mirror of
https://github.com/omgcast/WireGuard-Guide-On_Arch_Linux.git
synced 2025-05-12 01:28:30 +02:00
Delete guide_free_vip
This commit is contained in:
n3kit91
GitHub
parent
1f4bd4da44
commit
ac139591b5
1 changed files with 0 additions and 282 deletions
282
guide_free_vip
282
guide_free_vip
|
|
@ -1,282 +0,0 @@
|
||||||
# WireGuard VPN Setup Guide for Arch Linux
|
|
||||||
|
|
||||||
This concise guide helps you set up a WireGuard VPN server on Arch Linux with two client types:
|
|
||||||
- **VIP**: Up to 100 Mbps
|
|
||||||
- **Free**: Up to 10 Mbps
|
|
||||||
|
|
||||||
You can easily switch a client between VIP and Free by modifying their configuration. Additionally, we'll address security concerns related to exposing your server's IP address.
|
|
||||||
|
|
||||||
## Table of Contents
|
|
||||||
1. [Prerequisites](#prerequisites)
|
|
||||||
2. [Installation](#installation)
|
|
||||||
3. [Server Configuration](#server-configuration)
|
|
||||||
4. [Client Management](#client-management)
|
|
||||||
- [Add a Client](#add-a-client)
|
|
||||||
- [Switch Client Type](#switch-client-type)
|
|
||||||
5. [Speed Limiting](#speed-limiting)
|
|
||||||
6. [Security Considerations](#security-considerations)
|
|
||||||
7. [Starting WireGuard](#starting-wireguard)
|
|
||||||
8. [Verification](#verification)
|
|
||||||
|
|
||||||
## Prerequisites
|
|
||||||
- **Arch Linux** installed on the server.
|
|
||||||
- **Root** or **sudo** privileges.
|
|
||||||
- **WireGuard** installed on client devices (Linux, Windows, iOS, Android).
|
|
||||||
|
|
||||||
## Installation
|
|
||||||
1. **Update System & Install Packages**
|
|
||||||
```bash
|
|
||||||
sudo pacman -Syu
|
|
||||||
sudo pacman -S wireguard-tools iproute2 nano
|
|
||||||
```
|
|
||||||
|
|
||||||
## Server Configuration
|
|
||||||
1. **Generate Server Keys**
|
|
||||||
```bash
|
|
||||||
sudo mkdir -p /etc/wireguard
|
|
||||||
cd /etc/wireguard
|
|
||||||
umask 077
|
|
||||||
wg genkey | tee server_privatekey | wg pubkey > server_publickey
|
|
||||||
```
|
|
||||||
|
|
||||||
2. **Create `wg0.conf`**
|
|
||||||
```bash
|
|
||||||
sudo nano /etc/wireguard/wg0.conf
|
|
||||||
```
|
|
||||||
```ini
|
|
||||||
[Interface]
|
|
||||||
Address = 10.0.0.1/24
|
|
||||||
ListenPort = 51820
|
|
||||||
PrivateKey = <server_privatekey>
|
|
||||||
|
|
||||||
# Enable IP forwarding and NAT
|
|
||||||
PostUp = sysctl -w net.ipv4.ip_forward=1
|
|
||||||
PostUp = iptables -t nat -A POSTROUTING -o <external_interface> -j MASQUERADE
|
|
||||||
PostUp = iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
||||||
PostUp = iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT
|
|
||||||
PostDown = sysctl -w net.ipv4.ip_forward=0
|
|
||||||
PostDown = iptables -t nat -D POSTROUTING -o <external_interface> -j MASQUERADE
|
|
||||||
PostDown = iptables -D FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
||||||
PostDown = iptables -D FORWARD -s 10.0.0.0/24 -j ACCEPT
|
|
||||||
```
|
|
||||||
- Replace `<server_privatekey>` with the content of `server_privatekey`.
|
|
||||||
- Replace `<external_interface>` with your network interface (e.g., `eth0`, `ens1`).
|
|
||||||
|
|
||||||
## Client Management
|
|
||||||
|
|
||||||
### Add a Client
|
|
||||||
Create a script to add clients with type (VIP or Free).
|
|
||||||
|
|
||||||
1. **Create `add_client.sh`**
|
|
||||||
```bash
|
|
||||||
sudo nano /etc/wireguard/add_client.sh
|
|
||||||
```
|
|
||||||
```bash
|
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
if [ "$#" -ne 2 ]; then
|
|
||||||
echo "Usage: $0 <VIP|Free> <client_name>"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
TYPE=$1
|
|
||||||
NAME=$2
|
|
||||||
|
|
||||||
if [ "$TYPE" == "VIP" ]; then
|
|
||||||
IP_START=2
|
|
||||||
RATE="100mbit"
|
|
||||||
elif [ "$TYPE" == "Free" ]; then
|
|
||||||
IP_START=12
|
|
||||||
RATE="10mbit"
|
|
||||||
else
|
|
||||||
echo "Type must be VIP or Free"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
CLIENT_IP="10.0.0.$IP_START"
|
|
||||||
|
|
||||||
# Generate keys
|
|
||||||
mkdir -p ~/wireguard_clients
|
|
||||||
cd ~/wireguard_clients
|
|
||||||
wg genkey | tee ${NAME}_privatekey | wg pubkey > ${NAME}_publickey
|
|
||||||
|
|
||||||
PRIVATE_KEY=$(cat ${NAME}_privatekey)
|
|
||||||
PUBLIC_KEY=$(cat ${NAME}_publickey)
|
|
||||||
|
|
||||||
# Add to server config
|
|
||||||
echo "### Client $NAME" | sudo tee -a /etc/wireguard/wg0.conf
|
|
||||||
echo "[Peer]" | sudo tee -a /etc/wireguard/wg0.conf
|
|
||||||
echo "PublicKey = $PUBLIC_KEY" | sudo tee -a /etc/wireguard/wg0.conf
|
|
||||||
echo "AllowedIPs = $CLIENT_IP/32" | sudo tee -a /etc/wireguard/wg0.conf
|
|
||||||
echo "" | sudo tee -a /etc/wireguard/wg0.conf
|
|
||||||
|
|
||||||
# Create client config
|
|
||||||
cat <<EOF > ${NAME}.conf
|
|
||||||
[Interface]
|
|
||||||
PrivateKey = $PRIVATE_KEY
|
|
||||||
Address = $CLIENT_IP/24
|
|
||||||
DNS = 8.8.8.8
|
|
||||||
|
|
||||||
[Peer]
|
|
||||||
PublicKey = $(cat /etc/wireguard/server_publickey)
|
|
||||||
Endpoint = $(curl -s ifconfig.me):51820
|
|
||||||
AllowedIPs = 0.0.0.0/0, ::/0
|
|
||||||
PersistentKeepalive = 25
|
|
||||||
EOF
|
|
||||||
|
|
||||||
echo "Client $NAME added with IP $CLIENT_IP."
|
|
||||||
echo "Config file: ~/wireguard_clients/${NAME}.conf"
|
|
||||||
```
|
|
||||||
2. **Make Script Executable**
|
|
||||||
```bash
|
|
||||||
sudo chmod +x /etc/wireguard/add_client.sh
|
|
||||||
```
|
|
||||||
|
|
||||||
3. **Add Clients**
|
|
||||||
- **Free Clients (Ваня и Вася)**
|
|
||||||
```bash
|
|
||||||
sudo /etc/wireguard/add_client.sh Free vanya
|
|
||||||
sudo /etc/wireguard/add_client.sh Free vasya
|
|
||||||
```
|
|
||||||
- **VIP Client (Петя)**
|
|
||||||
```bash
|
|
||||||
sudo /etc/wireguard/add_client.sh VIP petya
|
|
||||||
```
|
|
||||||
|
|
||||||
### Switch Client Type
|
|
||||||
To switch a client from Free to VIP or vice versa:
|
|
||||||
|
|
||||||
1. **Edit Server Configuration**
|
|
||||||
```bash
|
|
||||||
sudo nano /etc/wireguard/wg0.conf
|
|
||||||
```
|
|
||||||
2. **Locate the Client's `[Peer]` Section**
|
|
||||||
```ini
|
|
||||||
### Client vanya
|
|
||||||
[Peer]
|
|
||||||
PublicKey = <vanya_publickey>
|
|
||||||
AllowedIPs = 10.0.0.12/32
|
|
||||||
```
|
|
||||||
3. **Change the `AllowedIPs` to Assign New IP Based on Type**
|
|
||||||
- **VIP**: `10.0.0.2/32` to `10.0.0.11/32`
|
|
||||||
- **Free**: `10.0.0.12/32` to `10.0.0.21/32`
|
|
||||||
4. **Update Speed Limiting Rules (see [Speed Limiting](#speed-limiting))**
|
|
||||||
5. **Restart WireGuard and Traffic Control**
|
|
||||||
```bash
|
|
||||||
sudo systemctl restart wg-quick@wg0
|
|
||||||
sudo systemctl restart wg-tc.service
|
|
||||||
```
|
|
||||||
|
|
||||||
## Speed Limiting
|
|
||||||
Use `tc` (Traffic Control) to limit bandwidth based on client IP.
|
|
||||||
|
|
||||||
1. **Create `set_tc.sh` Script**
|
|
||||||
```bash
|
|
||||||
sudo nano /etc/wireguard/set_tc.sh
|
|
||||||
```
|
|
||||||
```bash
|
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
INTERFACE="ens1" # Replace with your external interface
|
|
||||||
|
|
||||||
# Clear existing rules
|
|
||||||
tc qdisc del dev $INTERFACE root 2>/dev/null
|
|
||||||
tc qdisc del dev $INTERFACE ingress 2>/dev/null
|
|
||||||
|
|
||||||
# Root qdisc
|
|
||||||
tc qdisc add dev $INTERFACE root handle 1: htb default 30
|
|
||||||
|
|
||||||
# Main class
|
|
||||||
tc class add dev $INTERFACE parent 1: classid 1:1 htb rate 1000mbit
|
|
||||||
|
|
||||||
# VIP class
|
|
||||||
tc class add dev $INTERFACE parent 1:1 classid 1:10 htb rate 100mbit
|
|
||||||
|
|
||||||
# Free class
|
|
||||||
tc class add dev $INTERFACE parent 1:1 classid 1:20 htb rate 10mbit
|
|
||||||
|
|
||||||
# Apply filters for VIP clients
|
|
||||||
for ip in $(grep "AllowedIPs" /etc/wireguard/wg0.conf | grep "/32" | awk '{print $3}' | grep "^10\.0\.0\.[2-11]$"); do
|
|
||||||
tc filter add dev $INTERFACE protocol ip parent 1:0 prio 1 u32 match ip src $ip flowid 1:10
|
|
||||||
done
|
|
||||||
|
|
||||||
# Apply filters for Free clients
|
|
||||||
for ip in $(grep "AllowedIPs" /etc/wireguard/wg0.conf | grep "/32" | awk '{print $3}' | grep "^10\.0\.0\.[12-21]$"); do
|
|
||||||
tc filter add dev $INTERFACE protocol ip parent 1:0 prio 1 u32 match ip src $ip flowid 1:20
|
|
||||||
done
|
|
||||||
|
|
||||||
# Ingress qdisc
|
|
||||||
tc qdisc add dev $INTERFACE ingress
|
|
||||||
|
|
||||||
# Apply policing for VIP
|
|
||||||
for ip in $(grep "AllowedIPs" /etc/wireguard/wg0.conf | grep "/32" | awk '{print $3}' | grep "^10\.0\.0\.[2-11]$"); do
|
|
||||||
tc filter add dev $INTERFACE parent ffff: protocol ip prio 1 u32 match ip dst $ip flowid 1:10 police rate 100mbit burst 10k drop flowid :1
|
|
||||||
done
|
|
||||||
|
|
||||||
# Apply policing for Free
|
|
||||||
for ip in $(grep "AllowedIPs" /etc/wireguard/wg0.conf | grep "/32" | awk '{print $3}' | grep "^10\.0\.0\.[12-21]$"); do
|
|
||||||
tc filter add dev $INTERFACE parent ffff: protocol ip prio 1 u32 match ip dst $ip flowid 1:20 police rate 10mbit burst 10k drop flowid :1
|
|
||||||
done
|
|
||||||
```
|
|
||||||
2. **Make Script Executable**
|
|
||||||
```bash
|
|
||||||
sudo chmod +x /etc/wireguard/set_tc.sh
|
|
||||||
```
|
|
||||||
|
|
||||||
3. **Create `systemd` Service**
|
|
||||||
```bash
|
|
||||||
sudo nano /etc/systemd/system/wg-tc.service
|
|
||||||
```
|
|
||||||
```ini
|
|
||||||
[Unit]
|
|
||||||
Description=WireGuard Traffic Control
|
|
||||||
After=network.target wg-quick@wg0.service
|
|
||||||
Requires=wg-quick@wg0.service
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=oneshot
|
|
||||||
ExecStart=/etc/wireguard/set_tc.sh
|
|
||||||
RemainAfterExit=yes
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
```
|
|
||||||
4. **Enable and Start Service**
|
|
||||||
```bash
|
|
||||||
sudo systemctl daemon-reload
|
|
||||||
sudo systemctl enable wg-tc.service
|
|
||||||
sudo systemctl start wg-tc.service
|
|
||||||
```
|
|
||||||
|
|
||||||
## Security Considerations
|
|
||||||
Distributing `.conf` files exposes your server's IP address, which can be targeted for DDoS attacks. To mitigate risks:
|
|
||||||
|
|
||||||
1. **Use a Firewall**: Ensure only necessary ports are open.
|
|
||||||
```bash
|
|
||||||
sudo iptables -A INPUT -p udp --dport 51820 -j ACCEPT
|
|
||||||
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
||||||
sudo iptables -A INPUT -j DROP
|
|
||||||
```
|
|
||||||
2. **Rate Limiting**: Further protect with fail2ban or similar tools.
|
|
||||||
3. **Monitor Traffic**: Use monitoring tools to detect unusual activity.
|
|
||||||
4. **Use a Dedicated IP**: If possible, host VPN on a separate IP to isolate traffic.
|
|
||||||
|
|
||||||
## Starting WireGuard
|
|
||||||
1. **Start and Enable WireGuard**
|
|
||||||
```bash
|
|
||||||
sudo systemctl start wg-quick@wg0
|
|
||||||
sudo systemctl enable wg-quick@wg0
|
|
||||||
```
|
|
||||||
|
|
||||||
## Verification
|
|
||||||
1. **Check WireGuard Status**
|
|
||||||
```bash
|
|
||||||
sudo wg show
|
|
||||||
```
|
|
||||||
2. **Verify Speed Limits**
|
|
||||||
- Connect clients and use [speedtest.net](https://www.speedtest.net) to ensure VIP clients have up to 100 Mbps and Free clients up to 10 Mbps.
|
|
||||||
|
|
||||||
## Conclusion
|
|
||||||
You have successfully set up a WireGuard VPN server on Arch Linux with VIP and Free clients, each having distinct bandwidth limitations. Ensure to follow security best practices to protect your server from potential threats.
|
|
||||||
|
|
||||||
For further assistance, refer to the [WireGuard Documentation](https://www.wireguard.com/#documentation) or the Arch Linux community.
|
|
||||||
Loading…
Add table
Reference in a new issue