# 安装 WireGuard
apt install -y wireguard

# 开启流量转发
echo 'net.ipv4.ip_forward = 1' | tee -a /etc/sysctl.conf
sysctl -p

# 进入配置存储路径，调整目录权限
chmod 700 /etc/wireguard
cd /etc/wireguard

wg genkey | tee server.key | wg pubkey > server.key.pub

# 生成 client1 公钥私钥
wg genkey | tee client1.key | wg pubkey > client1.key.pub

echo "
[Interface]
PrivateKey = $(cat server.key)
Address = 10.0.0.1/24
ListenPort = 51820

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
# 注意：eth0 需要为本机物理网卡名称

[Peer]
PublicKey = $(cat client1.key.pub)
AllowedIPs = 10.0.0.2/32" > wg0.conf

# 生成 client2 公钥私钥
wg genkey | tee client2.key | wg pubkey > client2.key.pub

# 追加到 wg0.conf 配置
echo "
[Peer]
PublicKey = $(cat client2.key.pub)
AllowedIPs = 10.0.0.3/32" >> wg0.conf

systemctl enable wg-quick@wg0.service

# 启动 wg0
wg-quick up wg0

# 关闭 wg0
wg-quick down wg0

echo "
[Interface]
PrivateKey = $(cat client1.key)
Address = 10.0.0.2/24
DNS = 119.29.29.29

[Peer]
PublicKey = $(cat server.key.pub)
AllowedIPs = 10.0.0.0/24
Endpoint = 公网IP:51820
PersistentKeepalive = 30" > client1.conf