OpenVPN / WireGuard VPN

sudo apt update
sudo apt install wireguard -y
 
# 验证内核模块
sudo modprobe wireguard
lsmod | grep wireguard

# /etc/wireguard 仅 root 可写，以下命令需要 root 权限
# 建议先执行 sudo -i 切换到 root，或为每条命令加 sudo
 
# 生成服务端密钥对
wg genkey | sudo tee /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key
sudo chmod 600 /etc/wireguard/server_private.key
 
# 生成客户端密钥对
wg genkey | sudo tee /etc/wireguard/client1_private.key | wg pubkey | sudo tee /etc/wireguard/client1_public.key
 
# 获取密钥内容
SERVER_PRIVKEY=$(sudo cat /etc/wireguard/server_private.key)
SERVER_PUBKEY=$(sudo cat /etc/wireguard/server_public.key)
CLIENT1_PRIVKEY=$(sudo cat /etc/wireguard/client1_private.key)
CLIENT1_PUBKEY=$(sudo cat /etc/wireguard/client1_public.key)

# 创建服务端配置
sudo tee /etc/wireguard/wg0.conf << EOF
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = ${SERVER_PRIVKEY}
 
# 启用 IP 转发和 NAT（用于客户端上网）
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
 
# 客户端 1
[Peer]
PublicKey = ${CLIENT1_PUBKEY}
AllowedIPs = 10.0.0.2/32
EOF
 
sudo chmod 600 /etc/wireguard/wg0.conf

# 启用 IP 转发
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.d/99-wireguard.conf
sudo sysctl -p /etc/sysctl.d/99-wireguard.conf
 
# 启动 WireGuard
sudo systemctl enable --now wg-quick@wg0
 
# 查看状态
sudo wg show
 
# 防火墙
sudo ufw allow 51820/udp

# 客户端配置文件
sudo tee /etc/wireguard/client1.conf << EOF
[Interface]
Address = 10.0.0.2/24
PrivateKey = ${CLIENT1_PRIVKEY}
DNS = 223.5.5.5, 8.8.8.8
 
[Peer]
PublicKey = ${SERVER_PUBKEY}
Endpoint = your-server-ip:51820
AllowedIPs = 0.0.0.0/0        # 全部流量走 VPN
# AllowedIPs = 10.0.0.0/24    # 仅 VPN 网段走 VPN（分流）
PersistentKeepalive = 25
EOF
 
# 启动连接（接口名取配置文件名 client1）
sudo wg-quick up client1
 
# 断开连接
sudo wg-quick down client1

# 在服务端生成新客户端密钥
wg genkey | tee /etc/wireguard/client2_private.key | wg pubkey > /etc/wireguard/client2_public.key
CLIENT2_PUBKEY=$(cat /etc/wireguard/client2_public.key)
 
# 热添加 Peer（无需重启服务）
sudo wg set wg0 peer ${CLIENT2_PUBKEY} allowed-ips 10.0.0.3/32
 
# 或编辑配置文件后重新加载
sudo systemctl restart wg-quick@wg0

sudo apt install qrencode -y
 
# 生成配置二维码
sudo qrencode -t ansiutf8 < /etc/wireguard/client1.conf

sudo apt update
sudo apt install openvpn easy-rsa -y

# 初始化 Easy-RSA
mkdir -p ~/easy-rsa
ln -s /usr/share/easy-rsa/* ~/easy-rsa/
cd ~/easy-rsa
 
# 配置变量
tee vars << 'EOF'
set_var EASYRSA_ALGO ec
set_var EASYRSA_DIGEST sha512
set_var EASYRSA_CURVE secp384r1
set_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE "Beijing"
set_var EASYRSA_REQ_CITY "Beijing"
set_var EASYRSA_REQ_ORG "MyOrg"
set_var EASYRSA_REQ_EMAIL "admin@example.com"
set_var EASYRSA_CA_EXPIRE 3650
set_var EASYRSA_CERT_EXPIRE 365
EOF
 
# 初始化 PKI
./easyrsa init-pki
 
# 创建 CA（证书颁发机构）
./easyrsa build-ca nopass
 
# 生成服务器证书
./easyrsa gen-req server nopass
./easyrsa sign-req server server
 
# 生成客户端证书
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1
 
# 生成 TLS 认证密钥
openvpn --genkey secret /etc/openvpn/ta.key
 
# 生成 DH 参数（使用 EC 时可跳过）
# ./easyrsa gen-dh

sudo cp ~/easy-rsa/pki/ca.crt /etc/openvpn/server/
sudo cp ~/easy-rsa/pki/issued/server.crt /etc/openvpn/server/
sudo cp ~/easy-rsa/pki/private/server.key /etc/openvpn/server/
sudo cp ~/easy-rsa/ta.key /etc/openvpn/server/ 2>/dev/null || sudo cp /etc/openvpn/ta.key /etc/openvpn/server/

sudo tee /etc/openvpn/server/server.conf << 'EOF'
# 监听端口和协议
port 1194
proto udp
dev tun
 
# 证书文件
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
tls-auth /etc/openvpn/server/ta.key 0
 
# 加密设置
cipher AES-256-GCM
auth SHA256
tls-version-min 1.2
 
# 网络设置
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
 
# 推送路由和 DNS
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 223.5.5.5"
push "dhcp-option DNS 8.8.8.8"
 
# 允许客户端之间通信
client-to-client
 
# 保持连接
keepalive 10 120
 
# 安全
user nobody
group nogroup
persist-key
persist-tun
 
# 日志
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
mute 20
 
# 最大客户端数
max-clients 50
EOF

# 创建日志目录
sudo mkdir -p /var/log/openvpn
 
# 启用 IP 转发
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.d/99-openvpn.conf
sudo sysctl -p /etc/sysctl.d/99-openvpn.conf
 
# 配置 NAT
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
 
# 持久化 iptables 规则
sudo apt install iptables-persistent -y
sudo netfilter-persistent save
 
# 启动 OpenVPN
sudo systemctl enable --now openvpn-server@server
 
# 防火墙
sudo ufw allow 1194/udp

# 创建客户端 .ovpn 配置文件
cat << 'EOF' > ~/client1.ovpn
client
dev tun
proto udp
remote your-server-ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
key-direction 1
verb 3
EOF
 
# 嵌入证书（生成单文件配置）
echo "<ca>" >> ~/client1.ovpn
cat ~/easy-rsa/pki/ca.crt >> ~/client1.ovpn
echo "</ca>" >> ~/client1.ovpn
 
echo "<cert>" >> ~/client1.ovpn
cat ~/easy-rsa/pki/issued/client1.crt >> ~/client1.ovpn
echo "</cert>" >> ~/client1.ovpn
 
echo "<key>" >> ~/client1.ovpn
cat ~/easy-rsa/pki/private/client1.key >> ~/client1.ovpn
echo "</key>" >> ~/client1.ovpn
 
echo "<tls-auth>" >> ~/client1.ovpn
cat /etc/openvpn/server/ta.key >> ~/client1.ovpn
echo "</tls-auth>" >> ~/client1.ovpn

# WireGuard 状态
sudo wg show
sudo wg show wg0 latest-handshakes
sudo wg show wg0 transfer
 
# OpenVPN 状态
sudo cat /var/log/openvpn/openvpn-status.log
sudo journalctl -u openvpn-server@server -f
 
# 查看连接的客户端
# WireGuard
sudo wg show wg0 peers
# OpenVPN
sudo cat /var/log/openvpn/openvpn-status.log | grep "CLIENT_LIST"

# 检查 IP 转发
sysctl net.ipv4.ip_forward
 
# 检查 NAT 规则
sudo iptables -t nat -L -n -v
 
# 检查端口监听
ss -ulnp | grep -E "(51820|1194)"
 
# 测试连通性
ping 10.0.0.1    # WireGuard 服务端
ping 10.8.0.1    # OpenVPN 服务端
 
# WireGuard 调试
sudo wg show wg0
# 如果没有握手时间，检查防火墙和端口
 
# OpenVPN 调试
sudo tail -f /var/log/openvpn/openvpn.log
 
# 客户端连接测试
curl ifconfig.me  # 查看出口 IP 是否为 VPN 服务器