90 lines
3.4 KiB
Bash
90 lines
3.4 KiB
Bash
#!/bin/bash
|
|
# ═══════════════════════════════════════════════════════════════════
|
|
# WireGuard Server Setup (VPS VPN)
|
|
# Install WireGuard, generate server keys, configure interface
|
|
# Network: 10.0.0.0/24
|
|
# Server IP: 10.0.0.1
|
|
# Listen: 0.0.0.0:51820/udp
|
|
# ═══════════════════════════════════════════════════════════════════
|
|
|
|
set -e
|
|
|
|
echo "[*] Setting up WireGuard Server..."
|
|
|
|
# ─── Install WireGuard ─────────────────────────────────────────
|
|
echo "[*] Installing WireGuard..."
|
|
apt-get update -qq
|
|
apt-get install -y wireguard wireguard-tools
|
|
|
|
# ─── Create key directory ──────────────────────────────────────
|
|
mkdir -p /etc/wireguard
|
|
cd /etc/wireguard
|
|
umask 077
|
|
|
|
# ─── Generate server keys ──────────────────────────────────────
|
|
if [ ! -f privatekey ]; then
|
|
echo "[*] Generating server private key..."
|
|
wg genkey > privatekey
|
|
cat privatekey | wg pubkey > publickey
|
|
echo "[✓] Keys generated"
|
|
echo ""
|
|
echo "Server Public Key:"
|
|
cat publickey
|
|
echo ""
|
|
else
|
|
echo "[!] Server keys already exist"
|
|
fi
|
|
|
|
# ─── Create wg0 configuration ──────────────────────────────────
|
|
echo "[*] Creating WireGuard interface configuration..."
|
|
|
|
cat > wg0.conf << 'EOF'
|
|
[Interface]
|
|
# Server IP dans le réseau VPN
|
|
Address = 10.0.0.1/24
|
|
ListenPort = 51820
|
|
|
|
# Charger la clé privée
|
|
PrivateKey = PRIVATE_KEY_PLACEHOLDER
|
|
|
|
# Accepter VPN traffic
|
|
PostUp = iptables -I FORWARD 1 -i %i -j ACCEPT; iptables -I FORWARD 1 -o %i -j ACCEPT; iptables -t nat -I POSTROUTING 1 -o eth0 -j MASQUERADE
|
|
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
|
|
|
|
# Peers: monitoring-uber, admins (ajouté après)
|
|
EOF
|
|
|
|
# Remplacer placeholder par clé réelle
|
|
PRIVATE_KEY=$(cat privatekey)
|
|
sed -i "s|PRIVATE_KEY_PLACEHOLDER|$PRIVATE_KEY|" wg0.conf
|
|
|
|
# ─── Enable WireGuard interface ────────────────────────────────
|
|
echo "[*] Bringing up WireGuard interface..."
|
|
ip link add dev wg0 type wireguard
|
|
ip addr add 10.0.0.1/24 dev wg0
|
|
ip link set wg0 up
|
|
wg set wg0 private-key <(cat privatekey)
|
|
wg set wg0 listen-port 51820
|
|
|
|
# ─── Enable at boot ───────────────────────────────────────────
|
|
echo "[*] Enabling WireGuard at boot..."
|
|
systemctl enable wg-quick@wg0 2>/dev/null || true
|
|
systemctl start wg-quick@wg0 2>/dev/null || true
|
|
|
|
echo ""
|
|
echo "[✓] WireGuard Server configured"
|
|
echo ""
|
|
echo "Configuration Summary:"
|
|
echo " • Interface: wg0"
|
|
echo " • Server IP: 10.0.0.1/24"
|
|
echo " • Listen: 0.0.0.0:51820/udp"
|
|
echo " • Config: /etc/wireguard/wg0.conf"
|
|
echo ""
|
|
echo "Server Public Key (for clients):"
|
|
cat publickey
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo " 1. Create client configs with wg-quick or manually"
|
|
echo " 2. Add peers to wg0:"
|
|
echo " wg set wg0 peer <CLIENT_PUBKEY> allowed-ips 10.0.0.X/32"
|