如下拓扑：
|----------| |----------|
| | 192.168.1.115 | |
| server |---------------------------| peer |
| | 192.168.1.117 | |
|----------| |----------|
wg0 - 10.8.0.1 wg0 - 10.8.0.2
基于Ubuntu 20.04服务器版本环境。
$ uname -a
Linux blackhurricane 5.4.0-113-generic #127-Ubuntu SMP Wed May 18 14:30:56 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
$
$ cat /etc/issue
Ubuntu 20.04 LTS \n \l
安装WireGuard:
$ sudo apt install wireguard
服务端基础配置
生成如下的私钥和公钥：
$ wg genkey | sudo tee /etc/wireguard/private.key
8EV7IGEpaFyUyu6x6bED0tCESrAl1q7q3RQQ9nCxEWc=
$
$ sudo cat /etc/wireguard/private.key
8EV7IGEpaFyUyu6x6bED0tCESrAl1q7q3RQQ9nCxEWc=
$
$
$ sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key
85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
$
$ sudo cat /etc/wireguard/public.key
85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
创建如下的配置文件，其中IPv4地址（10.8.0.1）和IPv6地址（可不需要）为WireGuard虚拟接口使用的地址。
$ sudo cat /etc/wireguard/wg0.conf
[Interface]
PrivateKey = 8EV7IGEpaFyUyu6x6bED0tCESrAl1q7q3RQQ9nCxEWc=
Address = 10.8.0.1/24, fd0d:86fa:c3bc::1/64
ListenPort = 51820
SaveConfig = true
启动WireGuard：
$ sudo wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.1/24 dev wg0
[#] ip -6 address add fd0d:86fa:c3bc::1/64 dev wg0
[#] ip link set mtu 1420 up dev wg0
以上创建了隧道虚拟接口wg0，如下可见其IPv4/v6地址和MTU值。
$ ip -d link show type wireguard
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/none promiscuity 0 minmtu 0 maxmtu 2147483552
wireguard addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
$
$ ip addr show wg0
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 10.8.0.1/24 scope global wg0
valid_lft forever preferred_lft forever
inet6 fd0d:86fa:c3bc::1/64 scope global
valid_lft forever preferred_lft forever
使用wg命令查看状态。
$ sudo wg
interface: wg0
public key: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
private key: (hidden)
listening port: 51820
查看监听在51820（UDP）端口的进程，内核线程在监听。
$ sudo ss -p -anu | grep 51820
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
UNCONN 0 0 0.0.0.0:51820 0.0.0.0:*
UNCONN 0 0 [::]:51820 [::]:*
$
$
$ ps aux | grep wg0
root 569269 0.0 0.0 0 0 ? I< 05:58 0:00 [wg-crypt-wg0]
获取本机的DNS服务器配置，PEER端可能需要使用。
$ resolvectl dns ens32
Link 2 (ens32): 114.114.114.114
PEER配置
生成PEER端的私钥和公钥：
$ wg genkey | sudo tee /etc/wireguard/private.key
sBO+UjzfSgBTRx+YDOyX0qdnyVBqWMt5teaF1xzTEko=
$
$ sudo cat /etc/wireguard/private.key
sBO+UjzfSgBTRx+YDOyX0qdnyVBqWMt5teaF1xzTEko=
$
$
$ sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key
IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
$
$ sudo cat /etc/wireguard/public.key
IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
安装resolvconf，不需要DNS的情况下，可忽略。
$ sudo apt install resolvconf
创建如下的配置文件，PEER端的隧道接口地址使用10.8.0.2。[Peer]段配置服务器的公钥，使用隧道的IP地址段，以及服务器的外网IP地址和端口号。
$ sudo cat /etc/wireguard/wg0.conf
[Interface]
PrivateKey = sBO+UjzfSgBTRx+YDOyX0qdnyVBqWMt5teaF1xzTEko=
Address = 10.8.0.2/24
Address = fd0d:86fa:c3bc::2/64
DNS = 114.114.114.114
[Peer]
PublicKey = 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
AllowedIPs = 10.8.0.0/24, fd0d:86fa:c3bc::/64
Endpoint = 192.168.1.115:51820
服务端添加PEER配置
在服务端配置中添加PEER的公钥，隧道IP地址。
$ sudo wg set wg0 peer IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8= allowed-ips 10.8.0.2,fd0d:86fa:c3bc::2
$
$ sudo wg
interface: wg0
public key: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
private key: (hidden)
listening port: 51820
peer: IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
allowed ips: 10.8.0.2/32, fd0d:86fa:c3bc::2/128
启动隧道连接
启动PEER端WireGuard。
$ sudo wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.2/24 dev wg0
[#] ip -6 address add fd0d:86fa:c3bc::2/64 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a tun.wg0 -m 0 -x
如下WireGuard隧道接口的IP地址配置。
$ ip -d link show type wireguard
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/none promiscuity 0 minmtu 0 maxmtu 2147483552
wireguard addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
$
$ ip addr show wg0
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 10.8.0.2/24 scope global wg0
valid_lft forever preferred_lft forever
inet6 fd0d:86fa:c3bc::2/64 scope global
valid_lft forever preferred_lft forever
查看PEER端WireGuard状态。
$ sudo wg
interface: wg0
public key: IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
private key: (hidden)
listening port: 57745
peer: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
endpoint: 192.168.1.115:51820
allowed ips: 10.8.0.0/24, fd0d:86fa:c3bc::/64
触发隧道连接，在PEER端ping服务端地址10.8.0.1，如下：
$ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=22.0 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=0.579 ms
再次查看PEER端WireGuard状态，握手成功。
$ sudo wg
interface: wg0
public key: IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
private key: (hidden)
listening port: 57745
peer: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
endpoint: 192.168.1.115:51820
allowed ips: 10.8.0.0/24, fd0d:86fa:c3bc::/64
latest handshake: 41 seconds ago
transfer: 348 B received, 436 B sent
服务器端WireGuard状态如下，可见Peer的外部地址192.168.1.117：
$ sudo wg
interface: wg0
public key: 85OcXb86grzV6Amt4H/vvMUAVz1k2ZwKIhYviPCfcik=
private key: (hidden)
listening port: 51820
peer: IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8=
endpoint: 192.168.1.117:57745
allowed ips: 10.8.0.2/32, fd0d:86fa:c3bc::2/128
latest handshake: 21 seconds ago
transfer: 436 B received, 348 B sent
PEER端删除隧道接口及配置：
# sudo wg-quick down wg0
服务端删除PEER配置：
# sudo wg set wg0 peer IWXK0VUxT2+iXbzbkStoim6JbfF34aZOiC0VLW+LfE8= remove
WireGuard版本信息如下：
$ tail /var/log/kern.log
[1201619.382517] wireguard: WireGuard 1.0.20201112 loaded. See www.wireguard.com for information.
[1201619.382519] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
报文信息
WireGuard握手和4个ping报文：
Wireguard握手报文Handshake Initiation：
Wireguard握手报文Handshake Response：
