背景

偶尔需要用到window,我是通过wireguard局域网远程家里的window。

网络拓扑

vps server是一个华为云的2G的3M vps

deepin 10.0.0.6
window11 10.0.0.4
vps server：10.0.0.1、公网ip


[[deepin]] ----公网---> vps <----公网---[[window11]]
|                                                 |
|                                                 |
|-----------------wireguard隧道------------------->|

server端（debian)

安装

apt install wireguard`

wireguard配置

# 使用默认的路径
cd /etc/wireguard/

# 创建公私钥
wg genkey > privatekey
wg pubkey < privatekey > publickey

# 创建wg0.conf配置文件

root@hcss-ecs-78e8:/etc/wireguard# cat wg0.conf
[Interface]
PrivateKey = MGt3mONT5GCkUmnWifagggbiEAeWo=
ListenPort = 5777
Address = 10.0.0.1/24
#PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
#PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = MKP+jAcWZSFT0=
# 控制哪些ip会走这个wg，需要精确到32位
AllowedIPs = 10.0.0.2/32

 # 启动wg
 wg-quick up wg0

 # 停止wg
 wg-quick down wg0

开放对应的UDP端口

常用查询命令wg

# 查看wg状态
root@hcss-ecs-78e8:/etc/wireguard# wg
interface: wg0
  public key: zKxke9B+0C90yO5fnnrWEfxTlZ8NYs1w=
  private key: (hidden)
  listening port: 5777

peer: MKP+jAcWC4pnSLaqj9znilcT0=
  endpoint: 59.39.1.143:51820
  allowed ips: 10.0.0.2/32
  latest handshake: 1 minute, 35 seconds ago
  transfer: 91.31 KiB received, 45.15 KiB sent

os转发配置

开启ip转发，这个是不是有需要我不是很了解，照着修改了

# 查看forward配置
sysctl -a | grep forward |grep 1

# 开启必要的forward
sysctl net.ipv4.ip_forward=1
sysctl net.ipv4.conf.all.forwarding=1
sysctl net.ipv6.conf.all.forwarding=1

client端（deepin)

安装

# 查看wireguard，发现有wireguard-tools
# 对比了官网的版本wireguard-tools版本就是20210914
apple@apple-PC:~$ apt search wireguard
正在排序... 完成
全文搜索... 完成  
wireguard-tools/未知,now 1.0.20210914-1deepin1 amd64 [已安装]
  fast, modern, secure kernel VPN tunnel (userland utilities)

wireguard-tools-dbgsym/未知 1.0.20210914-1deepin1 amd64
  debug symbols for wireguard-tools

# 直接安装
apt install wireguard-tools

wireguard配置

找一个临时目录生成公、私钥

wg genkey > privatekey
wg pubkey < privatekey > publickey

新建 /etc/wireguard/wg0.conf配置

# 新建
sudo vim /etc/wireguard/wg0

写入wgclient的配置

apple@apple-PC:~$ sudo cat /etc/wireguard/wg0.conf
[Interface]
# 刚刚生成的密钥
PrivateKey = 4ccccccccccccccccccg+Lfpm1VVSWqWVM=
# client端的ip
Address = 10.0.0.6/32

[Peer]
# server的公钥
PublicKey = zKssssssssssssssssssssssssss8NYs1w=
# 控制哪些ip会走wg，一般对应的大段就行
AllowedIPs = 10.0.0.0/24
# server端的ip和端口
Endpoint = 12.21.18.171:5777
PersistentKeepalive = 15

启动验证

 # 启动wg
 wg-quick up wg0

 # 停止wg
 wg-quick down wg0

client端（win11)

使用wireguard客户端即可

[Interface]
PrivateKey = qJxQiE0yI=
ListenPort = 51820
Address = 10.0.0.32/32

[Peer]
PublicKey = zKxke9B+0C90yO5fnnrs1w=
# 控制哪些ip会走wg，一般对应的大段就行
AllowedIPs = 10.0.0.0/24
Endpoint = 124.71.108.17:5777
PersistentKeepalive = 15

deepin通过remmina直接连接windows远程桌面

见效果图