|
|
<!DOCTYPE html>
|
|
|
<html lang="en-us">
|
|
|
<head><meta charset="utf-8">
|
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
|
<script type="application/ld+json">
|
|
|
{
|
|
|
"@context" : "http://schema.org",
|
|
|
"@type" : "BlogPosting",
|
|
|
"mainEntityOfPage": {
|
|
|
"@type": "WebPage",
|
|
|
"@id": "https:\/\/h.cowbay.org"
|
|
|
},
|
|
|
"articleSection" : "post",
|
|
|
"name" : "[筆記] 透過 wireguard 建立多點 site to site VPN \/ Multiple Site to Site VPN Using Wireguard",
|
|
|
"headline" : "[筆記] 透過 wireguard 建立多點 site to site VPN \/ Multiple Site to Site VPN Using Wireguard",
|
|
|
"description" : "\u003cp\u003e因為實在受夠了現在用的 openwrt \u002b strongswan 建立 IPSec VPN\u003c\/p\u003e\n\u003cp\u003e雖然說其實沒有什麼不好，但是畢竟不是我建立的，而當初的文件也都不見了\u003c\/p\u003e\n\u003cp\u003e完全沒辦法了解當時設計的邏輯，造成後續debug 困難\u003c\/p\u003e\n\u003cp\u003e可以想像一下，一台VPN router ping 不到remote、ping不到internet、甚至ping不到自己 是要怎麼debug !?(翻桌\u003c\/p\u003e\n\u003cp\u003e之前買了兩台edgerouter X 拿來玩了一下 wireguard，感覺還不錯，不過只有測試到點對點\u003c\/p\u003e\n\u003cp\u003e這次試試看躲在gateway後面，看看能不能建立多點的VPN環境\u003c\/p\u003e",
|
|
|
"inLanguage" : "en",
|
|
|
"author" : "Eric Chang",
|
|
|
"creator" : "Eric Chang",
|
|
|
"publisher": "Eric Chang",
|
|
|
"accountablePerson" : "Eric Chang",
|
|
|
"copyrightHolder" : "Eric Chang",
|
|
|
"copyrightYear" : "2019",
|
|
|
"datePublished": "2019-08-13 15:50:31 \u002b0800 CST",
|
|
|
"dateModified" : "2019-08-13 15:50:31 \u002b0800 CST",
|
|
|
"url" : "https:\/\/h.cowbay.org\/post\/multiple-site-to-site-vpn-using-wireguard\/",
|
|
|
"wordCount" : "1075",
|
|
|
"image" : "https://h.cowbay.orghttps://h.cowbay.org/images/post-default-10.jpg"",
|
|
|
"keywords" : [ ""vpn"",""ubuntu"",""wireguard"","Blog" ]
|
|
|
}
|
|
|
</script>
|
|
|
|
|
|
|
|
|
<title>[筆記] 透過 wireguard 建立多點 site to site VPN / Multiple Site to Site VPN Using Wireguard </title>
|
|
|
|
|
|
|
|
|
<meta name="description" content="some articles about job,food,passion sisters" />
|
|
|
|
|
|
|
|
|
|
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
|
<meta name="robots" content="all,follow">
|
|
|
<meta name="googlebot" content="index,follow,snippet,archive">
|
|
|
<link rel="stylesheet" id="ct-tracks-google-fonts-css" href="https://fonts.googleapis.com/css?family=Raleway%3A400%2C700&subset=latin%2Clatin-ext&ver=4.7.2" type="text/css" media="all">
|
|
|
|
|
|
<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.3.1/css/all.css" integrity="sha384-mzrmE5qonljUremFsqc01SB46JvROS7bZs3IO2EmfFsd15uHvIt+Y8vEf7N7fWAU" crossorigin="anonymous">
|
|
|
|
|
|
<link href="https://h.cowbay.org/css/style.css?v=1634607506" rel="stylesheet" id="theme-stylesheet" type='text/css' media='all'>
|
|
|
|
|
|
<link href="https://h.cowbay.org/css/custom.css?v=1634607506" rel="stylesheet" type='text/css' media='all'>
|
|
|
<link rel="shortcut icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
|
|
|
<link rel="icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
|
|
|
|
|
|
|
|
|
<script type="application/javascript">
|
|
|
var doNotTrack = false;
|
|
|
if (!doNotTrack) {
|
|
|
window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date;
|
|
|
ga('create', 'UA-138954876-1', 'auto');
|
|
|
|
|
|
ga('send', 'pageview');
|
|
|
}
|
|
|
</script>
|
|
|
<script async src='https://www.google-analytics.com/analytics.js'></script>
|
|
|
|
|
|
</head>
|
|
|
|
|
|
|
|
|
<body class="post-template-default single single-post single-format-standard ct-body singular singular-post not-front standard">
|
|
|
|
|
|
<div id="overflow-container" class="overflow-container">
|
|
|
<a class="skip-content" href="#main">Skip to content</a>
|
|
|
<header id="site-header" class="site-header" role="banner">
|
|
|
<div class='top-navigation'>
|
|
|
<div class='container'>
|
|
|
|
|
|
<div id="menu-secondary" class="menu-container menu-secondary" role="navigation">
|
|
|
<button id="toggle-secondary-navigation" class="toggle-secondary-navigation"><i class="fas fa-plus"></i></button>
|
|
|
|
|
|
<div class="menu">
|
|
|
|
|
|
<ul id="menu-secondary-items" class="menu-secondary-items">
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/ansible">ansible</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/linux">linux</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/proxmox">proxmox</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/ps">ps</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E7%A2%8E%E5%BF%B5">碎念</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E7%AD%86%E8%A8%98">筆記</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E7%BE%A4%E6%9A%89">群暉</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E9%9B%9C%E5%BF%B5">雜念</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
<ul class="social-media-icons">
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20Social%20profile%20url%20in%20facebook" data-animate-hover="pulse" class="facebook" target="_blank">
|
|
|
<i class="fab fa-facebook-square" title="facebook"></i>
|
|
|
<span class="screen-reader-text">facebook</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20googleplus" data-animate-hover="pulse" class="gplus" target="_blank">
|
|
|
<i class="fab fa-google-plus-g" title="googleplus"></i>
|
|
|
<span class="screen-reader-text">googleplus</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" data-animate-hover="pulse" class="twitter" target="_blank">
|
|
|
<i class="fab fa-twitter-square" title="twitter"></i>
|
|
|
<span class="screen-reader-text">twitter</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" data-animate-hover="pulse" class="instagram" target="_blank">
|
|
|
<i class="fab fa-instagram" title="instagram"></i>
|
|
|
<span class="screen-reader-text">instagram</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="mailto:mc@hotshraingmy.info" data-animate-hover="pulse" class="email">
|
|
|
<i class="fas fa-envelope" title="email"></i>
|
|
|
<span class="screen-reader-text">email</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20linkedin" data-animate-hover="pulse" class="linkedin" target="_blank">
|
|
|
<i class="fab fa-linkedin-in" title="linkedin"></i>
|
|
|
<span class="screen-reader-text">linkedin</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20stackoverflow" data-animate-hover="pulse" class="stackoverflow" target="_blank">
|
|
|
<i class="fab fa-stack-overflow" title="stackoverflow"></i>
|
|
|
<span class="screen-reader-text">stackoverflow</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="changchichung" data-animate-hover="pulse" class="github" target="_blank">
|
|
|
<i class="fab fa-github" title="github"></i>
|
|
|
<span class="screen-reader-text">github</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20pinterest" data-animate-hover="pulse" class="pinterest" target="_blank">
|
|
|
<i class="fab fa-pinterest" title="pinterest"></i>
|
|
|
<span class="screen-reader-text">pinterest</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="https://h.cowbay.org/index.xml" data-animate-hover="pulse" class="rss" target="_blank">
|
|
|
<i class="fas fa-rss" title="rss"></i>
|
|
|
<span class="screen-reader-text">rss</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
</ul></div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="container">
|
|
|
<div id="title-info" class="title-info">
|
|
|
<div id='site-title' class='site-title'>
|
|
|
|
|
|
<a href="/"> MC部落 </a>
|
|
|
</div>
|
|
|
</div>
|
|
|
<button id="toggle-navigation" class="toggle-navigation">
|
|
|
<i class="fas fa-bars"></i>
|
|
|
</button>
|
|
|
|
|
|
<div id="menu-primary-tracks" class="menu-primary-tracks"></div>
|
|
|
<div id="menu-primary" class="menu-container menu-primary" role="navigation">
|
|
|
|
|
|
<p class="site-description">What’s the Worst That Could Happen?</p>
|
|
|
|
|
|
|
|
|
<div class="menu">
|
|
|
<ul id="menu-primary-items" class="menu-primary-items">
|
|
|
|
|
|
|
|
|
<li class='menu-item menu-item-type-custom menu-item-object-custom '>
|
|
|
<a href="https://h.cowbay.org/">Home</a>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class='menu-item menu-item-type-post_type menu-item-object-page '>
|
|
|
<a href="https://h.cowbay.org/about/">About</a>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class='menu-item menu-item-type-post_type menu-item-object-page '>
|
|
|
<a href="https://h.cowbay.org/contact/">Get in touch</a>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
</header>
|
|
|
|
|
|
<div id="main" class="main" role="main">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<div id="loop-container" class="loop-container">
|
|
|
|
|
|
<div class="post type-post status-publish format-standard has-post-thumbnail hentry category-design tag-design tag-standard-2 tag-tagalicious tag-travel entry full-without-featured odd excerpt-1">
|
|
|
|
|
|
<div class='featured-image lazy lazy-bg-image' data-background="https://h.cowbay.org/images/post-default-10.jpg">
|
|
|
</div>
|
|
|
|
|
|
<div class="entry-meta">
|
|
|
<span class="date">13 August</span> <span> / </span>
|
|
|
|
|
|
<span class="author">
|
|
|
<a href="https://github.com/changchichung" title="Posts by Eric Chang" rel="author">Eric Chang</a>
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
<span class="category">
|
|
|
<span> / </span>
|
|
|
|
|
|
<a href="/categories/%E7%AD%86%E8%A8%98">筆記</a>
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
<div class='entry-header'>
|
|
|
<h1 class='entry-title'> [筆記] 透過 wireguard 建立多點 site to site VPN / Multiple Site to Site VPN Using Wireguard</h1>
|
|
|
</div>
|
|
|
<div class="entry-container">
|
|
|
<div class="entry-content">
|
|
|
<article>
|
|
|
<p>因為實在受夠了現在用的 openwrt + strongswan 建立 IPSec VPN</p>
|
|
|
<p>雖然說其實沒有什麼不好，但是畢竟不是我建立的，而當初的文件也都不見了</p>
|
|
|
<p>完全沒辦法了解當時設計的邏輯，造成後續debug 困難</p>
|
|
|
<p>可以想像一下，一台VPN router ping 不到remote、ping不到internet、甚至ping不到自己 是要怎麼debug !?(翻桌</p>
|
|
|
<p>之前買了兩台edgerouter X 拿來玩了一下 wireguard，感覺還不錯，不過只有測試到點對點</p>
|
|
|
<p>這次試試看躲在gateway後面，看看能不能建立多點的VPN環境</p>
|
|
|
<h4 id="every-node">every node</h4>
|
|
|
<h5 id="enable-ip_forward">enable ip_forward</h5>
|
|
|
<p>edit /etc/sysctl.conf
|
|
|
add below line in the end of the file</p>
|
|
|
<pre tabindex="0"><code>net.ipv4.ip_forward=1
|
|
|
</code></pre><h5 id="install-wireguard">install wireguard</h5>
|
|
|
<pre tabindex="0"><code>sudo apt-get install libmnl-dev linux-headers-$(uname -r) build-essential make git libelf-dev
|
|
|
git clone https://git.zx2c4.com/WireGuard
|
|
|
cd WireGuard/src/
|
|
|
make
|
|
|
sudo make install
|
|
|
</code></pre><p>or
|
|
|
<strong>via apt</strong></p>
|
|
|
<pre tabindex="0"><code>sudo add-apt-repository ppa:wireguard/wireguard
|
|
|
sudo apt install wireguard
|
|
|
</code></pre><h5 id="create-wireguard-service-file">create wireguard service file</h5>
|
|
|
<p>add /etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service</p>
|
|
|
<pre tabindex="0"><code>[Unit]
|
|
|
Description=WireGuard via wg-quick(8) for %I
|
|
|
After=network-online.target nss-lookup.target
|
|
|
Wants=network-online.target nss-lookup.target
|
|
|
Documentation=man:wg-quick(8)
|
|
|
Documentation=man:wg(8)
|
|
|
Documentation=https://www.wireguard.com/
|
|
|
Documentation=https://www.wireguard.com/quickstart/
|
|
|
Documentation=https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick.8
|
|
|
Documentation=https://git.zx2c4.com/WireGuard/about/src/tools/man/wg.8
|
|
|
|
|
|
[Service]
|
|
|
Type=oneshot
|
|
|
RemainAfterExit=yes
|
|
|
ExecStart=/usr/bin/wg-quick up %i
|
|
|
ExecStop=/usr/bin/wg-quick down %i
|
|
|
Environment=WG_ENDPOINT_RESOLUTION_RETRIES=infinity
|
|
|
|
|
|
[Install]
|
|
|
WantedBy=multi-user.target
|
|
|
</code></pre><h4 id="node-a">Node A</h4>
|
|
|
<h5 id="create-wireguard-privatepublic-key">create wireguard private/public key</h5>
|
|
|
<pre tabindex="0"><code>wg genkey > /etc/wireguard/private
|
|
|
cat /etc/wireguard/private | wg pubkey > /etc/wireguard/public
|
|
|
</code></pre><h5 id="etcwireguardwg0conf">/etc/wireguard/wg0.conf</h5>
|
|
|
<p>watch the interface name , must meets the interface name in system , ens18 is the default value of my test VM</p>
|
|
|
<pre tabindex="0"><code>[Interface]
|
|
|
Address = 10.0.0.40/24
|
|
|
ListenPort = 12000
|
|
|
PrivateKey = private key of node A
|
|
|
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
|
|
|
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens18 -j MASQUERADE
|
|
|
|
|
|
[Peer]
|
|
|
PublicKey = public key of node B
|
|
|
AllowedIPs = 10.0.0.28/32,192.168.28.0/24
|
|
|
Endpoint = 2.2.2.2:12000
|
|
|
PersistentKeepalive = 15
|
|
|
|
|
|
[Peer]
|
|
|
PublicKey = public key of node C
|
|
|
AllowedIPs = 10.0.0.80/32,192.168.80.0/24
|
|
|
Endpoint = 3.3.3.3:12000
|
|
|
PersistentKeepalive = 15
|
|
|
</code></pre><h4 id="node-b-peer-1">Node B (peer 1)</h4>
|
|
|
<h5 id="create-wireguard-privatepublic-key-1">create wireguard private/public key</h5>
|
|
|
<pre tabindex="0"><code>wg genkey > /etc/wireguard/private
|
|
|
cat /etc/wireguard/private | wg pubkey > /etc/wireguard/public
|
|
|
</code></pre><h5 id="etcwireguardwg0conf-1">/etc/wireguard/wg0.conf</h5>
|
|
|
<p>watch the interface name , must meets the interface name in system , ens18 is the default value of my test VM</p>
|
|
|
<pre tabindex="0"><code>[Interface]
|
|
|
ListenPort = 12000
|
|
|
PrivateKey = private key of node B
|
|
|
Address = 10.0.0.28/24
|
|
|
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
|
|
|
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens18 -j MASQUERADE
|
|
|
|
|
|
[Peer]
|
|
|
PublicKey = public key of node A
|
|
|
AllowedIPs = 10.0.0.40/32,192.168.40.0/24
|
|
|
Endpoint = 1.1.1.1:12000
|
|
|
PersistentKeepalive = 15
|
|
|
|
|
|
[Peer]
|
|
|
PublicKey = public key of node C
|
|
|
AllowedIPs = 10.0.0.80/32,192.168.80.0/24
|
|
|
Endpoint = 3.3.3.3:12000
|
|
|
PersistentKeepalive = 15
|
|
|
|
|
|
</code></pre><h4 id="node-c-peer-2">Node C (peer 2)</h4>
|
|
|
<h5 id="create-wireguard-privatepublic-key-2">create wireguard private/public key</h5>
|
|
|
<pre tabindex="0"><code>wg genkey > /etc/wireguard/private
|
|
|
cat /etc/wireguard/private | wg pubkey > /etc/wireguard/public
|
|
|
</code></pre><h4 id="etcwireguardwg0conf-2">/etc/wireguard/wg0.conf</h4>
|
|
|
<p>watch the interface name , must meets the interface name in system , ens18 is the default value of my test VM</p>
|
|
|
<pre tabindex="0"><code>[Interface]
|
|
|
ListenPort = 12000
|
|
|
PrivateKey = private key of node C
|
|
|
Address = 10.0.0.80/24
|
|
|
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
|
|
|
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens18 -j MASQUERADE
|
|
|
|
|
|
|
|
|
[Peer]
|
|
|
PublicKey = public key of node A
|
|
|
AllowedIPs = 10.0.0.40/32,192.168.40.0/24
|
|
|
Endpoint = 1.1.1.1:12000
|
|
|
PersistentKeepalive = 15
|
|
|
|
|
|
[Peer]
|
|
|
PublicKey = public key of node B
|
|
|
AllowedIPs = 10.0.0.28/32,192.168.28.0/24
|
|
|
Endpoint = 2.2.2.2:12000
|
|
|
PersistentKeepalive = 15
|
|
|
</code></pre><h5 id="test">Test</h5>
|
|
|
<p>Reboot all nodes , check if interface wg0 up by default or not</p>
|
|
|
<p>use command wg show to check status</p>
|
|
|
<p>for example , this is result of wg show in node C</p>
|
|
|
<pre tabindex="0"><code>root@sdvpn:~# wg show
|
|
|
interface: wg0
|
|
|
public key: public key of Node C
|
|
|
private key: (hidden)
|
|
|
listening port: 12000
|
|
|
|
|
|
peer: public key of node A
|
|
|
endpoint: 1.1.1.1:12000
|
|
|
allowed ips: 10.0.0.40/32, 192.168.40.0/24
|
|
|
latest handshake: 49 seconds ago
|
|
|
transfer: 9.77 KiB received, 9.73 KiB sent
|
|
|
persistent keepalive: every 15 seconds
|
|
|
|
|
|
peer: public key of node B
|
|
|
endpoint: 2.2.2.2:12000
|
|
|
allowed ips: 10.0.0.28/32, 192.168.28.0/24
|
|
|
latest handshake: 2 minutes, 8 seconds ago
|
|
|
transfer: 3.93 KiB received, 7.89 KiB sent
|
|
|
persistent keepalive: every 15 seconds
|
|
|
</code></pre><p>and the ping test</p>
|
|
|
<pre tabindex="0"><code>root@sdvpn:~# ping -c 1 192.168.40.40
|
|
|
PING 192.168.40.40 (192.168.40.40) 56(84) bytes of data.
|
|
|
64 bytes from 192.168.40.40: icmp_seq=1 ttl=63 time=21.2 ms
|
|
|
|
|
|
--- 192.168.40.40 ping statistics ---
|
|
|
1 packets transmitted, 1 received, 0% packet loss, time 0ms
|
|
|
rtt min/avg/max/mdev = 21.204/21.204/21.204/0.000 ms
|
|
|
root@sdvpn:~# ping -c 1 192.168.28.40
|
|
|
PING 192.168.28.40 (192.168.28.40) 56(84) bytes of data.
|
|
|
64 bytes from 192.168.28.40: icmp_seq=1 ttl=63 time=24.2 ms
|
|
|
|
|
|
--- 192.168.28.40 ping statistics ---
|
|
|
1 packets transmitted, 1 received, 0% packet loss, time 0ms
|
|
|
rtt min/avg/max/mdev = 24.208/24.208/24.208/0.000 ms
|
|
|
root@sdvpn:~#
|
|
|
</code></pre><p>and the traceroute</p>
|
|
|
<pre tabindex="0"><code>root@sdvpn:~# traceroute 192.168.40.40
|
|
|
traceroute to 192.168.40.40 (192.168.40.40), 30 hops max, 60 byte packets
|
|
|
1 10.0.0.40 (10.0.0.40) 21.349 ms 22.337 ms 22.576 ms
|
|
|
2 tcpc040.abc.com (192.168.40.40) 22.565 ms 22.551 ms 22.541 ms
|
|
|
root@sdvpn:~# traceroute 192.168.28.40
|
|
|
traceroute to 192.168.28.40 (192.168.28.40), 30 hops max, 60 byte packets
|
|
|
1 10.0.0.28 (10.0.0.28) 25.481 ms 30.117 ms 32.086 ms
|
|
|
2 dcpc040.abc.com (192.168.28.40) 33.811 ms 35.360 ms 36.769 ms
|
|
|
root@sdvpn:~#
|
|
|
</code></pre><h4 id="additonal-steps">additonal steps</h4>
|
|
|
<h5 id="enable-firewall-nat-in-each-nodes-router">enable firewall NAT in each nodes router</h5>
|
|
|
<p>not necessary , but if the wireguard node is behind a NAT router , then must enable NAT for wireguard</p>
|
|
|
<p>1.1.1.1 is the WAN IP of the router , and 192.168.80.4 is the wireguard LAN ip, I map port 224 to ssh and 12000 for wireguard</p>
|
|
|
<pre tabindex="0"><code>iptables -t nat -A PREROUTING -i eth1 -d 1.1.1.1 -p tcp --dport 224 -j DNAT --to-destination 192.168.80.4:22
|
|
|
iptables -t nat -A PREROUTING -i eth1 -d 1.1.1.1 -p udp --dport 12000 -j DNAT --to-destination 192.168.80.4:12000
|
|
|
</code></pre><h4 id="summary">summary</h4>
|
|
|
<p>if want to add more nodes into VPN , just follow the logic and steps.</p>
|
|
|
<pre tabindex="0"><code>create private/public key
|
|
|
create wg0.conf
|
|
|
add new nodes in every other nodes wg0.conf as peer
|
|
|
</code></pre><ol>
|
|
|
<li>for route , must add remote network in AllowedIPs</li>
|
|
|
<li>check ip_forward is enable</li>
|
|
|
<li>I think the postup haws no effect here , because the firewall service was disable by default , and if I use iptables -F to flush all firewall rules , the network still remain in connected.</li>
|
|
|
<li>need to create an ansible playbook for this</li>
|
|
|
</ol>
|
|
|
<h4 id="update">Update</h4>
|
|
|
<h5 id="strongswan-ipsec-vs-wireguard">strongswan IPSEC VS wireguard</h5>
|
|
|
<p><strong>wireguard almost twice faster than strongswan</strong></p>
|
|
|
<p>iperf test with wireguard VPN 30 seconds benchmark</p>
|
|
|
<pre tabindex="0"><code>root@sdvpn:~# iperf -c 192.168.40.7 -t 30
|
|
|
------------------------------------------------------------
|
|
|
Client connecting to 192.168.40.7, TCP port 5001
|
|
|
TCP window size: 85.0 KByte (default)
|
|
|
------------------------------------------------------------
|
|
|
[ 3] local 10.0.0.80 port 48270 connected with 192.168.40.7 port 5001
|
|
|
[ ID] Interval Transfer Bandwidth
|
|
|
[ 3] 0.0-30.1 sec 65.1 MBytes 18.1 Mbits/sec
|
|
|
root@sdvpn:~#
|
|
|
</code></pre><p>iperf test with strongswan VPN</p>
|
|
|
<pre tabindex="0"><code>root@sdvpn:~# iperf -c 192.168.40.7 -t 30
|
|
|
------------------------------------------------------------
|
|
|
Client connecting to 192.168.40.7, TCP port 5001
|
|
|
TCP window size: 85.0 KByte (default)
|
|
|
------------------------------------------------------------
|
|
|
[ 3] local 192.168.80.4 port 57806 connected with 192.168.40.7 port 5001
|
|
|
[ ID] Interval Transfer Bandwidth
|
|
|
[ 3] 0.0-30.1 sec 35.6 MBytes 9.94 Mbits/sec
|
|
|
root@sdvpn:~#
|
|
|
</code></pre>
|
|
|
</article>
|
|
|
</div>
|
|
|
|
|
|
<div class='entry-meta-bottom'>
|
|
|
|
|
|
|
|
|
<div class="entry-categories"><p><span>Categories</span>
|
|
|
|
|
|
<a href="/categories/%E7%AD%86%E8%A8%98" title="View all posts in 筆記">筆記</a>
|
|
|
</p>
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="entry-tags"><p><span>Tags</span>
|
|
|
|
|
|
<a href="/tags/vpn" title="View all posts tagged vpn">vpn</a>
|
|
|
|
|
|
<a href="/tags/ubuntu" title="View all posts tagged ubuntu">ubuntu</a>
|
|
|
|
|
|
<a href="/tags/wireguard" title="View all posts tagged wireguard">wireguard</a>
|
|
|
|
|
|
|
|
|
</p></div> </div>
|
|
|
|
|
|
|
|
|
<div class="author-meta">
|
|
|
|
|
|
<div class="author">
|
|
|
|
|
|
<img alt='Eric Chang' src="https://www.gravatar.com/avatar/23f8ed94e007297499ac8df1641b3ff5?s=100&d=identicon" class='avatar avatar-72 photo' height='72' width='72'>
|
|
|
|
|
|
<span>
|
|
|
Written by:<a href="https://github.com/changchichung" title="Posts by Eric Chang" rel="author">Eric Chang</a> </span>
|
|
|
</div>
|
|
|
<div class="bio">
|
|
|
|
|
|
|
|
|
<p>塵世裡一個迷途小書僮</p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="facebook" target="_blank"
|
|
|
href="full%20Social%20profile%20url%20in%20facebook">
|
|
|
<i class="fab fa-facebook-f"
|
|
|
title="facebook icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="googleplus" target="_blank"
|
|
|
href="full%20profile%20url%20in%20googleplus">
|
|
|
<i class="fab fa-google-plus-g"
|
|
|
title="googleplus icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="twitter" target="_blank"
|
|
|
href="chang0206">
|
|
|
<i class="fab fa-twitter-square"
|
|
|
title="twitter icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
<a class="linkedin" target="_blank"
|
|
|
href="full%20profile%20url%20in%20linkedin">
|
|
|
<i class="fab fa-linkedin"
|
|
|
title="linkedin icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="email" target="_blank"
|
|
|
href="mailto:mc@hotshraingmy.info">
|
|
|
<i class="fas fa-envelope"
|
|
|
title="email icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="instagram" target="_blank"
|
|
|
href="chang0206">
|
|
|
<i class="fab fa-instagram"
|
|
|
title="instagram icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="stackoverflow" target="_blank"
|
|
|
href="full%20profile%20url%20in%20stackoverflow">
|
|
|
<i class="fab fa-stack-overflow"
|
|
|
title="stackoverflow icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="github" target="_blank"
|
|
|
href="changchichung">
|
|
|
<i class="fab fa-github"
|
|
|
title="github icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="pinterest" target="_blank"
|
|
|
href="full%20profile%20url%20in%20pinterest">
|
|
|
<i class="fab fa-pinterest"
|
|
|
title="pinterest icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
</div>
|
|
|
|
|
|
<section id="comments" class="comments">
|
|
|
<div id="disqus_thread"></div>
|
|
|
<script type="application/javascript">
|
|
|
var disqus_config = function () {
|
|
|
|
|
|
|
|
|
|
|
|
};
|
|
|
(function() {
|
|
|
if (["localhost", "127.0.0.1"].indexOf(window.location.hostname) != -1) {
|
|
|
document.getElementById('disqus_thread').innerHTML = 'Disqus comments not available by default when the website is previewed locally.';
|
|
|
return;
|
|
|
}
|
|
|
var d = document, s = d.createElement('script'); s.async = true;
|
|
|
s.src = '//' + "h-cowbay-org-1" + '.disqus.com/embed.js';
|
|
|
s.setAttribute('data-timestamp', +new Date());
|
|
|
(d.head || d.body).appendChild(s);
|
|
|
})();
|
|
|
</script>
|
|
|
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
|
|
|
<a href="https://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</section>
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<footer id="site-footer" class="site-footer" role="contentinfo">
|
|
|
<h1>
|
|
|
|
|
|
<a href=""> MC部落 </a>
|
|
|
|
|
|
</h1>
|
|
|
|
|
|
|
|
|
<p class="site-description">What’s the Worst That Could Happen?</p>
|
|
|
|
|
|
|
|
|
<div id="menu-footer" class="menu-container menu-footer" role="navigation">
|
|
|
<div class="menu">
|
|
|
|
|
|
<ul id="menu-footer-items" class="menu-footer-items">
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
</div> </div>
|
|
|
|
|
|
<ul class="social-media-icons">
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a class="facebook" target="_blank"
|
|
|
href="full%20Social%20profile%20url%20in%20facebook" >
|
|
|
<i class="fab fa-facebook-f" title="facebook"></i>
|
|
|
<span class="screen-reader-text">facebook</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a class="googleplus" target="_blank"
|
|
|
href="full%20profile%20url%20in%20googleplus" >
|
|
|
<i class="fab fa-google-plus-g" title="googleplus"></i>
|
|
|
<span class="screen-reader-text">googleplus</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" class="twitter" target="_blank">
|
|
|
<i class="fab fa-twitter-square" title="twitter"></i>
|
|
|
<span class="screen-reader-text">twitter</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" class="instagram" target="_blank">
|
|
|
<i class="fab fa-instagram" title="instagram"></i>
|
|
|
<span class="screen-reader-text">instagram</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="mailto:mc@hotshraingmy.info" class="email">
|
|
|
<i class="fas fa-envelope" title="email"></i>
|
|
|
<span class="screen-reader-text">email</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20linkedin" class="linkedin" target="_blank">
|
|
|
<i class="fab fa-linkedin-in" title="linkedin"></i>
|
|
|
<span class="screen-reader-text">linkedin</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20stackoverflow" class="stackoverflow" target="_blank">
|
|
|
<i class="fab fa-stack-overflow" title="stackoverflow"></i>
|
|
|
<span class="screen-reader-text">stackoverflow</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="changchichung" class="github" target="_blank">
|
|
|
<i class="fab fa-github" title="github"></i>
|
|
|
<span class="screen-reader-text">github</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20pinterest" class="pinterest" target="_blank">
|
|
|
<i class="fab fa-pinterest" title="pinterest"></i>
|
|
|
<span class="screen-reader-text">pinterest</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="https://h.cowbay.org/index.xml" data-animate-hover="pulse" class="rss" target="_blank">
|
|
|
<i class="fas fa-rss" title="rss"></i>
|
|
|
<span class="screen-reader-text">rss</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
</ul> <div class="design-credit">
|
|
|
|
|
|
<p>© 2018 Göran Svensson</p>
|
|
|
|
|
|
<p>Nederburg Hugo Theme by <a href="https://appernetic.io">Appernetic</a>.</p>
|
|
|
|
|
|
<p>A port of Tracks by Compete Themes.</p>
|
|
|
|
|
|
</div>
|
|
|
</footer>
|
|
|
|
|
|
</div>
|
|
|
<script src="https://h.cowbay.org/js/jquery.min.js"></script>
|
|
|
<script src="https://h.cowbay.org/js/jquerymigrate.js"></script>
|
|
|
<script src="https://h.cowbay.org/js/production.min.js?v=1634607506"></script>
|
|
|
|
|
|
</body>
|
|
|
</html>
|
