To se mi líbí 0
Fork 0

Naposledy aktivní 1736346281

Mathias revidoval tento gist 1736346281. Přejít na revizi

1 file changed, 169 insertions

VPN_Setup_Wireguard.md(vytvořil soubor)

@@ -0,0 +1,169 @@
1 + # Setting Up a Home Server: Static IP and Port Exposure with WireGuard on Linux
2 +
3 + Have you ever wished to run your own email server from the comfort of your home but were held back by the need for a
4 + reliable static IP? There is a solution! Whether it's hosting a personal website, gaming server, or a
5 + specialized application, this guide will show you how to set up a static IP and port exposure using Wireguard on Linux.
6 +
7 + > "What if I already have a static IP?"
8 + > If you already have a static IP address, you may not need this guide. However, you can still use WireGuard to
9 + > secure your connection and hide your home IP address from the internet.
10 +
11 + ## Prerequisites
12 +
13 + - 🖥️ A hosted Linux server with a public IPv4 address
14 + - :computer: A linux server at your home (e.g. Raspberry Pi)
15 + - :thinking: A basic understanding of Linux and networking
16 +
17 + ## Overview
18 +
19 + The basic idea is to set up a VPN server on your hosted Linux server and a VPN client on your home Linux server. The
20 + VPN client will connect to the VPN server and expose the VPN server's IP address to the internet. This will allow you
21 + to access your home server from the internet using the VPN server's IP address.
22 + A nice side effect of this setup is that your actual home IP address will be hidden from the internet.
23 +
24 + ## 🖥️ Setting up the VPN Server
25 +
26 + This process is fairly straightforward. We will be using WireGuard to set up the VPN server.
27 +
28 + 1. SSH into your hosted Linux server
29 + 2. Install WireGuard
30 + ```bash
31 + sudo apt update && sudo apt install wireguard -y
32 + ```
33 + 3. Generate server and client keys
34 + ``` bash
35 + umask 077; wg genkey | tee server_private_key | wg pubkey > server_public_key
36 + umask 077; wg genkey | tee client_private_key | wg pubkey > client_public_key
37 + ```
38 + 4. Configure the WireGuard server
39 + Create the configuration file `/etc/wireguard/wg0.conf` with the following content:
40 + ```ini
41 + [Interface]
42 + PrivateKey = <server_private_key>
43 + Address = 12.0.0.1/24
44 + ListenPort = 51820
45 +
46 + [Peer]
47 + PublicKey = <client_public_key>
48 + AllowedIPs = 12.0.0.2/32
49 + ```
50 + 5. Start the WireGuard server
51 + ```bash
52 + sudo wg-quick up wg0
53 + ```
54 + 6. Enable WireGuard to start on boot
55 + ``` bash
56 + sudo systemctl enable wg-quick@wg0
57 + ```
58 +
59 + ## :computer: Setting up the VPN Client
60 +
61 + 1. SSH into your home Linux server and install WireGuard:
62 + ``` bash
63 + sudo apt update && sudo apt install wireguard -y
64 + ```
65 + 2. Configure the WireGuard client
66 + Create the configuration file `/etc/wireguard/wg0.conf` with the following content:
67 + ```ini
68 + [Interface]
69 + PrivateKey = <client_private_key>
70 + Address = 12.0.0.2/24
71 +
72 + [Peer]
73 + PublicKey = <server_public_key>
74 + Endpoint = <hosted-server-ip>:51820
75 + AllowedIPs = 0.0.0.0/0
76 + ```
77 + 3. Start the WireGuard client:
78 + ```bash
79 + sudo wg-quick up wg0
80 + ```
81 + 4. Enable WireGuard to start on boot
82 + ```bash
83 + sudo systemctl enable wg-quick@wg0
84 + ```
85 + 5. Check your public IP address:
86 + ```bash
87 + curl ifconfig.me
88 + ```
89 + You should see the IP address of your hosted Linux server. This means that your home Linux server is now connected
90 + to your hosted Linux server via the VPN server.
91 +
92 + ## :twisted_rightwards_arrows: Setting up port forwarding
93 +
94 + Now that your home Linux server is connected to your hosted Linux server via the VPN server, you can expose any port
95 + on your home Linux server to the internet. This is done by setting up port forwarding on your hosted Linux server.
96 +
97 + First, you need to find out the IP address of your home Linux server. You can do this by running the following command
98 + on your hosted Linux server:
99 +
100 + ``` bash
101 + cat /etc/wireguard/wg0.conf | grep Address | cut -d '=' -f 2
102 + ```
103 +
104 + This is the IP address of your home Linux server. You can now set up port forwarding on your hosted Linux server to
105 + expose any port on your home Linux server to the internet.
106 +
107 + To make the setup easier, we are going to set an environment variable with the IP address of your home Linux server:
108 +
109 + ``` bash
110 + export HOME_IP=<home-server-ip> # Replace <home-server-ip> with the IP address of your home Linux server
111 + export STATIC_IP=<static-ip> # Replace <static-ip> with the static IP address of your hosted Linux server
112 + ```
113 +
114 + First, you need to enable IP forwarding on your hosted Linux server. Replace `eth0` with the name of your network
115 + interface:
116 +
117 + ``` bash
118 + sudo sysctl -w net.ipv4.ip_forward=1
119 + sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
120 + ```
121 +
122 + You can use the following commands to set up port forwarding on your hosted Linux server:
123 +
124 + ### :globe_with_meridians: Exposing a TCP port
125 +
126 + ``` bash
127 + PORT=<port>; sudo iptables -t nat -d $STATIC_IP -A PREROUTING -p tcp --dport $PORT -j DNAT --to-destination $HOME_IP:$PORT
128 + ```
129 +
130 + ### :globe_with_meridians: Exposing a UDP port
131 +
132 + ``` bash
133 + PORT=<port>; sudo iptables -t nat -d $STATIC_IP -A PREROUTING -p udp --dport $PORT -j DNAT --to-destination $HOME_IP:$PORT
134 + ```
135 +
136 + ### :earth_africa: Exposing a range of TCP ports
137 +
138 + ``` bash
139 + START_PORT=<start-port> END_PORT=<end-port>; sudo iptables -t nat -d $STATIC_IP -A PREROUTING -p tcp --dport $START_PORT:$END_PORT -j DNAT --to-destination $HOME_IP:$START_PORT-$END_PORT
140 + ```
141 +
142 + ### :earth_africa: Exposing a range of UDP ports
143 +
144 + ``` bash
145 + START_PORT=<start-port> END_PORT=<end-port>; sudo iptables -t nat -d $STATIC_IP -A PREROUTING -p udp --dport $START_PORT:$END_PORT -j DNAT --to-destination $HOME_IP:$START_PORT-$END_PORT
146 + ```
147 +
148 + ### :information_source: Example: Exposing a web server on port 80
149 +
150 + ``` bash
151 + PORT=80; sudo iptables -t nat -d $STATIC_IP -A PREROUTING -p tcp --dport $PORT -j DNAT --to-destination $HOME_IP:$PORT
152 + ```
153 +
154 + ## :floppy_disk: Making the iptables rules persistent
155 +
156 + The iptables rules are not persistent by default. This means that if you reboot your hosted Linux server, the iptables
157 + rules will be lost. To make the iptables rules persistent, you need to install the `iptables-persistent` package:
158 +
159 + ``` bash
160 + sudo apt update && apt install iptables-persistent -y
161 + ```
162 +
163 + During the installation, you will be asked if you want to save the current iptables rules. Type `yes` and press `Enter`
164 + to save the rules. The iptables rules will now be loaded automatically on boot.
165 +
166 + ## :tada: Conclusion
167 +
168 + Congratulations! You have successfully set up a static IP and port exposure using WireGuard on Linux. You can now access
169 + any service on your home Linux server from the internet using the IP address of your hosted Linux server.
Novější Starší

Vytvořeno pomocí Opengist ⋅ Load: 7ms⋅

Čeština