXH6kue6kphaQk/iAkc=
|
|
|
ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU=
|
|
|
configure
|
|
|
set interfaces wireguard wg0 address 192.168.99.1/24
|
|
|
set interfaces wireguard wg0 listen-port 51820
|
|
|
set interfaces wireguard wg0 route-allowed-ips true
|
|
|
set interfaces wireguard wg0 private-key QGAUHJSDFAdkfjskdjo1DP8H1NuLTrXH6kue6kphaQk/iAkc=
|
|
|
set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= allowed-ips 192.168.99.0/16
|
|
|
set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= endpoint 222.222.222.222:51820
|
|
|
set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= persistent-keepalive 15
|
|
|
set firewall name WAN_LOCAL rule 40 action accept
|
|
|
set firewall name WAN_LOCAL rule 40 protocol udp
|
|
|
set firewall name WAN_LOCAL rule 40 source port 51820
|
|
|
set firewall name WAN_LOCAL rule 40 destination port 51820
|
|
|
commit
|
|
|
save
|
|
|
ip route add 192.168.111.0/24 dev wg0
|
|
|
</code></pre>
|
|
|
|
|
|
<h5 id="right-router">right router</h5>
|
|
|
|
|
|
<pre><code>wg genkey | tee /dev/tty | wg pubkey
|
|
|
UBzmPabcdefghijklmnopqrlbi5tnsQqjoJ4+H4=
|
|
|
tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk=
|
|
|
configure
|
|
|
set interfaces wireguard wg0 address 192.168.99.2/24
|
|
|
set interfaces wireguard wg0 listen-port 51820
|
|
|
set interfaces wireguard wg0 route-allowed-ips true
|
|
|
set interfaces wireguard wg0 private-key UBzmPabcdefghijklmnopqrlbi5tnsQqjoJ4+H4=
|
|
|
set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= allowed-ips 192.168.99.0/16
|
|
|
set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= endpoint 111.111.111.111:51280
|
|
|
set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= persistent-keepalive 15
|
|
|
set firewall name WAN_LOCAL rule 40 action accept
|
|
|
set firewall name WAN_LOCAL rule 40 protocol udp
|
|
|
set firewall name WAN_LOCAL rule 40 source port 51820
|
|
|
set firewall name WAN_LOCAL rule 40 destination port 51820
|
|
|
commit
|
|
|
save
|
|
|
ip route add 192.168.112.0/24 dev wg0
|
|
|
</code></pre>
|
|
|
</article>
|
|
|
</div>
|
|
|
|
|
|
<div class='entry-meta-bottom'>
|
|
|
|
|
|
|
|
|
<div class="entry-categories"><p><span>Categories</span>
|
|
|
|
|
|
<a href="/categories/%E7%AD%86%E8%A8%98" title="View all posts in 筆記">筆記</a>
|
|
|
</p>
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="entry-tags"><p><span>Tags</span>
|
|
|
|
|
|
<a href="/tags/vpn" title="View all posts tagged vpn">vpn</a>
|
|
|
|
|
|
<a href="/tags/edgerouter" title="View all posts tagged edgerouter">edgerouter</a>
|
|
|
|
|
|
|
|
|
</p></div> </div>
|
|
|
|
|
|
|
|
|
<div class="author-meta">
|
|
|
|
|
|
<div class="author">
|
|
|
|
|
|
<img alt='Eric Chang' src="https://www.gravatar.com/avatar/23f8ed94e007297499ac8df1641b3ff5?s=100&d=identicon" class='avatar avatar-72 photo' height='72' width='72'>
|
|
|
|
|
|
<span>
|
|
|
Written by:<a href="https://github.com/changchichung" title="Posts by Eric Chang" rel="author">Eric Chang</a> </span>
|
|
|
</div>
|
|
|
<div class="bio">
|
|
|
|
|
|
|
|
|
<p>塵世裡一個迷途小書僮</p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="facebook" target="_blank"
|
|
|
href="full%20Social%20profile%20url%20in%20facebook">
|
|
|
<i class="fab fa-facebook-f"
|
|
|
title="facebook icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="googleplus" target="_blank"
|
|
|
href="full%20profile%20url%20in%20googleplus">
|
|
|
<i class="fab fa-google-plus-g"
|
|
|
title="googleplus icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="twitter" target="_blank"
|
|
|
href="chang0206">
|
|
|
<i class="fab fa-twitter-square"
|
|
|
title="twitter icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
<a class="linkedin" target="_blank"
|
|
|
href="full%20profile%20url%20in%20linkedin">
|
|
|
<i class="fab fa-linkedin"
|
|
|
title="linkedin icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="email" target="_blank"
|
|
|
href="mailto:mc@hotshraingmy.info">
|
|
|
<i class="fas fa-envelope"
|
|
|
title="email icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="instagram" target="_blank"
|
|
|
href="chang0206">
|
|
|
<i class="fab fa-instagram"
|
|
|
title="instagram icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="stackoverflow" target="_blank"
|
|
|
href="full%20profile%20url%20in%20stackoverflow">
|
|
|
<i class="fab fa-stack-overflow"
|
|
|
title="stackoverflow icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="github" target="_blank"
|
|
|
href="changchichung">
|
|
|
<i class="fab fa-github"
|
|
|
title="github icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="pinterest" target="_blank"
|
|
|
href="full%20profile%20url%20in%20pinterest">
|
|
|
<i class="fab fa-pinterest"
|
|
|
title="pinterest icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
</div>
|
|
|
|
|
|
<section id="comments" class="comments">
|
|
|
<div id="disqus_thread"></div>
|
|
|
<script type="application/javascript">
|
|
|
var disqus_config = function () {
|
|
|
|
|
|
|
|
|
|
|
|
};
|
|
|
(function() {
|
|
|
if (["localhost", "127.0.0.1"].indexOf(window.location.hostname) != -1) {
|
|
|
document.getElementById('disqus_thread').innerHTML = 'Disqus comments not available by default when the website is previewed locally.';
|
|
|
return;
|
|
|
}
|
|
|
var d = document, s = d.createElement('script'); s.async = true;
|
|
|
s.src = '//' + "h-cowbay-org-1" + '.disqus.com/embed.js';
|
|
|
s.setAttribute('data-timestamp', +new Date());
|
|
|
(d.head || d.body).appendChild(s);
|
|
|
})();
|
|
|
</script>
|
|
|
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
|
|
|
<a href="https://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</section>
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<footer id="site-footer" class="site-footer" role="contentinfo">
|
|
|
<h1>
|
|
|
|
|
|
<a href=""> MC部落 </a>
|
|
|
|
|
|
</h1>
|
|
|
|
|
|
|
|
|
<p class="site-description">What’s the Worst That Could Happen?</p>
|
|
|
|
|
|
|
|
|
<div id="menu-footer" class="menu-container menu-footer" role="navigation">
|
|
|
<div class="menu">
|
|
|
|
|
|
<ul id="menu-footer-items" class="menu-footer-items">
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
</div> </div>
|
|
|
|
|
|
<ul class="social-media-icons">
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a class="facebook" target="_blank"
|
|
|
href="full%20Social%20profile%20url%20in%20facebook" >
|
|
|
<i class="fab fa-facebook-f" title="facebook"></i>
|
|
|
<span class="screen-reader-text">facebook</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a class="googleplus" target="_blank"
|
|
|
href="full%20profile%20url%20in%20googleplus" >
|
|
|
<i class="fab fa-google-plus-g" title="googleplus"></i>
|
|
|
<span class="screen-reader-text">googleplus</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" class="twitter" target="_blank">
|
|
|
<i class="fab fa-twitter-square" title="twitter"></i>
|
|
|
<span class="screen-reader-text">twitter</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" class="instagram" target="_blank">
|
|
|
<i class="fab fa-instagram" title="instagram"></i>
|
|
|
<span class="screen-reader-text">instagram</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="mailto:mc@hotshraingmy.info" class="email">
|
|
|
<i class="fas fa-envelope" title="email"></i>
|
|
|
<span class="screen-reader-text">email</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20linkedin" class="linkedin" target="_blank">
|
|
|
<i class="fab fa-linkedin-in" title="linkedin"></i>
|
|
|
<span class="screen-reader-text">linkedin</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20stackoverflow" class="stackoverflow" target="_blank">
|
|
|
<i class="fab fa-stack-overflow" title="stackoverflow"></i>
|
|
|
<span class="screen-reader-text">stackoverflow</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="changchichung" class="github" target="_blank">
|
|
|
<i class="fab fa-github" title="github"></i>
|
|
|
<span class="screen-reader-text">github</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20pinterest" class="pinterest" target="_blank">
|
|
|
<i class="fab fa-pinterest" title="pinterest"></i>
|
|
|
<span class="screen-reader-text">pinterest</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="https://h.cowbay.org/index.xml" data-animate-hover="pulse" class="rss" target="_blank">
|
|
|
<i class="fas fa-rss" title="rss"></i>
|
|
|
<span class="screen-reader-text">rss</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
</ul> <div class="design-credit">
|
|
|
|
|
|
<p>© 2018 Göran Svensson</p>
|
|
|
|
|
|
<p>Nederburg Hugo Theme by <a href="https://appernetic.io">Appernetic</a>.</p>
|
|
|
|
|
|
<p>A port of Tracks by Compete Themes.</p>
|
|
|
|
|
|
</div>
|
|
|
</footer>
|
|
|
|
|
|
</div>
|
|
|
<script src="https://h.cowbay.org/js/jquery.min.js"></script>
|
|
|
<script src="https://h.cowbay.org/js/jquerymigrate.js"></script>
|
|
|
<script src="https://h.cowbay.org/js/production.min.js?v=1626744134"></script>
|
|
|
|
|
|
</body>
|
|
|
</html>
|
