(так консоль сервера становится доступной только одному пользователю),
[Interface]
PrivateKey = <VPN_SERVER_PRIVATE_KEY>
Address = 10.8.0.1/24
ListenPort = 51820
[Peer]
PublicKey = <CLIENT2_PUBLIC_KEY>
AllowedIPs = 10.8.0.2/32, 192.168.10.0/24 ## маршруты сами прописываются в таблицу маршрутизации сервера
[Peer]
PublicKey = <CLIENT3_PUBLIC_KEY>
AllowedIPs = 10.8.0.3/32, 192.168.88.0/24 ## маршруты сами прописываются в таблицу маршрутизации сервера
## Forward
sudo sysctl -w net.ipv4.ip_forward=1
## Firewall
sudo iptables -A FORWARD -i wg0 -j ACCEPT
sudo iptables -A FORWARD -o wg0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o enp3s0 -j MASQUERADE
## Публикуем порт и прокидываем его на сервер в локальной сети за Клиент 2 через VPN
iptables -t nat -A PREROUTING -i enp3s0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.10.10:80[Interface]
Address = 10.8.0.2/32
PrivateKey = <CLIENT2_PRIVATE_KEY>
Table = 100
PostUp = ip rule add from 10.8.0.2 table 100; ip route add 192.168.88.0/24 dev wg0; ip route add 10.8.0.0/24 dev wg0; ip rule add fwmark 1/3 table 100
PostDown = ip rule del from 10.8.0.2 table 100; ip route del 192.168.88.0/24 dev wg0; ip route del 10.8.0.0/24 dev wg0; ip rule del fwmark 1/3 table 100
[Peer]
AllowedIPs = 0.0.0.0/0
PublicKey = <VPN_SERVER_PUBLIC_KEY>
Endpoint = <VPN_SERVER_IP>:51820
## Forward
sudo sysctl -w net.ipv4.ip_forward=1
## Firewall
sudo iptables -A FORWARD -i wg0 -j ACCEPT
sudo iptables -A FORWARD -o wg0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE
## Вот эта строчка маркирует ответ от веб сервера, а потом на него
## применяется правило (ip rule add fwmark 1/3 table 100) и пакет попадает в таблицу 100 и
## при такой конфигурации будет виден реальный IP клиента.
## При этом сервер 192.168.10.10 в интернет будет выходить через gw (Клиент 2),
## а ответы отправлять в VPN.
iptables -t mangle -A PREROUTING -i wg0 -m conntrack --ctstate NEW -j CONNMARK --set-xmark 0x1/0x3
iptables -t mangle -A PREROUTING -i enp3s0 -m connmark ! --mark 0x0/0x3 -j CONNMARK --restore-mark --nfmask 0x3 --ctmask 0x3[Interface]
Address = 10.8.0.3/32
PrivateKey = <CLIENT3_PRIVATE_KEY>
Table = 100
PostUp = ip rule add from 10.8.0.3 table 100; ip route add 192.168.10.0/24 dev wg0; ip route add 10.8.0.0/24 dev wg0; ip rule add fwmark 1/3 table 100
PostDown = ip rule del from 10.8.0.3 table 100; ip route del 192.168.10.0/24 dev wg0; ip route del 10.8.0.0/24 dev wg0; ip rule del fwmark 1/3 table 100
[Peer]
AllowedIPs = 0.0.0.0/0
PublicKey = <VPN_SERVER_PUBLIC_KEY>
Endpoint = <VPN_SERVER_IP>:51820
## Forward
sudo sysctl -w net.ipv4.ip_forward=1
## Firewall
sudo iptables -A FORWARD -i wg0 -j ACCEPT
sudo iptables -A FORWARD -o wg0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADEversion: "3"
services:
traefik:
image: "traefik:v2.10"
container_name: "traefik"
command:
#- "--log.level=DEBUG"
- "--api.insecure=true"
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.myresolver.acme.httpchallenge=true"
- "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
#- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.myresolver.acme.email=MYEMAIL@gmail.com"
- "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
ports:
- "80:80"
- "443:443"
# - "8080:8080"
volumes:
- "./letsencrypt:/letsencrypt"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
networks:
private_network:
ipv4_address: 10.2.0.120
unbound:
image: "mvance/unbound:1.17.0"
container_name: unbound
restart: unless-stopped
hostname: "unbound"
volumes:
- "./unbound:/opt/unbound/etc/unbound/"
networks:
private_network:
ipv4_address: 10.2.0.200
wg-easy:
depends_on: [unbound, adguardhome]
environment:
- WG_HOST=MYHOST_IP
- PASSWORD=openode
- WG_PORT=51820
- WG_DEFAULT_ADDRESS=10.10.10.x
- WG_DEFAULT_DNS=10.2.0.100
- WG_ALLOWED_IPS=10.2.0.0/24, 0.0.0.0/0, ::/0
- WG_PERSISTENT_KEEPALIVE=25
- WG_MTU=1280
#image: ditek/wg-easy
image: weejewel/wg-easy
container_name: wg-easy
volumes:
- .:/etc/wireguard
ports:
- "51820:51820/udp"
# - "51821:51821/tcp"
restart: unless-stopped
cap_add:
- NET_ADMIN
- SYS_MODULE
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
dns:
- 10.2.0.100
- 10.2.0.200
networks:
private_network:
ipv4_address: 10.2.0.3
labels:
- "traefik.enable=true"
- "traefik.http.routers.vpn.rule=Host(`vpn.site.com`)"
- "traefik.http.routers.vpn.entrypoints=websecure"
- 'traefik.http.routers.vpn.tls=true'
- "traefik.http.routers.vpn.tls.certresolver=myresolver"
- "traefik.http.services.vpn.loadbalancer.server.port=51821"
adguardhome:
depends_on: [unbound]
image: adguard/adguardhome
container_name: adguardhome
restart: unless-stopped
environment:
- TZ=America/Los_Angeles
volumes:
- ./work:/opt/adguardhome/work
- ./conf:/opt/adguardhome/conf
networks:
private_network:
ipv4_address: 10.2.0.100
networks:
private_network:
ipam:
driver: default
config:
- subnet: 10.2.0.0/24$TTL 604800
lra-lx1.local IN SOA ns.lra-lx1.local. (
202301022 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
A 192.168.1.10 ; delete this line
MX 50 mx.lra-lx1.local.
CAA 128 issue "sectigo.com"
TXT "v=spf1 a mx -all"
$ORIGIN example.com.
ns IN A 192.168.1.20
mx IN A 192.168.1.30server:
verbosity: 1
interface: 0.0.0.0
do-ip4: yes
access-control: 0.0.0.0/0 allow
chroot: ""
hide-version: yes
key-cache-size: 0
cache-max-ttl: 0
private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
private-address: 192.168.0.0/16
private-domain: "site.com"
local-zone: "10.in-addr.arpa." nodefault
local-zone: "16.172.in-addr.arpa." nodefault
local-zone: "168.192.in-addr.arpa." nodefault
local-data: "ntp.site.com IN A 10.10.10.1"
## Если нет записи в local-data то дальше резолвим домены site.com на 1.1.1.1
forward-zone:
name: "site.com"
forward-addr: 1.1.1.1
## Все остальное резолвим на 1.1.1.1
forward-zone:
name: "."
forward-addr: 1.1.1.1