通过Wireguard VPN重定向流量

Question

我有一个公开的IPv6地址，但没有一个IPv4。因此，我想通过带有公共IPv4和IPv6地址的VPS路由流量。我的问题是如何使用Wireguard创建这种类型的隧道。从VPS到我网络中的设备的隧道不是挑战，而是如何将服务器上的数据包重定向到该隧道。

我做了一些研究，我的方法会是这样的。

我的网络设备

[Interface]
Address = <DEVICE IPv6>
PrivateKey = <private key>
ListenPort = <DEVICE PORT>

# Peer to VPS
[Peer]
PublicKey = [PUBLIC KEY VPS]
AllowedIPs = [VPS IPv6]
Endpoint = [VPS IPv6]:[VPS PORT]

副总裁

[Interface]
Address = <VPS IPv6>
Address = <VPS IPv4>
PrivateKey = <private key>
ListenPort = <VPS PORT>

# Peer to device
[Peer]
PublicKey = [PUBLIC KEY DEVICE]
Endpoint = [DEVICE IPv6]:[DEVICE PORT]
AllowedIPs = 0.0.0.0/0, ::/0


# Example peer of client
[Peer]
PublicKey = <client public key>
AllowedIPs = 0.0.0.0/0, ::/0

示例客户端

[Interface]
PrivateKey = <private key>
ListenPort = <CLIENT PORT>

[Peer]
PublicKey = [PUBLIC KEY VPS]
Endpoint = [VPS IPv4]:[VPS PORT], [VPS IPv6]:[VPS PORT]
AllowedIPs = 0.0.0.0/0

这个是可能的吗？还是需要创建两个WG接口并在两者之间路由通信量？

Answer 1

听起来你只是想从你的网络设备连接到你的示例客户端，反之亦然？如果是这样的话，那么这就是经典的轮毂和辐式有线护卫场景，以VPS作为集线器，网络设备和示例客户端作为辐条。

对于在您的WireGuard网络中隧道化的连接，您可以使用IPv4或IPv6地址--它不必与承载隧道连接的数据包的IP版本相匹配。下面是一个示例，将IPv6 fd00::/56地址块用于WireGuard网络；使用198.51.100.123作为集线器的公共IPv4地址；使用2001:db8:1234:abcd::1作为集线器的公共IPv6地址：

网络设备(IPv6辐)：

# local settings for Network Device
[Interface]
PrivateKey = <Network Device private key>
Address = fd00:0:0:2::1/64

# remote settings for VPS
[Peer]
PublicKey = <VPS public key>
AllowedIPs = fd00::/56
Endpoint = [2001:db8:1234:abcd::1]:51820
PersistentKeepalive = 25

副总裁(枢纽)：

# local settings for VPS
[Interface]
PrivateKey = <VPS private key>
Address = fd00:0:0:1::1/64
ListenPort = 51820

PreUp = sysctl -w net.ipv6.conf.all.forwarding=1

# remote settings for Network Device
[Peer]
PublicKey = <Network Device public key>
AllowedIPs = fd00:0:0:2::/64

# remote settings for Example Client
[Peer]
PublicKey = <Example Client public key>
AllowedIPs = fd00:0:0:3::/64

示例客户端(IPv4分支)：

# local settings for Example Client
[Interface]
PrivateKey = <Example Client private key>
Address = fd00:0:0:3::1/64

# remote settings for VPS
[Peer]
PublicKey = <VPS public key>
AllowedIPs = fd00::/56
Endpoint = 198.51.100.123:51820
PersistentKeepalive = 25

然后，您可以从网络设备访问运行在示例客户端上的then服务器，使用示例客户端的WireGuard IP地址fd00:0:0:3::1；或者从示例客户端访问SSH到网络设备，使用网络设备的WireGuard IP地址fd00:0:0:2::1。