From 6ff9570ca05a90fcee2d179f82339143581a8e77 Mon Sep 17 00:00:00 2001 From: Guofang Date: Fri, 23 Oct 2026 15:11:45 +0800 Subject: [PATCH] Add example WireGuard server and client configs Co-Authored-By: Claude Sonnet 5.5 --- wireguard/README.md | 30 ++++++++++++++++++++++++++++++ wireguard/client.conf | 11 +++++++++++ wireguard/server.conf | 11 +++++++++++ 3 files changed, 52 insertions(+) create mode 100644 wireguard/README.md create mode 100644 wireguard/client.conf create mode 100644 wireguard/server.conf diff --git a/wireguard/README.md b/wireguard/README.md new file mode 100644 index 0000000..727a945 --- /dev/null +++ b/wireguard/README.md @@ -0,0 +1,30 @@ +# WireGuard example configs + +Example server and client configs for a point-to-point WireGuard tunnel. The keys are samples only; do not use them in production. + +| File | Role | Tunnel address | +| --- | --- | --- | +| `server.conf` | Server, listens on UDP 51820 | `192.168.200.1/24` | +| `client.conf` | Client, routes all traffic (`0.0.0.0/0`) through the server | `192.168.200.2/24` | + +## Usage + +1. Replace the keys with your own (`wg genkey | tee private.key | wg pubkey`), and set the client's `Endpoint` to the server's address. +2. On the server, bring up the interface and register the client as a peer: + + ```sh + wg-quick up wg0 + sudo wg set wg0 peer allowed-ips 192.168.200.2/32 + sudo systemctl enable wg-quick@wg0.service + ``` + +3. To let the client reach the outside through the server, enable forwarding and NAT: + + ```sh + sudo sysctl net.ipv4.ip_forward=1 + sudo nft add table ip nat + sudo nft -- add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; } + sudo nft add rule ip nat POSTROUTING ip saddr 192.168.200.0/24 masquerade + ``` + +4. On the client: `wg-quick up client` (the file name is the interface name). diff --git a/wireguard/client.conf b/wireguard/client.conf new file mode 100644 index 0000000..38b25bd --- /dev/null +++ b/wireguard/client.conf @@ -0,0 +1,11 @@ +[Interface] +PrivateKey = wMy0gixHHH1D8HOI9CaUXMLJTCW9+34sVGuocWDz328= +Address = 192.168.200.2/24 + +[Peer] +PublicKey = UNZuRQxGmTSe7LkRJKfBlA/02RxPaNgl4qu/+ePYqwo= +Endpoint = 10.15.108.21:51820 +AllowedIPs = 0.0.0.0/0 +PersistentKeepalive = 25 + +# wg-quick up wg0 diff --git a/wireguard/server.conf b/wireguard/server.conf new file mode 100644 index 0000000..2389a3e --- /dev/null +++ b/wireguard/server.conf @@ -0,0 +1,11 @@ +[Interface] +PrivateKey = sFQmh6nRt3MrZc0v4KHNMH16ngj4ndgmdGKlXZ5uG3k= +Address = 192.168.200.1/24 +ListenPort = 51820 + +# sudo wg set wg0 peer MvdYtQy6ran5wrKt4OMUiDqYQERg9/JaLZ89LsFTGg8= allowed-ips 192.168.200.2/32 +# sudo systemctl enable wg-quick@wg0.service +# sudo nft add table ip nat +# sudo nft -- add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; } +# sudo nft add rule ip nat POSTROUTING ip saddr 192.168.200.0/24 masquerade +# sudo sysctl net.ipv4.ip_forward=1