☰

如何使用wireguard正确配置iptables？

tag-icon • tag-icon iptables wireguard
如何使用wireguard正确配置iptables？

我有两个虚拟机（服务器，客户端）连接到网络10.0.0.0/24并运行wireguard，服务器具有以下配置

[Interface]
PrivateKey = <server_private_key>
Address = 172.0.0.1/24 
ListenPort = 10001

[Peer]
PublicKey = <client_public_key>
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 10

服务器 iptables 规则

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

客户端有以下配置

[Interface]
PrivateKey = <client_private_key>
Address = 172.0.0.2/24 

[Peer]
PublicKey = <server_public_key>
AllowedIPs = 172.0.0.0/24
Endpoint = 172.0.0.1:10001 
PersistentKeepalive = 10

和客户端 iptables 规则

target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

当 pining 客户端时172.0.0.2，我得到以下输出

PING 172.0.0.2 (172.0.0.2) 56(84) bytes of data.
From 172.0.0.1 icmp_seq=1 Destination Host Unreachable
ping: sendmsg: Destination address required
From 172.0.0.1 icmp_seq=2 Destination Host Unreachable
ping: sendmsg: Destination address required
From 172.0.0.1 icmp_seq=3 Destination Host Unreachable
ping: sendmsg: Destination address required
^C
--- 172.0.0.2 ping statistics ---
3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2045ms

当 ping 服务器时，172.0.0.1所有数据包都会被丢弃

PING 172.0.0.1 (172.0.0.1) 56(84) bytes of data.
^C
--- 172.0.0.1 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2053ms

相关内容