53 lines
1.4 KiB
Bash
53 lines
1.4 KiB
Bash
#/bin/bash
|
|
# install wireguard as the VPN server
|
|
|
|
# install wireguard
|
|
sudo curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
|
|
sudo yum install epel-release
|
|
sudo yum install wireguard-dkms wireguard-tools
|
|
|
|
cat << EOF >> /etc/firewalld/services/wireguard.xml
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<service>
|
|
<short>wireguard</short>
|
|
<description>wireguard vpn</description>
|
|
<port protocol="udp" port="51820"/>
|
|
</service>
|
|
EOF
|
|
|
|
sleep 5
|
|
|
|
sudo firewall-cmd --add-service wireguard --permanent
|
|
sudo firewall-cmd --add-masquerade --permanent
|
|
sudo firewall-cmd --reload
|
|
|
|
sudo mkdir /etc/wireguard
|
|
# make private and public keys
|
|
wg genkey | tee /etc/wireguard/<hostname>.wg0.key | wg pubkey > /etc/wireguard/<hostname>.wg0.pub
|
|
|
|
# example of wg0.conf file
|
|
: '
|
|
[Interface]
|
|
Address = 10.12.0.1/29
|
|
PrivateKey = <Private Key>
|
|
ListenPort = 51820
|
|
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o <INTERFACE> -j MASQUERADE
|
|
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o <INTERFACE> -j MASQUERADE
|
|
|
|
# iPhone
|
|
[Peer]
|
|
PublicKey = <Public Key>
|
|
AllowedIPs = 10.12.0.2/32
|
|
|
|
# GauntLaptop
|
|
[Peer]
|
|
PublicKey = <Public Key>
|
|
AllowedIPs = 10.12.0.3/32
|
|
|
|
# GauntMTA
|
|
[Peer]
|
|
PublicKey = <Public Key>
|
|
AllowedIPs = 10.12.0.4/32
|
|
|
|
'
|