192 lines
4.3 KiB
Markdown
192 lines
4.3 KiB
Markdown
# WireGuard VPN Setup for Debian 13
|
|
|
|
## Overview
|
|
Personal WireGuard VPN server with IPv4/IPv6 support, client management via `/etc/wireguard/peer.d/`, designed for 1 CPU / 1GB RAM VPS.
|
|
|
|
## Configuration
|
|
- **Server Domain**: velkhana.calmcacil.dev
|
|
- **Port**: 51820
|
|
- **VPN IPv4 Range**: 10.10.69.0/24
|
|
- **VPN IPv6 Range**: fd69:dead:beef:69::/64
|
|
- **DNS**: 8.8.8.8, 8.8.4.4 (Google)
|
|
- **Server-side peer configs**: /etc/wireguard/peer.d/*.conf (loaded dynamically)
|
|
- **Client-side configs**: /etc/wireguard/clients/*.conf (for distribution)
|
|
|
|
## Installation
|
|
|
|
### 1. Upload files to VPS
|
|
```bash
|
|
scp install-wireguard.sh wg-client-manager calmcacil@velkhana.calmcacil.dev:~/
|
|
```
|
|
|
|
### 2. Run installation
|
|
```bash
|
|
chmod +x ~/install-wireguard.sh ~/wg-client-manager
|
|
sudo ~/install-wireguard.sh
|
|
```
|
|
|
|
### 3. Install client manager
|
|
```bash
|
|
sudo mv ~/wg-client-manager /usr/local/sbin/
|
|
sudo chmod +x /usr/local/sbin/wg-client-manager
|
|
```
|
|
|
|
## Usage
|
|
|
|
### Dynamic client loading
|
|
WireGuard automatically loads clients from `/etc/wireguard/peer.d/`:
|
|
- Add/remove client configs in `/etc/wireguard/peer.d/*.conf`
|
|
- Run `sudo /usr/local/sbin/wg-load-clients` to reload
|
|
- Changes are applied immediately without restarting
|
|
|
|
### Add a new client
|
|
```bash
|
|
sudo /usr/local/sbin/wg-client-manager add myphone
|
|
```
|
|
This creates:
|
|
- Server config in `/etc/wireguard/peer.d/myphone.conf`
|
|
- Client config in `/etc/wireguard/clients/myphone.conf`
|
|
- QR code in `/etc/wireguard/clients/myphone.qr`
|
|
|
|
### List all clients
|
|
```bash
|
|
sudo /usr/local/sbin/wg-client-manager list
|
|
```
|
|
|
|
### Show client config
|
|
```bash
|
|
sudo /usr/local/sbin/wg-client-manager show myphone
|
|
```
|
|
|
|
### Show QR code
|
|
```bash
|
|
sudo /usr/local/sbin/wg-client-manager qr myphone
|
|
```
|
|
|
|
### Remove a client
|
|
```bash
|
|
sudo /usr/local/sbin/wg-client-manager remove myphone
|
|
```
|
|
|
|
## Server Management
|
|
|
|
### Check WireGuard status
|
|
```bash
|
|
sudo wg show
|
|
```
|
|
|
|
### Check service status
|
|
```bash
|
|
sudo systemctl status wg-quick@wg0
|
|
```
|
|
|
|
### Restart WireGuard
|
|
```bash
|
|
sudo systemctl restart wg-quick@wg0
|
|
```
|
|
|
|
### Reload clients (automatic on add/remove)
|
|
```bash
|
|
sudo /usr/local/sbin/wg-load-clients
|
|
```
|
|
|
|
### Firewall management
|
|
The setup configures nftables with:
|
|
- Dual-stack IPv4/IPv6 support in a single ruleset
|
|
- Default drop incoming, accept outgoing
|
|
- SSH access allowed (port 22)
|
|
- WireGuard allowed (UDP 51820)
|
|
- Forwarding from wg0 interface allowed
|
|
- NAT masquerade for VPN internet access
|
|
|
|
View firewall rules:
|
|
```bash
|
|
sudo nft list ruleset
|
|
```
|
|
|
|
Enable/disable firewall:
|
|
```bash
|
|
sudo nftables-firewall disable
|
|
sudo nftables-firewall enable
|
|
```
|
|
|
|
Allow additional ports if needed:
|
|
```bash
|
|
sudo nftables-firewall allow 80/tcp # HTTP
|
|
sudo nftables-firewall allow 443/tcp # HTTPS
|
|
```
|
|
|
|
## Manual Client Configuration
|
|
|
|
To manually add a client, create a file in `/etc/wireguard/peer.d/`:
|
|
|
|
```ini
|
|
[Peer]
|
|
# mydevice
|
|
PublicKey = <client_public_key>
|
|
AllowedIPs = 10.10.69.2/32, fd69:dead:beef:69::2/128
|
|
```
|
|
|
|
Then run:
|
|
```bash
|
|
sudo /usr/local/sbin/wg-load-clients
|
|
```
|
|
|
|
## Client Setup
|
|
|
|
### Importing the config
|
|
- **Desktop**: Import `/etc/wireguard/clients/<name>.conf` into WireGuard app
|
|
- **Mobile**: Scan QR code with WireGuard app, or import config file
|
|
|
|
### Test connectivity
|
|
```bash
|
|
# On client
|
|
ping 10.10.69.1
|
|
ping -6 fd69:dead:beef:69::1
|
|
|
|
# Check your IP
|
|
curl -4 https://ifconfig.me
|
|
curl -6 https://ifconfig.me
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
### Check firewall
|
|
```bash
|
|
sudo nft list ruleset
|
|
```
|
|
|
|
### Check IP forwarding
|
|
```bash
|
|
sysctl net.ipv4.ip_forward
|
|
sysctl net.ipv6.conf.all.forwarding
|
|
```
|
|
|
|
### View logs
|
|
```bash
|
|
sudo journalctl -u wg-quick@wg0 -f
|
|
```
|
|
|
|
### Check client directory
|
|
```bash
|
|
ls -la /etc/wireguard/peer.d/
|
|
```
|
|
|
|
### Manual reload if needed
|
|
```bash
|
|
sudo /usr/local/sbin/wg-load-clients
|
|
```
|
|
|
|
## Notes
|
|
- `/etc/wireguard/peer.d/` - Server-side peer configs, loaded automatically by wg-load-clients
|
|
- `/etc/wireguard/clients/` - Client-side configs (import to WireGuard apps) and QR codes
|
|
- Clients are automatically reloaded when added/removed
|
|
- IPv4 and IPv6 NAT are configured (MASQUERADE)
|
|
- nftables firewall is configured with dual-stack IPv4/IPv6 support
|
|
- Single nftables ruleset handles both IPv4 and IPv6
|
|
- SSH (port 22) and WireGuard (UDP 51820) are allowed by default
|
|
- Keepalive is set to 25 seconds for better stability
|
|
- Server private keys are stored in `/etc/wireguard/server_private.key`
|
|
- Server public key is displayed after installation
|
|
- Use `nftables-firewall` script for easy firewall management
|