31 lines
1.2 KiB
Markdown
31 lines
1.2 KiB
Markdown
# WireGuard example configs
|
|
|
|
Example server and client configs for a point-to-point WireGuard tunnel. The keys are samples only; do not use them in production.
|
|
|
|
| File | Role | Tunnel address |
|
|
| --- | --- | --- |
|
|
| `server.conf` | Server, listens on UDP 51820 | `192.168.200.1/24` |
|
|
| `client.conf` | Client, routes all traffic (`0.0.0.0/0`) through the server | `192.168.200.2/24` |
|
|
|
|
## Usage
|
|
|
|
1. Replace the keys with your own (`wg genkey | tee private.key | wg pubkey`), and set the client's `Endpoint` to the server's address.
|
|
2. On the server, bring up the interface and register the client as a peer:
|
|
|
|
```sh
|
|
wg-quick up wg0
|
|
sudo wg set wg0 peer <client-public-key> allowed-ips 192.168.200.2/32
|
|
sudo systemctl enable wg-quick@wg0.service
|
|
```
|
|
|
|
3. To let the client reach the outside through the server, enable forwarding and NAT:
|
|
|
|
```sh
|
|
sudo sysctl net.ipv4.ip_forward=1
|
|
sudo nft add table ip nat
|
|
sudo nft -- add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; }
|
|
sudo nft add rule ip nat POSTROUTING ip saddr 192.168.200.0/24 masquerade
|
|
```
|
|
|
|
4. On the client: `wg-quick up client` (the file name is the interface name).
|