树莓派安装 WireGuard 备忘

2020-03-09 tech linux raspberry-pi wireguard 2 mins 942 字

安装内核头文件

$ sudo apt install raspberrypi-kernel-headers

安装依赖库和编译所需工具

$ sudo apt install libmnl-dev build-essential git

编译安装 WireGuard

$ git clone https://git.zx2c4.com/WireGuard
$ cd WireGuard/
$ cd src/
$ make
$ sudo make install

启动

 # 从服务端获取配置和密钥公钥到/etc/wireguard
 wg-quick up wg0

开机启动

systemctl enable wg-quick@wg0

iptables转发备忘

# 查看nat转发表
iptables -nvL -t nat --line-numbers |more

# 本机： 10.101.7.1:40001(10.250.101.7:40001)
# 转发至10.250.0.1:22
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 40001 -j DNAT --to-destination 10.250.0.1:22
iptables -t nat -A POSTROUTING -d 10.250.0.1 -p tcp -m tcp --dport 22 -j SNAT --to-source 10.101.7.1

# 或者
iptables -t nat -A PREROUTING -p tcp -i flannel.100 --dport 40001 -j DNAT --to 10.250.0.1:22
iptables -t nat -A POSTROUTING -j MASQUERADE

参考资料

https://it.ismy.fun/2018/10/06/wireguard-rpi3/
https://blog.csdn.net/zzhongcy/article/details/42738285
http://xstarcd.github.io/wiki/Linux/iptables_forward_internetshare.html