Table des matières

Wireguard - Un VPN moderne

Wireguard est un VPN moderne, léger et très compact (4000 lignes de code) qui utilise les derniers algorithmes de cryptographie

Liens

Installation sur Debian Bullseye/Bookworm

apt install -y wireguard wireguard-tools

Configuration

Machine A (server)

Génération des clés

cd /etc/wireguard
umask 077 ; wg genkey | tee private.key | wg pubkey > public.key 
cat private.key 
WIgkDciQDO38k6mb5yT7FAivxnDuqbNHx+0qLAPfA24=
cat public.key 
lbCB7J6kdQlnwPu67KDJIshqZH66fdGwq6zaUrbws1c=

Constitution du fichier wg0.conf

Editer le fichier /etc/wireguard/wg0.conf

[Interface]
Address = 10.0.2.1/24 # Adresses autorisées dans le VPN
Listenport = 51820

# clé privée de machine A 
PrivateKey = qPF9uU7qsCbw3uKR1t2Q0gfr2HasTKZGPkCHz2AszUs= 
# UDP service port; 51820 is a common choice for WireGuard
ListenPort = 51820

[Peer]
PublicKey = zpNm6Du5j8Y2SqsWOcPj67KYPxqQ1M2sv0Uvi0a9oA8= # de machine B
AllowedIPs = 10.0.2.1/24 # le peer peut acceder au serveur
systemctl start wg-quick@wg0
systemctl enable wg-quick@wg0
wg 
wginterface: wg0
  public key: cHQaOlh6/d8tvPn/7ESawn+DcbO01UeR5Z/DvRu8YiI=
  private key: (hidden)
  listening port: 51820
root@A:~# wg
interface: wg0
  public key: cHQaOlh6/d8tvPn/7ESawn+DcbO01UeR5Z/DvRu8YiI=
  private key: (hidden)
  listening port: 47580
 
peer: wclxVxrolgdsquZ3gD9Ysu71+IQt7bFfetRfBsWKYWo=
  endpoint: 192.168.1.14:39785
  allowed ips: 10.0.0.2/32
  latest handshake: 22 minutes, 21 seconds ago
  transfer: 32.11 KiB received, 34.48 KiB sent

Machine B

ip 192.168.1.14/24

cd /etc/wireguard
umask 077 ; wg genkey | tee private.key | wg pubkey > public.key 
[Interface]
PrivateKey = SHUt1BtkKjAKn12MLKorv3Mm2G45iwseZigCDe1PXno=
Address = 10.0.2.2/32
#DNS = 192.168.1.254

[Peer]
PublicKey = xKzwFyVVjeyuLS/vSb1T3PgdGDS7kkaDABX1icr3Bjo= # de machineA
#AllowedIPs = 10.0.0.0/8, 192.168.1.0/24
AllowedIPs = 0.0.0.0/0
Wireguard - Scripts de configuration
Endpoint = 192.168.1.13:51820
Wireguard - Scripts de configuration
PersistentKeepalive = 20

La commande wg permet d'afficher les paramètres de base et l'état de fonctionnement de wireguard

wg
interface: wg0
  public key: zpNm6Du5j8Y2SqsWOcPj67KYPxqQ1M2sv0Uvi0a9oA8=
  private key: (hidden)
  listening port: 57250
  fwmark: 0xca6c
 
peer: xKzwFyVVjeyuLS/vSb1T3PgdGDS7kkaDABX1icr3Bjo=
  endpoint: 192.168.1.13:51820
  allowed ips: 0.0.0.0/0
  latest handshake: 22 seconds ago
  transfer: 10.56 KiB received, 80.12 KiB sent
  persistent keepalive: every 20 seconds

Wireguard - Scripts de configuration

Remarque : wireguard n'est pas activé au démarrage. Pour l'activer :

  systemctl enable --now wg-quick@wg0
  systemctl status wg-quick@wg0

Configuration point à point

Le script génère deux fichier de configuration wg0-a.conf et wg0-b.conf à copier sur les deux machines et à renommer wg0.conf

mkwgconf-p2p.sh
#!/bin/bash
set -u
set -e
 
AddressAwg=10.0.0.1/32  # Adresse VPN Wireguard extremite A
EndpointA=192.168.1.81  # Adresse extremite A
PortA=51820             # Port ecoute extremite A
AddressBwg=10.0.0.2/32  # Adresse VPN Wireguard extremite B
EndpointB=192.168.1.82  # Adresse extremite B
PortB=51820             # Port ecoute extremite B
 
umask 077 ;  
wg genkey > endpoint-a.key
wg pubkey < endpoint-a.key > endpoint-a.pub
 
wg genkey > endpoint-b.key
wg pubkey < endpoint-b.key > endpoint-b.pub
 
PKA=$(cat endpoint-a.key)
pKA=$(cat endpoint-a.pub)
PKB=$(cat endpoint-b.key)
pKB=$(cat endpoint-b.pub)
 
cat <<FINI > wg0-a.conf
# local settings for Endpoint A
[Interface]
PrivateKey = $PKA
Address = $AddressAwg
ListenPort = $PortA
 
# remote settings for Endpoint B
[Peer]
PublicKey = $pKB
Endpoint = ${EndpointB}:$PortB
AllowedIPs = $AddressBwg
FINI
 
 
cat <<FINI > wg0-b.conf
# local settings for Endpoint B
[Interface]
PrivateKey = $PKB
Address = $AddressBwg
ListenPort = $PortB
 
# remote settings for Endpoint A
[Peer]
PublicKey = $pKA
Endpoint = ${EndpointA}:$PortA
AllowedIPs = $AddressAwg
FINI

Configuration site à site

Le script est similaire au précédent avec en plus l'adresse du réseau distant dans la clause AllowedIPs (variables NetworkA et NetworkB)

mkwgconf-s2s.sh
#!/bin/bash
set -u
set -e
# Version Site to Site 
 
AddressAwg="10.0.0.1/32"  # Adresse VPN Wireguard cote A
EndpointA="192.168.1.81"  # Adresse extremite A
PortA="51820"  # Port ecoute extremite A
NetworkA="10.0.1.0/24" # reseau cote A
 
AddressBwg="10.0.0.2/32"  # Adresse VPN Wireguard cote B
EndpointB="192.168.1.82" # Adresse extremite B
PortB="51820"  # Port ecoute extremite B
NetworkB="10.0.2.0/24" # reseau cote B
 
umask 077
wg genkey > endpoint-a.key
wg pubkey < endpoint-a.key > endpoint-a.pub
 
wg genkey > endpoint-b.key
wg pubkey < endpoint-b.key > endpoint-b.pub
 
 
PKA=$(cat endpoint-a.key)
pKA=$(cat endpoint-a.pub)
PKB=$(cat endpoint-b.key)
pKB=$(cat endpoint-b.pub)
 
cat <<FINI > wg0-a.conf
# local settings for Endpoint A
[Interface]
PrivateKey = $PKA
Address = $AddressAwg
ListenPort = $PortA
 
# IP forwarding
PreUp = sysctl -w net.ipv4.ip_forward=1
 
# remote settings for Endpoint B
[Peer]
PublicKey = $pKB
Endpoint = ${EndpointB}:$PortB
AllowedIPs = $AddressBwg, $NetworkB
 
FINI
 
 
cat <<FINI > wg0-b.conf
# local settings for Endpoint B
[Interface]
PrivateKey = $PKB
Address = $AddressBwg
ListenPort = $PortB
 
# IP forwarding
PreUp = sysctl -w net.ipv4.ip_forward=1
 
# remote settings for Endpoint A
[Peer]
PublicKey = $pKA
Endpoint = ${EndpointA}:$PortA
AllowedIPs = $AddressAwg, $NetworkA
 
FINI
 
echo "wg0-a.conf et wg0-b.conf sont generes ..."
echo "copier wg0-b.conf sur la machine b et renommer les fichiers de configuration ..."