64 lines
1.8 KiB
Bash
64 lines
1.8 KiB
Bash
#!/usr/bin/env sh
|
|
set -e
|
|
set -u
|
|
# Set the listen port used by Wireguard, this is the default so feel free to change it.
|
|
LISTENPORT=51820
|
|
CONFIG_DIR=/root/wireguard-conf
|
|
umask 077
|
|
mkdir -p $CONFIG_DIR/client
|
|
|
|
# Install wireguard
|
|
apt update && apt install -y wireguard
|
|
|
|
# Generate public/private key for the "server".
|
|
wg genkey > $CONFIG_DIR/privatekey
|
|
wg pubkey < $CONFIG_DIR/privatekey > $CONFIG_DIR/publickey
|
|
|
|
# Generate public/private key for the "client"
|
|
wg genkey > $CONFIG_DIR/client/privatekey
|
|
wg pubkey < $CONFIG_DIR/client/privatekey > $CONFIG_DIR/client/publickey
|
|
|
|
|
|
# Generate server config
|
|
echo "[Interface]
|
|
Address = 10.66.66.1/24,fd42:42:42::1/64
|
|
ListenPort = $LISTENPORT
|
|
PrivateKey = $(cat $CONFIG_DIR/privatekey)
|
|
|
|
### Client config
|
|
[Peer]
|
|
PublicKey = $(cat $CONFIG_DIR/client/publickey)
|
|
AllowedIPs = 10.66.66.2/32,fd42:42:42::2/128
|
|
" > /etc/wireguard/do.conf
|
|
|
|
|
|
# Generate client config. This will need to be copied to your machine.
|
|
echo "[Interface]
|
|
PrivateKey = $(cat $CONFIG_DIR/client/privatekey)
|
|
Address = 10.66.66.2/32,fd42:42:42::2/128
|
|
DNS = 1.1.1.1,1.0.0.1
|
|
|
|
[Peer]
|
|
PublicKey = $(cat $CONFIG_DIR/publickey)
|
|
Endpoint = $(curl icanhazip.com):$LISTENPORT
|
|
AllowedIPs = 0.0.0.0/0,::/0
|
|
" > $CONFIG_DIR/client-config.conf
|
|
|
|
wg-quick up do
|
|
|
|
# Add iptables rules to forward internet traffic through this box
|
|
# We are assuming our Wireguard interface is called do and our
|
|
# primary public facing interface is called eth0.
|
|
|
|
iptables -I INPUT -p udp --dport 51820 -j ACCEPT
|
|
iptables -I FORWARD -i eth0 -o do -j ACCEPT
|
|
iptables -I FORWARD -i do -j ACCEPT
|
|
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
|
ip6tables -I FORWARD -i do -j ACCEPT
|
|
ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
|
|
|
# Enable routing on the server
|
|
echo "net.ipv4.ip_forward = 1
|
|
net.ipv6.conf.all.forwarding = 1" >/etc/sysctl.d/wg.conf
|
|
sysctl --system
|