WireGuard/RockyLinux8

[root@rockylinux8 ~]# cat /etc/redhat-release
Rocky Linux release 8.10 (Green Obsidian)
 
[root@rockylinux8 ~]# uname -r
4.18.0-553.el8_10.x86_64           <-- 8.10のkernelでそれ以降のupdateをしていないです. これが重要.
 
[root@rockylinux8 ~]# getenforce
Enforcing
 
[root@rockylinux8 ~]# mokutil --sb-state
EFI variables are not supported on this system
 
[root@rockylinux8 ~]# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp6s18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether bc:24:11:cd:3c:9f brd ff:ff:ff:ff:ff:ff
 
[root@rockylinux8 ~]# firewall-cmd --get-active-zones
public
  interfaces: enp6s18
 
[root@rockylinux8 ~]#

[root@rockylinux8 ~]# dnf install epel-release -y
 
[root@rockylinux8 ~]# dnf install wireguard-tools -y

[root@rockylinux8 ~]# dnf install elrepo-release -y
 
[root@rockylinux8 ~]# dnf install kmod-wireguard -y
 
(確認)
[root@rockylinux8 ~]# rpm -qali kmod-wireguard
Name        : kmod-wireguard
Epoch       : 9
Version     : 1.0.20220627
Release     : 7.el8_10.elrepo
Architecture: x86_64
Install Date: Wed 12 Feb 2025 03:36:31 AM JST
Group       : System Environment/Kernel
Size        : 368772
License     : GPLv2
Signature   : DSA/SHA256, Fri 24 May 2024 06:19:06 PM JST, Key ID 309bc305baadae52
Source RPM  : kmod-wireguard-1.0.20220627-7.el8_10.elrepo.src.rpm
Build Date  : Fri 24 May 2024 04:51:58 PM JST
Build Host  : Build64F39
Relocations : (not relocatable)
Packager    : Akemi Yagi <toracat@elrepo.org>
Vendor      : The ELRepo Project (https://elrepo.org)
URL         : https://git.zx2c4.com/wireguard-linux-compat/
Summary     : wireguard kernel module(s)
Description :
This package provides the wireguard kernel module(s).
It is built to depend upon the specific ABI provided by a range of releases
of the same variant of the Linux kernel and not on any one specific build.
/etc/depmod.d/kmod-wireguard.conf
/lib/modules/4.18.0-553.el8_10.x86_64
/lib/modules/4.18.0-553.el8_10.x86_64/extra
/lib/modules/4.18.0-553.el8_10.x86_64/extra/wireguard
/lib/modules/4.18.0-553.el8_10.x86_64/extra/wireguard/wireguard.ko
/usr/share/doc/kmod-wireguard-1.0.20220627
/usr/share/doc/kmod-wireguard-1.0.20220627/GPL-v2.0.txt
/usr/share/doc/kmod-wireguard-1.0.20220627/greylist.txt
 
[root@rockylinux8 ~]# uname -r
4.18.0-553.el8_10.x86_64
 
[root@rockylinux8 ~]#

[root@rockylinux8 ~]# modprobe wireguard
 
[root@rockylinux8 ~]# lsmod | grep wireguard
wireguard             217088  0
ip6_udp_tunnel         16384  1 wireguard
udp_tunnel             20480  1 wireguard
 
[root@rockylinux8 ~]#

[root@rockylinux8 ~]# cd /etc/wireguard/
 
[root@rockylinux8 wireguard]# umask 077
[root@rockylinux8 wireguard]# wg genkey > privatekey                *秘密鍵を作成
[root@rockylinux8 wireguard]# wg pubkey < privatekey > publickey    *秘密鍵から公開鍵を作成
[root@rockylinux8 wireguard]# ls -l
total 8
-rw-------. 1 root root 45 Feb 12 03:44 privatekey     *秘密鍵
-rw-------. 1 root root 45 Feb 12 03:44 publickey      *公開鍵
[root@rockylinux8 wireguard]#

[root@rockylinux8 ~]# cat /etc/wireguard/privatekey
uN9qMaFQiEZyQTD7Q8hL7QRhGKuECMWVcc9uIuXgh0w=
 
[root@rockylinux8 ~]# vi /etc/wireguard/wg0.conf
[Interface]
PrivateKey = eDRTtsNIB4xH9OKs1GxNCaEkqFd5tBqOPo4RP+y+Mkw=
Address = 10.10.10.1/32
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp6s18 -j MASQUERADE      <--- enp6s18 はnicです
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp6s18 -j MASQUERADE
 
 
# note-PC [HP EliteBook]
[Peer]
PublicKey = JPjP77zkEh9kOARtOsInnytux5RYciZuqYvrfAXbczM=
AllowedIPs = 10.10.10.10/32
 
[root@rockylinux8 ~]#

[root@rockylinux8 ~]# systemctl stop firewalld
[root@rockylinux8 ~]# systemctl disable firewalld

[root@rockylinux8 ~]# vi /etc/sysctl.conf
net.ipv4.ip_forward=1
 
[root@rockylinux8 ~]# sysctl -p
[root@rockylinux8 ~]# cat /proc/sys/net/ipv4/ip_forward
1
[root@rockylinux8 ~]#

[root@rockylinux8 ~]# wg-quick up /etc/wireguard/wg0.conf     <--「wg-quick up wg0」でも可
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.10.10.1/32 dev wg0
[#] ip link set mtu 1420 up dev wg0
 
[root@rockylinux8 ~]#
 
(確認)
[root@rockylinux8 ~]# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp6s18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether bc:24:11:cd:3c:9f brd ff:ff:ff:ff:ff:ff
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000     <--- 追加された
    link/none
 
[root@rockylinux8 ~]# ip addr show dev wg0 scope global
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none
    inet 10.10.10.1/32 scope global wg0
       valid_lft forever preferred_lft forever
 
[root@rockylinux8 ~]#

[root@rockylinux8 ~]# systemctl enable wg-quick@wg0
Created symlink /etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service → /usr/lib/systemd/system/wg-quick@.service.
 
[root@rockylinux8 ~]#