WireGuard异地组网

在众多 VPN 协议中，WireGuard 以其简洁、高效和现代的特性脱颖而出。它是一个新兴的开源 VPN 协议，旨在提供比传统协议（如 OpenVPN 和 IPsec）更简单、更快速、更安全的连接。WireGuard 的核心优势在于其极小的代码库，这使得它更容易审计、减少了潜在的漏洞，并显著提升了连接速度和性能。由于其出色的表现，WireGuard 已经成为许多开发者和企业构建安全、稳定网络连接的首选。

服务端

docker-compose.yaml

volumes:
  etc_wireguard:

services:
  wg-easy:
    environment:
      # Change Language:
      # (Supports: en, ua, ru, tr, no, pl, fr, de, ca, es, ko, vi, nl, is, pt, chs, cht, it, th, hi)
      - LANG=chs
      # ⚠️ Required:
      # Change this to your host's public address
      - WG_HOST=1.1.1.1

      # Optional:
      # - PASSWORD_HASH=$$2y$$10$$hBCoykrB95WSzuV4fafBzOHWKu9sbyVa34GJr8VV5R/pIelfEMYyG # (needs double $$, hash of 'foobar123'; see "How_to_generate_an_bcrypt_hash.md" for generate the hash)
      # - PORT=51821
      # - WG_PORT=51820
      # - WG_CONFIG_PORT=92820
      # - WG_DEFAULT_ADDRESS=10.8.0.x
      # - WG_DEFAULT_DNS=223.5.5.5
      # - WG_MTU=1420
      # - WG_ALLOWED_IPS=10.0.8.0/24,192.168.6.0/24
      # - WG_PERSISTENT_KEEPALIVE=25
      # - WG_PRE_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt
      # - WG_POST_UP=echo "Post Up" > /etc/wireguard/post-up.txt
      # - WG_PRE_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt
      # - WG_POST_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt
      # - UI_TRAFFIC_STATS=true
      # - UI_CHART_TYPE=0 # (0 Charts disabled, 1 # Line chart, 2 # Area chart, 3 # Bar chart)

      - PASSWORD_HASH=$$2y$$10$$hBCoykrB95WSzuV4fafBzOHWKu9sbyVa34GJr8VV5R/pIelfEMYyG
      - WG_POST_UP=iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE; iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT;
      - WG_POST_DOWN=iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE; iptables -D INPUT -p udp -m udp --dport 51820 -j ACCEPT; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT;
      - WG_DEFAULT_ADDRESS=10.8.0.x
      - WG_DEFAULT_DNS=223.5.5.5
      - WG_ALLOWED_IPS=10.8.0.0/24,192.168.6.0/24
      - WG_PERSISTENT_KEEPALIVE=25
      - PORT=51821
      - WG_PORT=51820

    image: ghcr.io/wg-easy/wg-easy:latest
    container_name: wg-easy
    volumes:
      - etc_wireguard:/etc/wireguard
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
      # - NET_RAW # ⚠️ Uncomment if using Podman
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1

额外增加一个脚本，修改服务端内client的allowips
extra.sh

#!/bin/bash

CONTAINER_NAME="wg-easy" # 替换为你的容器名称

# 停止容器内的 wg0 接口
docker exec $CONTAINER_NAME wg-quick down wg0

# 修改容器内的配置文件
docker exec $CONTAINER_NAME sed -i "/^AllowedIPs = 10.8.0.3\/32$/s/$/\,192.168.6.0\/24/" /etc/wireguard/wg0.conf
echo "容器内配置修改完成"

# 启动容器内的 wg0 接口
docker exec $CONTAINER_NAME wg-quick up wg0
echo "容器内 WireGuard 重启完成"

客户端

进入webui，添加客户端，下载配置文件导入即可