centos7(k8s跨云网络) wireguard加密流量

虚拟机IP	wireguard IP
172.18.1.94	19.11.11.1
172.18.1.95	19.11.11.3
172.18.1.64	19.11.11.6

所有节点安装

yum install epel-release elrepo-release
yum install yum-plugin-elrepo
yum install kmod-wireguard wireguard-tools
cd /etc/wireguard/
#生成公密钥
wg genkey | tee privatekey | wg pubkey > publickey

# cat privatekey 
UPil4oDLUNLgqKATvJDZe4jYTYY8gAs/oZPG6gLBIlI=

• vim /etc/wireguard/wg0.conf 所有节点编辑以下

[Interface]
Address = 19.11.11.1/32
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp0s3 -j MASQUERADE
ListenPort = 51820
#自己的私钥
PrivateKey = UPil4oDLUNLgqKATvJDZe4jYTYY8gAs/oZPG6gLBIlI=

• 开机启动

systemctl enable wg-quick@wg0.service
systemctl start wg-quick@wg0.service

各节点相互添加

• 节点 1

# cat /etc/wireguard/wg0.conf 
[Interface]
Address = 19.11.11.1/32
DNS = 172.18.0.1
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp0s3 -j MASQUERADE
ListenPort = 51820
PrivateKey = CHQtPBl3pSwjlXgbxu6Zwg7XWQ23agWoc/bA7DCi2nY=

[Peer]
PublicKey = cQsJXdvj9N+AYhoezPiekhbJysy+cT7USTe4Sz3hs1Q=
AllowedIPs = 19.11.11.3/32
EndPoint = 172.18.1.95:51820
[Peer]
PublicKey = w9R9iSDZdDIxojn+nDfPW5Z3FdjpCTL2SErbADh++z4=
AllowedIPs = 19.11.11.6/32
EndPoint = 172.18.1.64:51820

• 节点 2

# cat wg0.conf 
[Interface]
Address = 19.11.11.3/32
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp0s3 -j MASQUERADE
ListenPort = 51820
PrivateKey = UPil4oDLUNLgqKATvJDZe4jYTYY8gAs/oZPG6gLBIlI=

[Peer]
PublicKey = +uNCw+YuLTgJLkb8onDxQfow5ta7zgz2v8oeq8FmWkc=
AllowedIPs = 19.11.11.1/32
EndPoint = 172.18.1.94:51820

[Peer]
PublicKey = w9R9iSDZdDIxojn+nDfPW5Z3FdjpCTL2SErbADh++z4=
AllowedIPs = 19.11.11.6/32
EndPoint = 172.18.1.64:51820

• 节点 3

[root@node64 ~]# cat /etc/wireguard/wg0.conf 
[Interface]
Address = 19.11.11.6/32
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp0s3 -j MASQUERADE
ListenPort = 51820
PrivateKey = IFjO8/EFgQQ1JrAp+n2VljmHSfSJyZ5xmdZl/g4uNFA=

[Peer]
PublicKey = +uNCw+YuLTgJLkb8onDxQfow5ta7zgz2v8oeq8FmWkc=
AllowedIPs = 19.11.11.1/32
EndPoint = 172.18.1.94:51820

[Peer]
PublicKey = cQsJXdvj9N+AYhoezPiekhbJysy+cT7USTe4Sz3hs1Q=
AllowedIPs = 19.11.11.3/32
EndPoint = 172.18.1.95:51820

命令命令方式

#虚拟机1
umask 077
wg genkey > privatekey
ip link add dev wg0 type wireguard
ip address add dev wg0 19.11.11.1/24 dev wg0 <<<<-----注意IP
wg set wg0 private-key ./privatekey  listen-port 50000
ip link set wg0 up 

#虚拟机2
umask 077
wg genkey > privatekey
ip link add dev wg0 type wireguard
ip address add dev wg0 19.11.11.3/24 dev wg0 <<<<-----注意IP
wg set wg0 private-key ./privatekey  listen-port 50000
ip link set wg0 up

#虚拟机3
umask 077
wg genkey > privatekey
ip link add dev wg0 type wireguard
ip address add dev wg0 19.11.11.6/24 dev wg0 <<<<-----注意IP
wg set wg0 private-key ./privatekey  listen-port 50000
ip link set wg0 up

启动后相互查看公钥各种节点加入

# wg

interface: wg0
  public key: +uNCw+YuLTgJLkb8onDxQfow5ta7zgz2v8oeq8FmWkc=
  private key: (hidden)
  listening port: 51820

wg set wg0 peer cQsJXdvj9N+AYhoezPiekhbJysy+cT7USTe4Sz3hs1Q= allowed-ips 19.11.11.3/32 endpoint 172.18.1.95:50000

wg set wg0 peer +uNCw+YuLTgJLkb8onDxQfow5ta7zgz2v8oeq8FmWkc= allowed-ips 19.11.11.1/32 endpoint 172.18.1.94:50000

wg set wg0 peer w9R9iSDZdDIxojn+nDfPW5Z3FdjpCTL2SErbADh++z4= allowed-ips 19.11.11.6/32 endpoint 172.18.1.64:50000