WireGuard 编译安装
WireGuard是一种实现加密虚拟专用网络(VPN) 的通信协议和免费开源软件。
系统环境:Centos7.9 3.10.0-1160
1. 系统环境配置
- 关闭防火墙
systemctl stop firewalld
systemctl disable firewalld
- 关闭selinux
sed -i 's/enforcing/disabled/' /etc/selinux/config
setenforce 0
- 开启内核转发
grep 'net.ipv4.ip_forward = 1' /etc/sysctl.conf || echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p
- 配置时间同步
yum -y install chrony
vim /etc/chrony.conf
server ntp.aliyun.com iburst
server ntp1.aliyun.com iburst
allow 0.0.0.0/0
# 启动服务
systemctl start chronyd
systemctl enable chronyd
2. 源码安装
系统内核版本说明:
- Linux kernel >= 5.6,已集成WireGuard模块
- Linux kernel >= 3.10.0-1160 <= 5.5,需要安装模块
# yum安装依赖
yum install make gcc wget xz pkgconfig iptables elfutils-libelf-devel kernel-devel-$(uname -r) kernel-headers-$(uname -r)
# 下载源代码
wget https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-1.0.20220627.tar.xz
wget https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-1.0.20210914.tar.xz
# 编译安装
tar -xJf wireguard-linux-compat-1.0.20220627.tar.xz
cd wireguard-linux-compat-1.0.20220627/src
make
make install
# 禁用内核模块签名验证,GRUB_CMDLINE_LINUX添加 module.sig_enforce=0 参数
vim /etc/default/grub
GRUB_CMDLINE_LINUX="... module.sig_enforce=0"
grub2-mkconfig -o /boot/grub2/grub.cfg
# 重启系统
reboot
# 加载WireGuard模块
modprobe wireguard
lsmod|grep wireguard
# 编译wg工具
tar -xJf wireguard-tools-1.0.20210914.tar.xz
cd wireguard-tools-1.0.20210914/src
make
make install wireguard-tools
# 验证
wg --versio
3. 错误处理
# 启动服务报错
wg-quick up wg0
/usr/bin/wg-quick: line 32: resolvconf: command not found
# 修改wg-quick脚本,在364行插下如下代码
vim /usr/bin/wg-quick
# ~~ function override insertion point ~~
set_dns() {
[[ ${#DNS[@]} -gt 0 ]] || return 0
if [[ $(resolvconf --version 2>/dev/null) == openresolv\ * ]]; then
{ printf 'nameserver %s\n' "${DNS[@]}"
[[ ${#DNS_SEARCH[@]} -eq 0 ]] || printf 'search %s\n' "${DNS_SEARCH[*]}"
} | cmd resolvconf -a "$INTERFACE" -m 0 -x
else
echo "[#] mount \`${DNS[*]}' /etc/resolv.conf" >&2
[[ -e /etc/resolv.conf ]] || touch /etc/resolv.conf
{ cat <<-_EOF
# This file was generated by wg-quick(8) for use with
# the WireGuard interface $INTERFACE. It cannot be
# removed or altered directly. You may remove this file
# by running \`wg-quick down $INTERFACE', or if that
# poses problems, run \`umount /etc/resolv.conf'.
_EOF
printf 'nameserver %s\n' "${DNS[@]}"
[[ ${#DNS_SEARCH[@]} -eq 0 ]] || printf 'search %s\n' "${DNS_SEARCH[*]}"
} | unshare -m --propagation shared bash -c "$(cat <<-_EOF
set -e
context="\$(stat -c %C /etc/resolv.conf 2>/dev/null)" || unset context
mount --make-private /dev/shm
mount -t tmpfs none /dev/shm
cat > /dev/shm/resolv.conf
[[ -z \$context || \$context == "?" ]] || chcon "\$context" /dev/shm/resolv.conf 2>/dev/null || true
mount -o remount,ro /dev/shm
mount -o bind,ro /dev/shm/resolv.conf /etc/resolv.conf
_EOF
)"
fi
HAVE_SET_DNS=1
}
unset_dns() {
[[ ${#DNS[@]} -gt 0 ]] || return 0
if [[ $(resolvconf --version 2>/dev/null) == openresolv\ * ]]; then
cmd resolvconf -d "$INTERFACE"
else
cmd umount /etc/resolv.conf
fi
}