内核模块补丁
CentOS7 安装 Wireguard 前需要安装 wireGuard 模块，官方给出来了3种安装方式，任选一种即可：
系统：centos 7.x
内核要求：> 3.10 (uname -r)
### Method 1: a signed module is available as built-in to CentOS's kernel-plus:
$ sudo yum install yum-utils epel-release
$ sudo yum-config-manager --setopt=centosplus.includepkgs=kernel-plus --enablerepo=centosplus --save
$ sudo sed -e 's/^DEFAULTKERNEL=kernel$/DEFAULTKERNEL=kernel-plus/' -i /etc/sysconfig/kernel
$ sudo yum install kernel-plus wireguard-tools
$ sudo reboot### Method 2: users wishing to stick with the standard kernel may use ELRepo's pre-built module:
$ sudo yum install epel-release elrepo-release
$ sudo yum install yum-plugin-elrepo
$ sudo yum install kmod-wireguard wireguard-tools### Method 3: users running non-standard kernels may wish to use the DKMS package instead:
$ sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
$ sudo curl -o /etc/yum.repos.d/jdoss-wireguard-epel-7.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
$ sudo yum install wireguard-dkms wireguard-tools安装完成后重启服务器。
利用 docker 安装 WireGuard
version: '3.5'
services:
wireguard:
image: weejewel/wg-easy
restart: unless-stopped
ports:
- 51820:51820/udp
- 51821:51821/tcp
environment:
- WG_HOST=wg.host.com
- PASSWORD=password
# - WG_PORT=51820
# - WG_DEFAULT_ADDRESS=10.8.0.x
- WG_DEFAULT_DNS=114.114.114.114
# - WG_MTU=1420
# - WG_ALLOWED_IPS=192.168.0.0/24, 10.8.0.0/24
# - WG_PRE_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt
# - WG_POST_UP=echo "Post Up" > /etc/wireguard/post-up.txt
# - WG_PRE_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt
# - WG_POST_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt
volumes:
- ./data:/etc/wireguard
cap_add:
- NET_ADMIN
- SYS_MODULE
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.src_valid_mark=1
# 参考：https://raw.githubusercontent.com/WeeJeWel/wg-easy/master/docker-compose.yml将以上内容保存为 docker-compose.yml 文件，并执行 docker-compose up -d 启动服务。在浏览器中输入服务器地址（端口 51821 ）登录管理界面。
注意：
- 通常服务位于路由或防火墙后面，
WG_PORT是映射的外网端口，WG_HOST是外网访问地址。 WG_ALLOWED_IPS如果设为0.0.0.0，那客户端的所有流量都会走 VPN，所以应该仅设置需要代理的 IP 域。