Overview
OpenVPN, WireGuard, and IPSec VPN configuration and management skills.
WireGuard
Installation
# Debian/Ubuntu
apt install wireguard
# CentOS/RHEL
yum install epel-release elrepo-release
yum install kmod-wireguard wireguard-tools
# 验证安装
wg --version
Generate Keys
# 生成私钥
wg genkey > privatekey
# 从私钥生成公钥
wg pubkey < privatekey > publickey
# 一步生成
wg genkey | tee privatekey | wg pubkey > publickey
# 生成预共享密钥（可选，增强安全）
wg genpsk > presharedkey
Server Configuration
# /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>
# 启用 IP 转发
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.0.0.2/32
Client Configuration
# /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.2/24
PrivateKey = <client_private_key>
DNS = 8.8.8.8
[Peer]
PublicKey = <server_public_key>
Endpoint = server.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
Management Commands
# 启动
wg-quick up wg0
systemctl start wg-quick@wg0
# 停止
wg-quick down wg0
systemctl stop wg-quick@wg0
# 开机启动
systemctl enable wg-quick@wg0
# 查看状态
wg show
wg show wg0
# 添加 peer
wg set wg0 peer <public_key> allowed-ips 10.0.0.3/32
OpenVPN
Installation
# Debian/Ubuntu
apt install openvpn easy-rsa
# CentOS/RHEL
yum install epel-release
yum install openvpn easy-rsa
Initialize PKI
# 创建 CA 目录
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
# 初始化 PKI
./easyrsa init-pki
# 创建 CA
./easyrsa build-ca nopass
# 生成服务器证书
./easyrsa gen-req server nopass
./easyrsa sign-req server server
# 生成 DH 参数
./easyrsa gen-dh
# 生成 TLS 密钥
openvpn --genkey secret ta.key
# 生成客户端证书
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1
Server Configuration
# /etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-GCM
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
Client Configuration
# client.ovpn
client
dev tun
proto udp
remote server.example.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
cipher AES-256-GCM
auth SHA256
verb 3
Management Commands
# 启动服务
systemctl start openvpn@server
systemctl enable openvpn@server
# 查看状态
systemctl status openvpn@server
# 查看连接
cat /var/log/openvpn-status.log
# 吊销证书
cd ~/openvpn-ca
./easyrsa revoke client1
./easyrsa gen-crl
IPSec (strongSwan)
Installation
# Debian/Ubuntu
apt install strongswan strongswan-pki
# CentOS/RHEL
yum install strongswan
Generate Certificates
# 生成 CA
ipsec pki --gen --type rsa --size 4096 --outform pem > ca-key.pem
ipsec pki --self --ca --lifetime 3650 \
--in ca-key.pem --type rsa \
--dn "CN=VPN CA" \
--outform pem > ca-cert.pem
# 生成服务器证书
ipsec pki --gen --type rsa --size 4096 --outform pem > server-key.pem
ipsec pki --pub --in server-key.pem --type rsa | \
ipsec pki --issue --lifetime 1825 \
--cacert ca-cert.pem --cakey ca-key.pem \
--dn "CN=vpn.example.com" \
--san vpn.example.com \
--flag serverAuth --flag ikeIntermediate \
--outform pem > server-cert.pem
Server Configuration
# /etc/ipsec.conf
config setup
charondebug="ike 2, knl 2, cfg 2"
uniqueids=no
conn ikev2-vpn
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes
dpdaction=clear
dpddelay=300s
rekey=no
left=%any
leftid=@vpn.example.com
leftcert=server-cert.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-mschapv2
rightsourceip=10.10.10.0/24
rightdns=8.8.8.8,8.8.4.4
rightsendcert=never
eap_identity=%identity
User Configuration
# /etc/ipsec.secrets
: RSA "server-key.pem"
user1 : EAP "password1"
user2 : EAP "password2"
Management Commands
# 启动
systemctl start strongswan
systemctl enable strongswan
# 重载配置
ipsec reload
ipsec rereadall
# 查看状态
ipsec statusall
ipsec status
# 查看 SA
ipsec listall
Common Scenarios
Scenario 1: WireGuard Site-to-Site
# 站点 A 配置
[Interface]
Address = 10.0.0.1/24
PrivateKey = <site_a_private>
ListenPort = 51820
[Peer]
PublicKey = <site_b_public>
Endpoint = site-b.example.com:51820
AllowedIPs = 10.0.0.2/32, 192.168.2.0/24
# 站点 B 配置
[Interface]
Address = 10.0.0.2/24
PrivateKey = <site_b_private>
ListenPort = 51820
[Peer]
PublicKey = <site_a_public>
Endpoint = site-a.example.com:51820
AllowedIPs = 10.0.0.1/32, 192.168.1.0/24
Scenario 2: Split Tunneling Configuration
# WireGuard 仅代理特定网段
[Peer]
PublicKey = <server_public_key>
Endpoint = server.example.com:51820
AllowedIPs = 10.0.0.0/24, 192.168.100.0/24
Scenario 3: Multi-User Management Script
#!/bin/bash
# add-wg-client.sh
CLIENT_NAME=$1
SERVER_PUBLIC_KEY="<server_public_key>"
SERVER_ENDPOINT="vpn.example.com:51820"
# 生成密钥
wg genkey | tee ${CLIENT_NAME}_private | wg pubkey > ${CLIENT_NAME}_public
# 生成客户端配置
cat > ${CLIENT_NAME}.conf << EOF
[Interface]
PrivateKey = $(cat ${CLIENT_NAME}_private)
Address = 10.0.0.${2}/24
DNS = 8.8.8.8
[Peer]
PublicKey = ${SERVER_PUBLIC_KEY}
Endpoint = ${SERVER_ENDPOINT}
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF
echo "添加到服务器："
echo "[Peer]"
echo "PublicKey = $(cat ${CLIENT_NAME}_public)"
echo "AllowedIPs = 10.0.0.${2}/32"
Troubleshooting
| Issue | Troubleshooting Method |
|---|---|
| Connection Failure | Check firewall, ports, and key configuration |
| Handshake Failure | Check public key configuration and time synchronization |
| Cannot Access Internal Network | Check AllowedIPs, routes, and IP forwarding |
| Poor Performance | Check MTU and encryption algorithm |
# WireGuard 调试
wg show
dmesg | grep wireguard
tcpdump -i any port 51820
# OpenVPN 调试
tail -f /var/log/openvpn.log
tcpdump -i any port 1194
# IPSec 调试
ipsec statusall
journalctl -u strongswan -f
# 检查 IP 转发
cat /proc/sys/net/ipv4/ip_forward
sysctl net.ipv4.ip_forward=1