Ubuntu22.04でWireGuardを設定する方法

WireGuardピアの設定は、WireGuardサーバーの設定に似ています。クライアントソフトウェアをインストールしたら、公開鍵と秘密鍵のペアを生成し、ピアの1つまたは複数のIPアドレスを決定し、ピアの構成ファイルを定義してから、wg-quick スクリプト。

次の手順を使用してキーペアと構成を生成することにより、VPNに必要な数のピアを追加できます。 VPNに複数のピアを追加する場合は、衝突を防ぐために、必ずプライベートIPアドレスを追跡してください。

WireGuard Peerを構成するには、次のaptを使用してWireGuardパッケージがインストールされていることを確認してください コマンド。 WireGuardピアの実行：

sudo apt update
sudo apt install wireguard

WireGuardピアのキーペアの作成

次に、サーバーで使用したのと同じ手順を使用して、ピアでキーペアを生成する必要があります。ピアとして機能するローカルマシンまたはリモートサーバーから、次のコマンドを使用して続行し、ピアの秘密鍵を作成します。

wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod go= /etc/wireguard/private.key

ここでも、1行のbase64を受け取ります 秘密鍵であるエンコードされた出力。出力のコピーも/etc/wireguard/private.keyに保存されます 。このセクションの後半でWireGuardの構成ファイルに追加する必要があるため、出力される秘密鍵を注意深くメモしてください。

次に、次のコマンドを使用して公開鍵ファイルを作成します。

sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

再びbase64の1行が届きます エンコードされた出力。これは、WireGuardPeerの公開鍵です。暗号化された接続を確立するには、公開鍵をWireGuardサーバーに配布する必要があるため、参照用にどこかにコピーしてください。

WireGuardピアの構成ファイルの作成

キーペアができたので、WireGuardサーバーへの接続を確立するために必要なすべての情報を含むピアの構成ファイルを作成できます。

構成ファイルにはいくつかの情報が必要です。

• base64 ピアで生成したエンコードされた秘密鍵。

• WireGuardサーバーで定義したIPv4およびIPv6アドレス範囲。

• base64 WireGuardサーバーからのエンコードされた公開鍵。

• WireGuardサーバーのパブリックIPアドレスとポート番号。通常、これはIPv4アドレスになりますが、サーバーにIPv6アドレスがあり、クライアントマシンにインターネットへのIPv6接続がある場合は、IPv4の代わりにこれを使用できます。

このすべての情報が手元にある状態で、新しい/etc/wireguard/wg0.confを開きます nanoを使用してWireGuardPeerマシン上のファイル またはお好みのエディター：

sudo nano /etc/wireguard/wg0.conf

次の行をファイルに追加し、必要に応じて強調表示されたセクションにさまざまなデータを代入します。

/etc/wireguard/wg0.conf[Interface]
PrivateKey = base64_encoded_peer_private_key_goes_here
Address = 10.8.0.2/24
Address = fd24:609a:6c18::2/64

[Peer]
PublicKey = U9uE2kb/nrrzsEU58GD3pKFU3TLYDMCbetIsnV8eeFE=
AllowedIPs = 10.8.0.0/24, fd24:609a:6c18::/64
Endpoint = 203.0.113.1:51820

最初のAddress 行は10.8.0.0/24のIPv4アドレスを使用します 以前に選択したサブネット。このIPアドレスは、サーバーのIPと異なる限り、サブネット内の任意のアドレスにすることができます。ピアを追加するたびにアドレスを1ずつ増やすのが、一般的にIPを割り当てる最も簡単な方法です。

同様に、2番目のAddress lineは、前に生成したサブネットのIPv6アドレスを使用し、サーバーのアドレスを1つ増やします。繰り返しになりますが、別のアドレスを使用する場合は、範囲内のすべてのIPが有効です。

ファイルの他の注目すべき部分は、最後のAllowedIPsです。 ライン。 These two IPv4 and IPv6 ranges instruct the peer to only send traffic over the VPN if the destination system has an IP address in either range. Using the AllowedIPs directive, you can restrict the VPN on the peer to only connect to other peers and services on the VPN, or you can configure the setting to tunnel all traffic over the VPN and use the WireGuard Server as a gateway.

If you are only using IPv4, then omit the trailing fd24:609a:6c18::/64 range (including the , comma). Conversely, if you are only using IPv6, then only include the fd24:609a:6c18::/64 prefix and leave out the 10.8.0.0/24 IPv4 range.

In both cases, if you would like to send all your peer’s traffic over the VPN and use the WireGuard Server as a gateway for all traffic, then you can use 0.0.0.0/0 , which represents the entire IPv4 address space, and ::/0 for the entire IPv6 address space.

(Optional) Configuring a Peer to Route All Traffic Over the Tunnel

If you have opted to route all of the peer’s traffic over the tunnel using the 0.0.0.0/0 or ::/0 routes and the peer is a remote system, then you will need to complete the steps in this section. If your peer is a local system then it is best to skip this section.

For remote peers that you access via SSH or some other protocol using a public IP address, you will need to add some extra rules to the peer’s wg0.conf ファイル。 These rules will ensure that you can still connect to the system from outside of the tunnel when it is connected. Otherwise, when the tunnel is established, all traffic that would normally be handled on the public network interface will not be routed correctly to bypass the wg0 tunnel interface, leading to an inaccessible remote system.

First, you’ll need to determine the IP address that the system uses as its default gateway. Run the following ip route コマンド：

ip route list table main default

次のような出力が表示されます：

Outputdefault via 203.0.113.1 dev eth0 proto static

Note the gateway’s highlighted IP address 203.0.113.1 for later use, and device eth0 。 Your device name may be different. If so, substitute it in place of eth0 in the following commands.

Next find the public IP for the system by examining the device with the ip address show コマンド：

ip -brief address show eth0

次のような出力が表示されます：

Outputeth0             UP             203.0.113.5/20 10.20.30.40/16 2604:a880:400:d1::3d3:6001/64 fe80::68d5:beff:feff:974c/64

In this example output, the highlighted 203.0.113.5 IP (without the trailing /20 ) is the public address that is assigned to the eth0 device that you’ll need to add to the WireGuard configuration.

Now open the WireGuard Peer’s /etc/wireguard/wg0.conf nanoのファイル or your preferred editor.

sudo nano /etc/wireguard/wg0.conf

Before the [Peer] line, add the following 4 lines:

PostUp = ip rule add table 200 from 203.0.113.5
PostUp = ip route add table 200 default via 203.0.113.1
PreDown = ip rule delete table 200 from 203.0.113.5
PreDown = ip route delete table 200 default via 203.0.113.1

[Peer]
. . .

These lines will create a custom routing rule, and add a custom route to ensure that public traffic to the system uses the default gateway.

• PostUp = ip rule add table 200 from 203.0.113.5 - This command creates a rule that checks for any routing entries in the table numbered 200 when the IP matches the system’s public 203.0.113.5 address.
• PostUp = ip route add table 200 default via 203.0.113.1 - This command ensures that any traffic being processed by the 200 table will use the 203.0.113.1 gateway for routing, instead of the WireGuard interface.

The PreDown lines remove the custom rule and route when the tunnel is shutdown.

Note:The table number 200 is arbitrary when constructing these rules. You can use a value between 2 and 252, or you can use a custom name by adding a label to the /etc/iproute2/rt_tables file and then referring to the name instead of the numeric value.

For more information about how routing tables work in Linux visit the Routing Tables Section of the Guide to IP Layer Network Administration with Linux.

If you are routing all the peer’s traffic over the VPN, ensure that you have configured the correct sysctl and iptables rules on the WireGuard Server in Step 4 — Adjusting the WireGuard Server’s Network Configuration and Step 5 — Configuring the WireGuard Server’s Firewall.

(Optional) Configuring the WireGuard Peer’s DNS Resolvers

If you are using the WireGuard Server as a VPN gateway for all your peer’s traffic, you will need to add a line to the [Interface] section that specifies DNS resolvers. If you do not add this setting, then your DNS requests may not be secured by the VPN, or they might be revealed to your Internet Service Provider or other third parties.

If you are only using WireGuard to access resources on the VPN network or in a peer-to-peer configuration then you can skip this section.

To add DNS resolvers to your peer’s configuration, first determine which DNS servers your WireGuard Server is using. Run the following command on the WireGuard Server , substituting in your ethernet device name in place of eth0 if it is different from this example:

resolvectl dns eth0

You should receive output like the following:

OutputLink 2 (eth0): 67.207.67.2 67.207.67.3 2001:4860:4860::8844 2001:4860:4860::8888

The IP addresses that are output are the DNS resolvers that the server is using. You can choose to use any or all of them, or only IPv4 or IPv6 depending on your needs. Make a note of the resolvers that you will use.

Next you will need to add your chosen resolvers to the WireGuard Peer’s configuration file. Back on the WireGuard Peer , open /etc/wireguard/wg0.conf file using nano or your preferred editor:

sudo nano /etc/wireguard/wg0.conf

Before the [Peer] line, add the following:

DNS = 67.207.67.2 2001:4860:4860::8844

[Peer]
. . .

Again, depending on your preference or requirements for IPv4 and IPv6, you can edit the list according to your needs.

Once you are connected to the VPN in the following step, you can check that you are sending DNS queries over the VPN by using a site like DNS leak test.com.

You can also check that your peer is using the configured resolvers with the resolvectl dns command like you ran on the server. You should receive output like the following, showing the DNS resolvers that you configured for the VPN tunnel:

OutputGlobal: 67.207.67.2 67.207.67.3
. . .

With all of these DNS resolver settings in place, you are now ready to add the peer’s public key to the server, and then start the WireGuard tunnel on the peer.

Step 8 — Adding the Peer’s Public Key to the WireGuard Server

Before connecting the peer to the server, it is important to add the peer’s public key to the WireGuard Server. This step ensures that you will be able to connect to and route traffic over the VPN. Without completing this step the WireGuard server will not allow the peer to send or receive any traffic over the tunnel.

Ensure that you have a copy of the base64 encoded public key for the WireGuard Peer by running:

sudo cat /etc/wireguard/public.key

OutputPeURxj4Q75RaVhBKkRTpNsBPiPSGb5oQijgJsTa29hg=

Now log into the WireGuard server, and run the following command:

sudo wg set wg0 peer PeURxj4Q75RaVhBKkRTpNsBPiPSGb5oQijgJsTa29hg= allowed-ips 10.8.0.2,fd24:609a:6c18::2

Note that the allowed-ips portion of the command takes a comma separated list of IPv4 and IPv6 addresses. You can specify individual IPs if you would like to restrict the IP address that a peer can assign itself, or a range like in the example if your peers can use any IP address in the VPN range. Also note that no two peers can have the same allowed-ips setting.

If you would like to update the allowed-ips for an existing peer, you can run the same command again, but change the IP addresses. Multiple IP addresses are supported. For example, to change the WireGuard Peer that you just added to add an IP like 10.8.0.100 to the existing 10.8.0.2 and fd24:609a:6c18::2 IPs, you would run the following:

sudo wg set wg0 peer PeURxj4Q75RaVhBKkRTpNsBPiPSGb5oQijgJsTa29hg= allowed-ips 10.8.0.2,10.8.0.100,fd24:609a:6c18::2

Once you have run the command to add the peer, check the status of the tunnel on the server using the wg コマンド：

sudo wg

Outputinterface: wg0
 public key: U9uE2kb/nrrzsEU58GD3pKFU3TLYDMCbetIsnV8eeFE=
 private key: (hidden)
 listening port: 51820

peer: PeURxj4Q75RaVhBKkRTpNsBPiPSGb5oQijgJsTa29hg=
 allowed ips: 10.8.0.2/32, fd24:609a:6c18::/128

Notice how the peer line shows the WireGuard Peer’s public key, and the IP addresses, or ranges of addresses that it is allowed to use to assign itself an IP.

Now that you have defined the peer’s connection parameters on the server, the next step is to start the tunnel on the peer.

Step 9 — Connecting the WireGuard Peer to the Tunnel

Now that your server and peer are both configured to support your choice of IPv4, IPv6, packet forwarding, and DNS resolution, it is time to connect the peer to the VPN tunnel.

Since you may only want the VPN to be on for certain use cases, we’ll use the wg-quick command to establish the connection manually. If you would like to automate starting the tunnel like you did on the server, follow those steps in Step 6 — Starting the WireGuard Server section instead of using the wq-quick コマンド。

In case you are routing all traffic through the VPN and have set up DNS forwarding, you’ll need to install the resolvconf utility on the WireGuard Peer before you start the tunnel. Run the following command to set this up:

sudo apt install resolvconf

To start the tunnel, run the following on the WireGuard Peer:

sudo wg-quick up wg0

次のような出力が表示されます：

Output[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.2/24 dev wg0
[#] ip -6 address add fd24:609a:6c18::2/64 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a tun.wg0 -m 0 -x

Notice the highlighted IPv4 and IPv6 addresses that you assigned to the peer.

If you set the AllowedIPs on the peer to 0.0.0.0/0 and ::/0 (or to use ranges other than the ones that you chose for the VPN), then your output will resemble the following:

Output[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.2/24 dev wg0
[#] ip -6 address add fd24:609a:6c18::2/64 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a tun.wg0 -m 0 -x
[#] wg set wg0 fwmark 51820
[#] ip -6 route add ::/0 dev wg0 table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip6tables-restore -n
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
[#] iptables-restore -n

In this example, notice the highlighted routes that the command added, which correspond to the AllowedIPs in the peer configuration.

You can check the status of the tunnel on the peer using the wg コマンド：

sudo wg

Outputinterface: wg0
 public key: PeURxj4Q75RaVhBKkRTpNsBPiPSGb5oQijgJsTa29hg=
 private key: (hidden)
 listening port: 49338
 fwmark: 0xca6c

peer: U9uE2kb/nrrzsEU58GD3pKFU3TLYDMCbetIsnV8eeFE=
 endpoint: 203.0.113.1:51820
 allowed ips: 10.8.0.0/24, fd24:609a:6c18::/64
 latest handshake: 1 second ago
 transfer: 6.50 KiB received, 15.41 KiB sent

You can also check the status on the server again, and you will receive similar output.

Verify that your peer is using the VPN by using the ip route and ip -6 route コマンド。 If you are using the VPN as a gateway for all your Internet traffic, check which interface will be used for traffic destined to CloudFlare’s 1.1.1.1 and 2606:4700:4700::1111 DNS resolvers.

If you are only using WireGuard to access resources on the VPN, substitute a valid IPv4 or IPv6 address like the gateway itself into these commands. For example 10.8.0.1 or fd24:609a:6c18::1 。

ip route get 1.1.1.1

Output1.1.1.1 dev wg0 table 51820 src 10.8.0.2 uid 1000
   cache

Notice the wg0 device is used and the IPv4 address 10.8.0.2 that you assigned to the peer. Likewise, if you are using IPv6, run the following:

ip -6 route get 2606:4700:4700::1111

Output2606:4700:4700::1111 from :: dev wg0 table 51820 src fd24:609a:6c18::2 metric 1024 pref medium

Again note the wg0 interface, and the IPv6 address fd24:609a:6c18::2 that you assigned to the peer.

If your peer has a browser installed, you can also visit ipleak.net and ipv6-test.com to confirm that your peer is routing its traffic over the VPN.

Once you are ready to disconnect from the VPN on the peer, use the wg-quick コマンド：

sudo wg-quick down wg0

You will receive output like the following indicating that the VPN tunnel is shut down:

Output[#] ip link delete dev wg0
[#] resolvconf -d tun.wg0 -f

If you set the AllowedIPs on the peer to 0.0.0.0/0 and ::/0 (or to use ranges other than the ones that you chose for the VPN), then your output will resemble the following:

Output[#] ip rule delete table 200 from 203.0.113.5
[#] ip route delete table 200 default via 203.0.113.1
[#] ip -4 rule delete table 51820
[#] ip -4 rule delete table main suppress_prefixlength 0
[#] ip -6 rule delete table 51820
[#] ip -6 rule delete table main suppress_prefixlength 0
[#] ip link delete dev wg0
[#] resolvconf -d tun.wg0 -f
[#] iptables-restore -n
[#] ip6tables-restore -n

To reconnect to the VPN, run the wg-quick up wg0 command again on the peer. If you would like to completely remove a peer’s configuration from the WireGuard Server, you can run the following command, being sure to substitute the correct public key for the peer that you want to remove:

sudo wg set wg0 peer PeURxj4Q75RaVhBKkRTpNsBPiPSGb5oQijgJsTa29hg= remove

Typically you will only need to remove a peer configuration if the peer no longer exists, or if its encryption keys are compromised or changed. Otherwise it is better to leave the configuration in place so that the peer can reconnect to the VPN without requiring that you add its key and allowed-ips each time.