29. 用户管理
29.1 添加新用户
29.1.1 生成密钥对
为新用户生成密钥：
#!/bin/bash
# generate-client-keys.sh
USERNAME=$1
if [ -z "$USERNAME" ]; then
echo "用法: $0 <用户名>"
exit 1
fi
# 创建密钥目录
KEYS_DIR="/etc/wireguard/clients"
sudo mkdir -p $KEYS_DIR
# 生成密钥对
CLIENT_PRIVATE=$(wg genkey)
CLIENT_PUBLIC=$(echo $CLIENT_PRIVATE | wg pubkey)
# 保存到文件
echo $CLIENT_PRIVATE | sudo tee $KEYS_DIR/${USERNAME}_private.key > /dev/null
echo $CLIENT_PUBLIC | sudo tee $KEYS_DIR/${USERNAME}_public.key > /dev/null
# 设置权限
sudo chmod 600 $KEYS_DIR/${USERNAME}_private.key
sudo chmod 644 $KEYS_DIR/${USERNAME}_public.key
echo "✓ 密钥已生成"
echo "私钥: $CLIENT_PRIVATE"
echo "公钥: $CLIENT_PUBLIC"
echo ""
echo "私钥文件: $KEYS_DIR/${USERNAME}_private.key"
echo "公钥文件: $KEYS_DIR/${USERNAME}_public.key"
使用方法：
sudo bash generate-client-keys.sh user3
29.1.2 分配IP地址
自动分配IP脚本：
#!/bin/bash
# allocate-ip.sh
CONFIG_FILE="/etc/wireguard/wg0.conf"
# 查找已使用的IP
find_next_ip() {
local used_ips=$(sudo grep "AllowedIPs" $CONFIG_FILE | \
grep -oP '10\.8\.0\.\d+' | \
sort -t. -k4 -n | \
tail -1)
if [ -z "$used_ips" ]; then
echo "10.8.0.2" # 首个客户端IP
else
local last_octet=$(echo $used_ips | cut -d. -f4)
local next_octet=$((last_octet + 1))
if [ $next_octet -gt 254 ]; then
echo "错误: IP地址池已满" >&2
return 1
fi
echo "10.8.0.$next_octet"
fi
}
# 使用
NEXT_IP=$(find_next_ip)
echo "下一个可用IP: $NEXT_IP"
29.1.3 修改服务器配置
添加peer到配置文件：
#!/bin/bash
# add-peer.sh
USERNAME=$1
CLIENT_PUBLIC=$2
CLIENT_IP=$3
if [ -z "$USERNAME" ] || [ -z "$CLIENT_PUBLIC" ] || [ -z "$CLIENT_IP" ]; then
echo "用法: $0 <用户名> <公钥> <IP地址>"
exit 1
fi
CONFIG_FILE="/etc/wireguard/wg0.conf"
# 备份配置
sudo cp $CONFIG_FILE ${CONFIG_FILE}.bak
# 添加peer
cat << EOF | sudo tee -a $CONFIG_FILE
# 用户: $USERNAME
# 添加日期: $(date +%Y-%m-%d)
[Peer]
PublicKey = $CLIENT_PUBLIC
AllowedIPs = $CLIENT_IP/32
EOF
echo "✓ Peer已添加到配置文件"
echo "备份: ${CONFIG_FILE}.bak"
重新加载配置：
# 不断开现有连接
sudo wg syncconf wg0 <(wg-quick strip wg0)
# 验证
sudo wg show wg0
29.1.4 生成客户端配置
创建客户端配置文件：
#!/bin/bash
# generate-client-config.sh
USERNAME=$1
CLIENT_PRIVATE=$2
CLIENT_IP=$3
SERVER_PUBLIC=$4
SERVER_ENDPOINT=$5
if [ -z "$USERNAME" ]; then
echo "用法: $0 <用户名> <客户端私钥> <客户端IP> <服务器公钥> <服务器端点>"
exit 1
fi
CONFIG_DIR="/etc/wireguard/clients"
sudo mkdir -p $CONFIG_DIR
CLIENT_CONFIG="$CONFIG_DIR/${USERNAME}.conf"
cat << EOF | sudo tee $CLIENT_CONFIG
[Interface]
PrivateKey = $CLIENT_PRIVATE
Address = $CLIENT_IP/24
DNS = 223.5.5.5, 114.114.114.114
[Peer]
PublicKey = $SERVER_PUBLIC
Endpoint = $SERVER_ENDPOINT
AllowedIPs = 10.8.0.0/24
PersistentKeepalive = 25
EOF
sudo chmod 600 $CLIENT_CONFIG
echo "✓ 客户端配置已生成: $CLIENT_CONFIG"
echo ""
echo "配置内容:"
cat $CLIENT_CONFIG
29.1.5 完整添加用户流程
一键添加用户脚本：
#!/bin/bash
# add-wireguard-user.sh
set -e
USERNAME=$1
if [ -z "$USERNAME" ]; then
echo "用法: $0 <用户名>"
exit 1
fi
# 配置
SERVER_PUBLIC="rUEB9pR7DO7qgkbo6Ylerrh/Fvl1XA8RJuALBdlkFkk="
SERVER_ENDPOINT="192.168.1.66:51820"
CONFIG_FILE="/etc/wireguard/wg0.conf"
KEYS_DIR="/etc/wireguard/clients"
CLIENT_CONFIG_DIR="/etc/wireguard/clients"
echo "=== 添加WireGuard用户: $USERNAME ==="
# 1. 生成密钥对
echo ""
echo "[1] 生成密钥对..."
sudo mkdir -p $KEYS_DIR
CLIENT_PRIVATE=$(wg genkey)
CLIENT_PUBLIC=$(echo $CLIENT_PRIVATE | wg pubkey)
echo $CLIENT_PRIVATE | sudo tee $KEYS_DIR/${USERNAME}_private.key > /dev/null
echo $CLIENT_PUBLIC | sudo tee $KEYS_DIR/${USERNAME}_public.key > /dev/null
sudo chmod 600 $KEYS_DIR/${USERNAME}_private.key
echo "✓ 密钥已生成"
# 2. 分配IP地址
echo ""
echo "[2] 分配IP地址..."
LAST_IP=$(sudo grep "AllowedIPs" $CONFIG_FILE | grep -oP '10\.8\.0\.\d+' | sort -t. -k4 -n | tail -1)
if [ -z "$LAST_IP" ]; then
CLIENT_IP="10.8.0.2"
else
LAST_OCTET=$(echo $LAST_IP | cut -d. -f4)
NEXT_OCTET=$((LAST_OCTET + 1))
CLIENT_IP="10.8.0.$NEXT_OCTET"
fi
echo "✓ 分配IP: $CLIENT_IP"
# 3. 添加到服务器配置
echo ""
echo "[3] 更新服务器配置..."
sudo cp $CONFIG_FILE ${CONFIG_FILE}.bak
cat << EOF | sudo tee -a $CONFIG_FILE
# 用户: $USERNAME
# 添加日期: $(date +%Y-%m-%d)
# IP地址: $CLIENT_IP
[Peer]
PublicKey = $CLIENT_PUBLIC
AllowedIPs = $CLIENT_IP/32
EOF
echo "✓ 服务器配置已更新"
# 4. 重新加载配置
echo ""
echo "[4] 重新加载WireGuard配置..."
sudo wg syncconf wg0 <(wg-quick strip wg0)
echo "✓ 配置已重新加载"
# 5. 生成客户端配置
echo ""
echo "[5] 生成客户端配置..."
sudo mkdir -p $CLIENT_CONFIG_DIR
CLIENT_CONFIG="$CLIENT_CONFIG_DIR/${USERNAME}.conf"
cat << EOF | sudo tee $CLIENT_CONFIG
[Interface]
PrivateKey = $CLIENT_PRIVATE
Address = $CLIENT_IP/24
DNS = 223.5.5.5, 114.114.114.114
[Peer]
PublicKey = $SERVER_PUBLIC
Endpoint = $SERVER_ENDPOINT
AllowedIPs = 10.8.0.0/24
PersistentKeepalive = 25
EOF
sudo chmod 600 $CLIENT_CONFIG
echo "✓ 客户端配置已生成: $CLIENT_CONFIG"
# 6. 生成QR码（如果安装了qrencode）
if command -v qrencode &> /dev/null; then
echo ""
echo "[6] 生成QR码..."
sudo qrencode -t ANSIUTF8 < $CLIENT_CONFIG
echo ""
echo "QR码图片: $CLIENT_CONFIG_DIR/${USERNAME}_qr.png"
sudo qrencode -o $CLIENT_CONFIG_DIR/${USERNAME}_qr.png < $CLIENT_CONFIG
fi
# 7. 显示摘要
echo ""
echo "=== 添加完成 ==="
echo "用户名: $USERNAME"
echo "IP地址: $CLIENT_IP"
echo "公钥: ${CLIENT_PUBLIC:0:20}..."
echo "配置文件: $CLIENT_CONFIG"
echo ""
echo "发送给用户的配置文件:"
echo "----------------------------------------"
cat $CLIENT_CONFIG
echo "----------------------------------------"
使用方法：
sudo bash add-wireguard-user.sh alice
29.2 删除用户
29.2.1 从配置文件删除
手动删除：
# 1. 备份配置
sudo cp /etc/wireguard/wg0.conf /etc/wireguard/wg0.conf.bak
# 2. 编辑配置文件
sudo nano /etc/wireguard/wg0.conf
# 删除对应的[Peer]段
# 保存并退出
# 3. 重新加载
sudo wg syncconf wg0 <(wg-quick strip wg0)
脚本删除：
#!/bin/bash
# remove-wireguard-user.sh
USERNAME=$1
if [ -z "$USERNAME" ]; then
echo "用法: $0 <用户名>"
exit 1
fi
CONFIG_FILE="/etc/wireguard/wg0.conf"
KEYS_DIR="/etc/wireguard/clients"
echo "=== 删除WireGuard用户: $USERNAME ==="
# 1. 查找用户的公钥
echo ""
echo "[1] 查找用户信息..."
if [ -f "$KEYS_DIR/${USERNAME}_public.key" ]; then
CLIENT_PUBLIC=$(cat $KEYS_DIR/${USERNAME}_public.key)
echo "✓ 找到公钥: ${CLIENT_PUBLIC:0:20}..."
else
echo "✗ 未找到用户密钥文件"
exit 1
fi
# 2. 备份配置
echo ""
echo "[2] 备份配置文件..."
sudo cp $CONFIG_FILE ${CONFIG_FILE}.bak.$(date +%Y%m%d_%H%M%S)
echo "✓ 配置已备份"
# 3. 从运行时删除peer
echo ""
echo "[3] 从运行时配置删除peer..."
sudo wg set wg0 peer $CLIENT_PUBLIC remove
echo "✓ Peer已从运行时删除"
# 4. 从配置文件删除
echo ""
echo "[4] 从配置文件删除..."
# 使用sed删除peer段（从注释到下一个空行或文件结束）
sudo sed -i "/# 用户: $USERNAME/,/^$/d" $CONFIG_FILE
# 或使用awk
# sudo awk -v user="$USERNAME" '
# /# 用户:/ {skip = ($3 == user)}
# !skip
# /^$/ {skip = 0}
# ' $CONFIG_FILE | sudo tee ${CONFIG_FILE}.tmp > /dev/null
# sudo mv ${CONFIG_FILE}.tmp $CONFIG_FILE
echo "✓ 配置文件已更新"
# 5. 删除密钥文件
echo ""
echo "[5] 删除密钥文件..."
sudo rm -f $KEYS_DIR/${USERNAME}_private.key
sudo rm -f $KEYS_DIR/${USERNAME}_public.key
sudo rm -f $KEYS_DIR/${USERNAME}.conf
sudo rm -f $KEYS_DIR/${USERNAME}_qr.png
echo "✓ 密钥文件已删除"
# 6. 验证
echo ""
echo "[6] 验证删除..."
if sudo wg show wg0 peers | grep -q "$CLIENT_PUBLIC"; then
echo "✗ Peer仍在运行时配置中"
else
echo "✓ Peer已完全删除"
fi
echo ""
echo "=== 删除完成 ==="
echo "备份文件: ${CONFIG_FILE}.bak.$(date +%Y%m%d)_*"
29.2.2 临时禁用用户
不删除配置，仅禁用：
#!/bin/bash
# disable-wireguard-user.sh
USERNAME=$1
if [ -z "$USERNAME" ]; then
echo "用法: $0 <用户名>"
exit 1
fi
CONFIG_FILE="/etc/wireguard/wg0.conf"
KEYS_DIR="/etc/wireguard/clients"
# 获取公钥
CLIENT_PUBLIC=$(cat $KEYS_DIR/${USERNAME}_public.key)
# 从运行时删除（但保留配置文件）
sudo wg set wg0 peer $CLIENT_PUBLIC remove
# 在配置文件中注释掉
sudo sed -i "/# 用户: $USERNAME/,/^$/s/^/# DISABLED: /" $CONFIG_FILE
echo "✓ 用户 $USERNAME 已禁用"
echo "要重新启用，运行: enable-wireguard-user.sh $USERNAME"
重新启用：
#!/bin/bash
# enable-wireguard-user.sh
USERNAME=$1
CONFIG_FILE="/etc/wireguard/wg0.conf"
# 取消注释
sudo sed -i "/# 用户: $USERNAME/,/^$/s/^# DISABLED: //" $CONFIG_FILE
# 重新加载
sudo wg syncconf wg0 <(wg-quick strip wg0)
echo "✓ 用户 $USERNAME 已启用"
29.3 修改用户权限
29.3.1 修改AllowedIPs
限制访问范围：
# 仅允许访问VPN网段
AllowedIPs = 10.8.0.0/24
# 允许访问VPN和特定内网段
AllowedIPs = 10.8.0.0/24, 192.168.1.0/24
# 仅允许访问特定服务器
AllowedIPs = 10.8.0.1/32, 192.168.1.100/32
修改脚本：
#!/bin/bash
# modify-user-allowedips.sh
USERNAME=$1
NEW_ALLOWED_IPS=$2
if [ -z "$USERNAME" ] || [ -z "$NEW_ALLOWED_IPS" ]; then
echo "用法: $0 <用户名> <AllowedIPs>"
echo "示例: $0 alice '10.8.0.0/24, 192.168.1.0/24'"
exit 1
fi
CONFIG_FILE="/etc/wireguard/wg0.conf"
KEYS_DIR="/etc/wireguard/clients"
# 获取公钥
CLIENT_PUBLIC=$(cat $KEYS_DIR/${USERNAME}_public.key)
# 备份配置
sudo cp $CONFIG_FILE ${CONFIG_FILE}.bak
# 修改AllowedIPs
sudo sed -i "/PublicKey = $CLIENT_PUBLIC/,/^$/s/AllowedIPs = .*/AllowedIPs = $NEW_ALLOWED_IPS/" $CONFIG_FILE
# 重新加载
sudo wg syncconf wg0 <(wg-quick strip wg0)
echo "✓ 用户 $USERNAME 的AllowedIPs已更新为: $NEW_ALLOWED_IPS"
29.3.2 带宽限制
使用tc限制带宽：
#!/bin/bash
# limit-user-bandwidth.sh
CLIENT_IP=$1
UPLOAD_LIMIT=$2 # Kbps
DOWNLOAD_LIMIT=$3 # Kbps
if [ -z "$CLIENT_IP" ] || [ -z "$UPLOAD_LIMIT" ] || [ -z "$DOWNLOAD_LIMIT" ]; then
echo "用法: $0 <客户端IP> <上传限制Kbps> <下载限制Kbps>"
echo "示例: $0 10.8.0.2 1024 2048"
exit 1
fi
# 删除现有规则
sudo tc qdisc del dev wg0 root 2>/dev/null
# 创建HTB队列
sudo tc qdisc add dev wg0 root handle 1: htb default 10
# 总带宽
sudo tc class add dev wg0 parent 1: classid 1:1 htb rate 100mbit
# 为特定IP创建类
sudo tc class add dev wg0 parent 1:1 classid 1:10 htb rate ${DOWNLOAD_LIMIT}kbit ceil ${DOWNLOAD_LIMIT}kbit
# 添加过滤器
sudo tc filter add dev wg0 protocol ip parent 1:0 prio 1 u32 match ip dst $CLIENT_IP flowid 1:10
echo "✓ 带宽限制已设置"
echo " 客户端: $CLIENT_IP"
echo " 下载限制: ${DOWNLOAD_LIMIT}Kbps"
29.3.3 时间限制
限制访问时间：
#!/bin/bash
# time-based-access.sh
USERNAME=$1
START_TIME=$2 # HH:MM
END_TIME=$3 # HH:MM
if [ -z "$USERNAME" ] || [ -z "$START_TIME" ] || [ -z "$END_TIME" ]; then
echo "用法: $0 <用户名> <开始时间> <结束时间>"
echo "示例: $0 alice 09:00 18:00"
exit 1
fi
KEYS_DIR="/etc/wireguard/clients"
CLIENT_PUBLIC=$(cat $KEYS_DIR/${USERNAME}_public.key)
# 创建cron任务
# 启用
echo "0 9 * * * wg set wg0 peer $CLIENT_PUBLIC allowed-ips 10.8.0.0/24" | sudo crontab -
# 禁用
echo "0 18 * * * wg set wg0 peer $CLIENT_PUBLIC remove" | sudo crontab -
echo "✓ 时间限制已设置: $START_TIME - $END_TIME"
29.4 查看在线用户
29.4.1 基本查看
查看所有peer：
# 简单列表
sudo wg show wg0 peers
# 详细信息
sudo wg show wg0
# 仅在线用户（最近握手<3分钟）
sudo wg show wg0 latest-handshakes | awk -v now=$(date +%s) '$2 > now - 180'
29.4.2 格式化输出
美化显示脚本：
#!/bin/bash
# show-online-users.sh
echo "=== WireGuard在线用户 ==="
echo ""
printf "%-15s %-20s %-15s %-20s %-15s\n" "用户名" "公钥" "IP地址" "最后握手" "流量"
echo "--------------------------------------------------------------------------------"
# 读取peer信息
sudo wg show wg0 dump | tail -n +2 | while IFS=$'\t' read -r pubkey psk endpoint allowed_ips handshake rx tx keepalive; do
# 查找用户名
username=$(grep -r "$pubkey" /etc/wireguard/clients/*.key 2>/dev/null | grep public | sed 's/.*\/\(.*\)_public.key.*/\1/')
if [ -z "$username" ]; then
username="unknown"
fi
# 提取IP
ip=$(echo $allowed_ips | cut -d'/' -f1)
# 计算握手时间
if [ "$handshake" != "0" ]; then
now=$(date +%s)
age=$((now - handshake))
if [ $age -lt 60 ]; then
handshake_str="${age}秒前"
elif [ $age -lt 3600 ]; then
handshake_str="$((age / 60))分钟前"
else
handshake_str="$((age / 3600))小时前"
fi
else
handshake_str="从未"
fi
# 格式化流量
rx_mb=$((rx / 1048576))
tx_mb=$((tx / 1048576))
traffic="${rx_mb}MB↓ ${tx_mb}MB↑"
printf "%-15s %-20s %-15s %-20s %-15s\n" \
"$username" "${pubkey:0:17}..." "$ip" "$handshake_str" "$traffic"
done
29.4.3 实时监控
监控连接状态：
#!/bin/bash
# monitor-connections.sh
while true; do
clear
echo "=== WireGuard实时监控 ==="
echo "时间: $(date '+%Y-%m-%d %H:%M:%S')"
echo ""
# 统计
total_peers=$(sudo wg show wg0 peers | wc -l)
online_peers=$(sudo wg show wg0 latest-handshakes | awk -v now=$(date +%s) '$2 > now - 180' | wc -l)
echo "总peer数: $total_peers"
echo "在线peer: $online_peers"
echo ""
# 详细列表
echo "在线用户:"
sudo wg show wg0 | grep -A 6 "peer:"
sleep 5
done
29.4.4 导出用户列表
生成报告：
#!/bin/bash
# export-user-list.sh
OUTPUT_FILE="/tmp/wireguard-users-$(date +%Y%m%d).csv"
echo "用户名,公钥,IP地址,最后握手,接收流量,发送流量,状态" > $OUTPUT_FILE
sudo wg show wg0 dump | tail -n +2 | while IFS=$'\t' read -r pubkey psk endpoint allowed_ips handshake rx tx keepalive; do
username=$(grep -r "$pubkey" /etc/wireguard/clients/*.key 2>/dev/null | grep public | sed 's/.*\/\(.*\)_public.key.*/\1/')
if [ -z "$username" ]; then
username="unknown"
fi
ip=$(echo $allowed_ips | cut -d'/' -f1)
# 状态判断
now=$(date +%s)
if [ "$handshake" != "0" ] && [ $((now - handshake)) -lt 180 ]; then
status="在线"
else
status="离线"
fi
echo "$username,$pubkey,$ip,$handshake,$rx,$tx,$status" >> $OUTPUT_FILE
done
echo "✓ 用户列表已导出: $OUTPUT_FILE"
30. 日常维护
30.1 监控检查项
30.1.1 每日检查清单
服务状态检查：
#!/bin/bash
# daily-check.sh
echo "=== WireGuard每日检查 ==="
echo "日期: $(date '+%Y-%m-%d %H:%M:%S')"
echo ""
# 1. 服务状态
echo "[1] 服务状态"
if systemctl is-active --quiet wg-quick@wg0; then
echo "✓ WireGuard服务运行中"
else
echo "✗ WireGuard服务已停止"
fi
# 2. 接口状态
echo ""
echo "[2] 接口状态"
if ip link show wg0 &> /dev/null; then
echo "✓ wg0接口存在"
# 检查接口是否UP
if ip link show wg0 | grep -q "UP"; then
echo "✓ wg0接口已启动"
else
echo "✗ wg0接口未启动"
fi
else
echo "✗ wg0接口不存在"
fi
# 3. 监听端口
echo ""
echo "[3] 监听端口"
if sudo ss -ulnp | grep -q :51820; then
echo "✓ 51820端口正在监听"
else
echo "✗ 51820端口未监听"
fi
# 4. Peer连接
echo ""
echo "[4] Peer连接"
total_peers=$(sudo wg show wg0 peers 2>/dev/null | wc -l)
online_peers=$(sudo wg show wg0 latest-handshakes 2>/dev/null | awk -v now=$(date +%s) '$2 > now - 300' | wc -l)
echo "总Peer数: $total_peers"
echo "在线Peer: $online_peers"
# 5. 错误日志
echo ""
echo "[5] 错误日志（最近24小时）"
error_count=$(sudo journalctl -u wg-quick@wg0 --since "24 hours ago" -p err | wc -l)
echo "错误数量: $error_count"
if [ $error_count -gt 0 ]; then
echo "最近错误:"
sudo journalctl -u wg-quick@wg0 --since "24 hours ago" -p err -n 5 --no-pager
fi
# 6. 磁盘空间
echo ""
echo "[6] 磁盘空间"
disk_usage=$(df -h / | awk 'NR==2 {print $5}' | sed 's/%//')
if [ $disk_usage -gt 80 ]; then
echo "⚠ 警告: 磁盘使用率 ${disk_usage}%"
else
echo "✓ 磁盘使用率 ${disk_usage}%"
fi
# 7. 内存使用
echo ""
echo "[7] 内存使用"
mem_usage=$(free | awk 'NR==2 {printf "%.0f", $3/$2 * 100}')
if [ $mem_usage -gt 90 ]; then
echo "⚠ 警告: 内存使用率 ${mem_usage}%"
else
echo "✓ 内存使用率 ${mem_usage}%"
fi
# 8. 连通性测试
echo ""
echo "[8] 连通性测试"
if ping -c 1 -W 2 8.8.8.8 &> /dev/null; then
echo "✓ 互联网连接正常"
else
echo "✗ 互联网连接异常"
fi
echo ""
echo "=== 检查完成 ==="
定时任务：
# 添加到crontab
crontab -e
# 每天早上9点执行
0 9 * * * /usr/local/bin/daily-check.sh | mail -s "WireGuard每日检查报告" [email protected]
30.1.2 性能监控
监控脚本：
#!/bin/bash
# performance-monitor.sh
LOG_FILE="/var/log/wireguard-performance.log"
# 记录时间戳
echo "=== $(date '+%Y-%m-%d %H:%M:%S') ===" >> $LOG_FILE
# CPU使用率
cpu_usage=$(top -bn1 | grep "Cpu(s)" | awk '{print $2}' | sed 's/%us,//')
echo "CPU使用率: ${cpu_usage}%" >> $LOG_FILE
# 内存使用
mem_usage=$(free | awk 'NR==2 {printf "%.2f", $3/$2 * 100}')
echo "内存使用率: ${mem_usage}%" >> $LOG_FILE
# 网络流量
rx_bytes=$(cat /sys/class/net/wg0/statistics/rx_bytes)
tx_bytes=$(cat /sys/class/net/wg0/statistics/tx_bytes)
echo "接收流量: $((rx_bytes / 1048576)) MB" >> $LOG_FILE
echo "发送流量: $((tx_bytes / 1048576)) MB" >> $LOG_FILE
# Peer数量
peer_count=$(sudo wg show wg0 peers | wc -l)
echo "Peer数量: $peer_count" >> $LOG_FILE
# 平均延迟（如果有在线peer）
if [ $peer_count -gt 0 ]; then
# 获取第一个peer的IP
first_peer_ip=$(sudo wg show wg0 allowed-ips | head -1 | awk '{print $2}' | cut -d'/' -f1)
if [ -n "$first_peer_ip" ]; then
latency=$(ping -c 5 -W 2 $first_peer_ip 2>/dev/null | grep "avg" | awk -F'/' '{print $5}')
if [ -n "$latency" ]; then
echo "平均延迟: ${latency}ms" >> $LOG_FILE
fi
fi
fi
echo "" >> $LOG_FILE
定时执行：
# 每5分钟执行一次
*/5 * * * * /usr/local/bin/performance-monitor.sh
30.2 日志轮转配置
30.2.1 配置logrotate
创建配置文件：
sudo nano /etc/logrotate.d/wireguard
内容：
/var/log/wireguard*.log {
daily
rotate 7
compress
delaycompress
missingok
notifempty
create 0640 root root
sharedscripts
postrotate
# 重新打开日志文件（如果需要）
systemctl reload wg-quick@wg0 > /dev/null 2>&1 || true
endscript
}
参数说明：
daily: 每天轮转rotate 7: 保留7天的日志compress: 压缩旧日志delaycompress: 延迟一天再压缩missingok: 日志文件不存在不报错notifempty: 空文件不轮转create 0640 root root: 创建新日志文件的权限
测试配置：
# 测试logrotate配置
sudo logrotate -d /etc/logrotate.d/wireguard
# 强制执行轮转
sudo logrotate -f /etc/logrotate.d/wireguard
30.2.2 systemd日志管理
配置journald：
sudo nano /etc/systemd/journald.conf
内容：
[Journal]
# 最大占用空间
SystemMaxUse=1G
# 保留时间
MaxRetentionSec=1month
# 单个日志文件大小
SystemMaxFileSize=100M
应用配置：
sudo systemctl restart systemd-journald
清理旧日志：
# 清理7天前的日志
sudo journalctl --vacuum-time=7d
# 限制日志大小到1GB
sudo journalctl --vacuum-size=1G
# 清理特定服务的日志
sudo journalctl --vacuum-time=7d -u wg-quick@wg0
30.3 定期检查清单
30.3.1 每周检查
每周维护脚本：
#!/bin/bash
# weekly-maintenance.sh
echo "=== WireGuard每周维护 ==="
echo "日期: $(date '+%Y-%m-%d')"
echo ""
# 1. 更新系统
echo "[1] 检查系统更新"
sudo apt update
updates=$(apt list --upgradable 2>/dev/null | grep -c upgradable)
echo "可用更新: $updates 个"
if [ $updates -gt 0 ]; then
echo "⚠ 建议更新系统"
fi
# 2. 检查WireGuard版本
echo ""
echo "[2] WireGuard版本"
wg --version
# 3. 配置备份
echo ""
echo "[3] 备份配置文件"
BACKUP_DIR="/var/backups/wireguard"
sudo mkdir -p $BACKUP_DIR
backup_file="$BACKUP_DIR/wg-backup-$(date +%Y%m%d).tar.gz"
sudo tar czf $backup_file /etc/wireguard/
echo "✓ 配置已备份: $backup_file"
# 4. 清理旧备份（保留30天）
echo ""
echo "[4] 清理旧备份"
find $BACKUP_DIR -name "wg-backup-*.tar.gz" -mtime +30 -delete
remaining=$(find $BACKUP_DIR -name "wg-backup-*.tar.gz" | wc -l)
echo "✓ 保留 $remaining 个备份文件"
# 5. 检查证书过期（如果使用）
echo ""
echo "[5] 密钥检查"
key_age_days=$((($(date +%s) - $(stat -c %Y /etc/wireguard/server_private.key)) / 86400))
echo "密钥年龄: $key_age_days 天"
if [ $key_age_days -gt 180 ]; then
echo "⚠ 建议轮换密钥（超过180天）"
fi
# 6. 日志分析
echo ""
echo "[6] 日志分析（最近7天）"
error_count=$(sudo journalctl -u wg-quick@wg0 --since "7 days ago" -p err | wc -l)
warning_count=$(sudo journalctl -u wg-quick@wg0 --since "7 days ago" -p warning | wc -l)
echo "错误数: $error_count"
echo "警告数: $warning_count"
# 7. 磁盘使用趋势
echo ""
echo "[7] 磁盘使用"
df -h / | tail -1
echo ""
echo "=== 维护完成 ==="
定时执行：
# 每周日凌晨2点执行
0 2 * * 0 /usr/local/bin/weekly-maintenance.sh >> /var/log/wireguard-weekly.log 2>&1
30.3.2 每月检查
每月维护清单：
□ 审查用户列表，删除不活跃用户
□ 检查安全日志，寻找异常活动
□ 更新系统和WireGuard
□ 测试备份恢复流程
□ 检查防火墙规则
□ 性能基准测试
□ 文档更新
□ 审查访问控制策略
审计脚本：
#!/bin/bash
# monthly-audit.sh
echo "=== WireGuard月度审计 ==="
echo "日期: $(date '+%Y-%m')"
echo ""
# 1. 不活跃用户
echo "[1] 不活跃用户（30天未连接）"
threshold=$(($(date +%s) - 2592000)) # 30天
sudo wg show wg0 dump | tail -n +2 | while IFS=$'\t' read -r pubkey psk endpoint allowed_ips handshake rx tx keepalive; do
if [ "$handshake" -lt "$threshold" ]; then
username=$(grep -r "$pubkey" /etc/wireguard/clients/*.key 2>/dev/null | grep public | sed 's/.*\/\(.*\)_public.key.*/\1/')
ip=$(echo $allowed_ips | cut -d'/' -f1)
if [ -n "$username" ]; then
days_inactive=$((($(date +%s) - handshake) / 86400))
echo "- $username ($ip): $days_inactive 天未活跃"
fi
fi
done
# 2. 异常流量用户
echo ""
echo "[2] 高流量用户（>10GB）"
sudo wg show wg0 dump | tail -n +2 | while IFS=$'\t' read -r pubkey psk endpoint allowed_ips handshake rx tx keepalive; do
total_bytes=$((rx + tx))
total_gb=$((total_bytes / 1073741824))
if [ $total_gb -gt 10 ]; then
username=$(grep -r "$pubkey" /etc/wireguard/clients/*.key 2>/dev/null | grep public | sed 's/.*\/\(.*\)_public.key.*/\1/')
ip=$(echo $allowed_ips | cut -d'/' -f1)
if [ -n "$username" ]; then
echo "- $username ($ip): ${total_gb}GB"
fi
fi
done
# 3. 配置文件完整性
echo ""
echo "[3] 配置文件检查"
if sudo wg-quick strip wg0 > /dev/null 2>&1; then
echo "✓ 配置文件语法正确"
else
echo "✗ 配置文件有错误"
fi
# 4. 安全事件
echo ""
echo "[4] 安全事件"
failed_auth=$(sudo journalctl --since "1 month ago" | grep -ic "authentication failed\|unauthorized")
echo "认证失败: $failed_auth 次"
# 5. 系统健康
echo ""
echo "[5] 系统健康"
uptime=$(uptime -p)
load=$(uptime | awk -F'load average:' '{print $2}')
echo "运行时间: $uptime"
echo "系统负载: $load"
echo ""
echo "=== 审计完成 ==="
30.4 性能优化建议
30.4.1 网络优化
TCP参数调优：
sudo nano /etc/sysctl.d/99-wireguard-tuning.conf
内容：
# TCP优化
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fastopen = 3
# 缓冲区大小
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.ipv4.tcp_rmem = 4096 87380 134217728
net.ipv4.tcp_wmem = 4096 65536 134217728
# 拥塞控制
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
# 连接表大小
net.netfilter.nf_conntrack_max = 524288
net.netfilter.nf_conntrack_tcp_timeout_established = 1800
应用：
sudo sysctl -p /etc/sysctl.d/99-wireguard-tuning.conf
30.4.2 系统优化
文件描述符限制：
sudo nano /etc/security/limits.conf
添加：
* soft nofile 65535
* hard nofile 65535
服务优化：
sudo mkdir -p /etc/systemd/system/[email protected]/
sudo nano /etc/systemd/system/[email protected]/override.conf
内容：
[Service]
# 提高优先级
Nice=-10
CPUSchedulingPolicy=fifo
CPUSchedulingPriority=50
# 增加资源限制
LimitNOFILE=65535
LimitNPROC=65535
重新加载：
sudo systemctl daemon-reload
sudo systemctl restart wg-quick@wg0
31. 备份与恢复
31.1 配置备份
31.1.1 手动备份
备份WireGuard配置：
#!/bin/bash
# backup-wireguard.sh
BACKUP_DIR="/var/backups/wireguard"
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="$BACKUP_DIR/wireguard-backup-$DATE.tar.gz"
# 创建备份目录
sudo mkdir -p $BACKUP_DIR
echo "=== WireGuard配置备份 ==="
echo "备份时间: $(date)"
echo ""
# 备份内容
echo "[1] 备份配置文件..."
sudo tar czf $BACKUP_FILE \
/etc/wireguard/ \
/etc/systemd/system/[email protected]/ \
2>/dev/null
if [ $? -eq 0 ]; then
echo "✓ 配置文件已备份"
else
echo "✗ 备份失败"
exit 1
fi
# 记录系统信息
echo ""
echo "[2] 记录系统信息..."
{
echo "=== 系统信息 ==="
echo "备份时间: $(date)"
echo "主机名: $(hostname)"
echo "内核版本: $(uname -r)"
echo "WireGuard版本: $(wg --version)"
echo ""
echo "=== 接口信息 ==="
ip addr show wg0
echo ""
echo "=== 路由信息 ==="
ip route
echo ""
echo "=== 防火墙规则 ==="
sudo iptables-save
} | sudo tee $BACKUP_DIR/system-info-$DATE.txt > /dev/null
echo "✓ 系统信息已记录"
# 显示备份信息
echo ""
echo "=== 备份完成 ==="
backup_size=$(du -h $BACKUP_FILE | cut -f1)
echo "备份文件: $BACKUP_FILE"
echo "文件大小: $backup_size"
echo "系统信息: $BACKUP_DIR/system-info-$DATE.txt"
# 列出所有备份
echo ""
echo "现有备份:"
ls -lh $BACKUP_DIR/wireguard-backup-*.tar.gz
使用方法：
sudo bash backup-wireguard.sh
31.1.2 自动备份
配置定时备份：
# 编辑crontab
sudo crontab -e
# 每天凌晨3点备份
0 3 * * * /usr/local/bin/backup-wireguard.sh >> /var/log/wireguard-backup.log 2>&1
# 每周日完整备份
0 2 * * 0 /usr/local/bin/backup-wireguard.sh >> /var/log/wireguard-backup.log 2>&1
备份保留策略：
#!/bin/bash
# cleanup-old-backups.sh
BACKUP_DIR="/var/backups/wireguard"
# 保留策略
DAILY_KEEP=7 # 保留7天的每日备份
WEEKLY_KEEP=4 # 保留4周的每周备份
MONTHLY_KEEP=12 # 保留12个月的月度备份
echo "=== 清理旧备份 ==="
# 删除7天前的每日备份（周日的除外）
find $BACKUP_DIR -name "wireguard-backup-*.tar.gz" -type f -mtime +$DAILY_KEEP ! -name "*_Sunday_*" -delete
# 删除4周前的周日备份（每月1号的除外）
find $BACKUP_DIR -name "*_Sunday_*.tar.gz" -type f -mtime +$((WEEKLY_KEEP * 7)) ! -name "*_01_*" -delete
# 删除12个月前的月度备份
find $BACKUP_DIR -name "*_01_*.tar.gz" -type f -mtime +$((MONTHLY_KEEP * 30)) -delete
# 显示剩余备份
echo "剩余备份:"
ls -lh $BACKUP_DIR/wireguard-backup-*.tar.gz | wc -l
echo "个备份文件"
# 显示总大小
total_size=$(du -sh $BACKUP_DIR | cut -f1)
echo "总大小: $total_size"
31.1.3 远程备份
备份到远程服务器：
#!/bin/bash
# remote-backup.sh
BACKUP_DIR="/var/backups/wireguard"
REMOTE_USER="backup"
REMOTE_HOST="backup.example.com"
REMOTE_DIR="/backups/wireguard"
DATE=$(date +%Y%m%d)
# 本地备份
LOCAL_BACKUP="$BACKUP_DIR/wireguard-backup-$DATE.tar.gz"
sudo bash /usr/local/bin/backup-wireguard.sh
# 传输到远程服务器
echo "=== 传输到远程服务器 ==="
scp $LOCAL_BACKUP $REMOTE_USER@$REMOTE_HOST:$REMOTE_DIR/
if [ $? -eq 0 ]; then
echo "✓ 备份已传输到远程服务器"
else
echo "✗ 传输失败"
exit 1
fi
# 验证远程备份
echo ""
echo "验证远程备份..."
REMOTE_SIZE=$(ssh $REMOTE_USER@$REMOTE_HOST "ls -lh $REMOTE_DIR/wireguard-backup-$DATE.tar.gz" | awk '{print $5}')
LOCAL_SIZE=$(ls -lh $LOCAL_BACKUP | awk '{print $5}')
if [ "$REMOTE_SIZE" = "$LOCAL_SIZE" ]; then
echo "✓ 备份验证成功"
else
echo "⚠ 警告: 文件大小不匹配"
fi
使用rsync增量备份：
#!/bin/bash
# incremental-backup.sh
BACKUP_DIR="/var/backups/wireguard"
REMOTE_USER="backup"
REMOTE_HOST="backup.example.com"
REMOTE_DIR="/backups/wireguard"
# rsync增量备份
rsync -avz --delete \
/etc/wireguard/ \
$REMOTE_USER@$REMOTE_HOST:$REMOTE_DIR/latest/
if [ $? -eq 0 ]; then
echo "✓ 增量备份完成"
# 创建日期快照
DATE=$(date +%Y%m%d)
ssh $REMOTE_USER@$REMOTE_HOST \
"cp -al $REMOTE_DIR/latest $REMOTE_DIR/snapshot-$DATE"
echo "✓ 快照已创建: snapshot-$DATE"
else
echo "✗ 备份失败"
fi
31.2 恢复流程
31.2.1 完整恢复
恢复配置文件：
#!/bin/bash
# restore-wireguard.sh
BACKUP_FILE=$1
if [ -z "$BACKUP_FILE" ]; then
echo "用法: $0 <备份文件>"
echo ""
echo "可用备份:"
ls -1 /var/backups/wireguard/wireguard-backup-*.tar.gz
exit 1
fi
if [ ! -f "$BACKUP_FILE" ]; then
echo "错误: 备份文件不存在: $BACKUP_FILE"
exit 1
fi
echo "=== WireGuard配置恢复 ==="
echo "备份文件: $BACKUP_FILE"
echo ""
# 确认操作
read -p "这将覆盖当前配置，是否继续? (y/n) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
echo "恢复已取消"
exit 0
fi
# 停止WireGuard
echo ""
echo "[1] 停止WireGuard服务..."
sudo systemctl stop wg-quick@wg0
echo "✓ 服务已停止"
# 备份当前配置
echo ""
echo "[2] 备份当前配置..."
CURRENT_BACKUP="/var/backups/wireguard/pre-restore-$(date +%Y%m%d_%H%M%S).tar.gz"
sudo tar czf $CURRENT_BACKUP /etc/wireguard/ 2>/dev/null
echo "✓ 当前配置已备份到: $CURRENT_BACKUP"
# 清理现有配置
echo ""
echo "[3] 清理现有配置..."
sudo rm -rf /etc/wireguard/*
echo "✓ 现有配置已清理"
# 恢复配置
echo ""
echo "[4] 恢复配置文件..."
sudo tar xzf $BACKUP_FILE -C /
echo "✓ 配置文件已恢复"
# 设置权限
echo ""
echo "[5] 设置权限..."
sudo chmod 600 /etc/wireguard/*.conf
sudo chmod 600 /etc/wireguard/*.key 2>/dev/null
sudo chown -R root:root /etc/wireguard/
echo "✓ 权限已设置"
# 验证配置
echo ""
echo "[6] 验证配置..."
if sudo wg-quick strip wg0 > /dev/null 2>&1; then
echo "✓ 配置验证成功"
else
echo "✗ 配置验证失败"
echo "恢复到之前的配置..."
sudo tar xzf $CURRENT_BACKUP -C /
exit 1
fi
# 启动WireGuard
echo ""
echo "[7] 启动WireGuard服务..."
sudo systemctl start wg-quick@wg0
if systemctl is-active --quiet wg-quick@wg0; then
echo "✓ 服务启动成功"
else
echo "✗ 服务启动失败"
sudo journalctl -u wg-quick@wg0 -n 20
exit 1
fi
# 验证运行状态
echo ""
echo "[8] 验证运行状态..."
sleep 2
sudo wg show wg0
echo ""
echo "=== 恢复完成 ==="
使用方法：
sudo bash restore-wireguard.sh /var/backups/wireguard/wireguard-backup-20250323.tar.gz
31.2.2 部分恢复
仅恢复特定配置文件：
#!/bin/bash
# restore-single-file.sh
BACKUP_FILE=$1
TARGET_FILE=$2
if [ -z "$BACKUP_FILE" ] || [ -z "$TARGET_FILE" ]; then
echo "用法: $0 <备份文件> <目标文件>"
echo "示例: $0 backup.tar.gz /etc/wireguard/wg0.conf"
exit 1
fi
# 列出备份中的文件
echo "备份中的文件:"
tar tzf $BACKUP_FILE | grep wireguard
echo ""
read -p "确认恢复 $TARGET_FILE? (y/n) " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
# 备份当前文件
if [ -f "$TARGET_FILE" ]; then
sudo cp $TARGET_FILE ${TARGET_FILE}.bak
echo "✓ 当前文件已备份到 ${TARGET_FILE}.bak"
fi
# 恢复文件
sudo tar xzf $BACKUP_FILE -C / $TARGET_FILE
if [ $? -eq 0 ]; then
echo "✓ 文件恢复成功"
else
echo "✗ 恢复失败"
fi
fi
31.2.3 灾难恢复
完整系统恢复指南：
#!/bin/bash
# disaster-recovery.sh
echo "=== WireGuard灾难恢复指南 ==="
echo ""
cat << 'EOF'
灾难恢复步骤:
1. 安装基础系统
- 安装Ubuntu Server
- 配置网络
- 更新系统
2. 安装WireGuard
sudo apt update
sudo apt install wireguard wireguard-tools
3. 恢复配置文件
- 从备份恢复 /etc/wireguard/
- 设置正确权限
4. 配置网络
- 启用IP转发
- 恢复iptables规则
5. 启动服务
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
6. 验证
- 检查接口状态
- 测试连接
- 验证peer连接
详细步骤请参考灾难恢复文档。
EOF
echo ""
echo "是否开始自动恢复? (需要备份文件)"
read -p "继续? (y/n) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
exit 0
fi
# 检查是否为全新系统
if [ -d /etc/wireguard ] && [ "$(ls -A /etc/wireguard)" ]; then
echo "警告: /etc/wireguard 目录不为空"
echo "这可能不是全新系统"
read -p "确定继续? (y/n) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
exit 0
fi
fi
# 1. 安装WireGuard
echo ""
echo "[1] 安装WireGuard..."
if ! command -v wg &> /dev/null; then
sudo apt update
sudo apt install -y wireguard wireguard-tools
echo "✓ WireGuard已安装"
else
echo "✓ WireGuard已存在"
fi
# 2. 选择备份文件
echo ""
echo "[2] 选择备份文件..."
echo "请输入备份文件路径:"
read BACKUP_FILE
if [ ! -f "$BACKUP_FILE" ]; then
echo "错误: 备份文件不存在"
exit 1
fi
# 3. 恢复配置
echo ""
echo "[3] 恢复配置文件..."
sudo tar xzf $BACKUP_FILE -C /
sudo chmod 600 /etc/wireguard/*.conf
sudo chmod 600 /etc/wireguard/*.key 2>/dev/null
sudo chown -R root:root /etc/wireguard/
echo "✓ 配置已恢复"
# 4. 配置网络
echo ""
echo "[4] 配置网络..."
# 启用IP转发
if ! grep -q "net.ipv4.ip_forward=1" /etc/sysctl.conf; then
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
fi
echo "✓ IP转发已启用"
# 5. 启动服务
echo ""
echo "[5] 启动WireGuard服务..."
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
if systemctl is-active --quiet wg-quick@wg0; then
echo "✓ 服务启动成功"
else
echo "✗ 服务启动失败"
sudo journalctl -u wg-quick@wg0 -n 50
exit 1
fi
# 6. 验证
echo ""
echo "[6] 验证系统..."
sudo wg show wg0
echo ""
echo "=== 恢复完成 ==="
echo "请验证以下内容:"
echo "1. WireGuard接口状态"
echo "2. 防火墙规则"
echo "3. 客户端连接"
echo "4. 网络连通性"
31.3 数据迁移
31.3.1 迁移到新服务器
迁移步骤：
在旧服务器上：
#!/bin/bash
# export-config.sh
echo "=== 导出WireGuard配置 ==="
EXPORT_DIR="/tmp/wireguard-export"
mkdir -p $EXPORT_DIR
# 1. 导出配置文件
echo "[1] 导出配置文件..."
sudo cp -r /etc/wireguard/* $EXPORT_DIR/
echo "✓ 配置文件已导出"
# 2. 导出网络配置
echo ""
echo "[2] 导出网络配置..."
{
echo "=== IP地址 ==="
ip addr show
echo ""
echo "=== 路由表 ==="
ip route
echo ""
echo "=== iptables规则 ==="
sudo iptables-save
} > $EXPORT_DIR/network-config.txt
echo "✓ 网络配置已导出"
# 3. 导出系统信息
echo ""
echo "[3] 导出系统信息..."
{
echo "主机名: $(hostname)"
echo "内核: $(uname -r)"
echo "WireGuard版本: $(wg --version)"
echo "IP转发: $(sysctl net.ipv4.ip_forward)"
} > $EXPORT_DIR/system-info.txt
echo "✓ 系统信息已导出"
# 4. 创建迁移包
echo ""
echo "[4] 创建迁移包..."
MIGRATION_FILE="/tmp/wireguard-migration-$(date +%Y%m%d).tar.gz"
tar czf $MIGRATION_FILE -C /tmp wireguard-export/
echo "✓ 迁移包已创建: $MIGRATION_FILE"
# 清理
rm -rf $EXPORT_DIR
echo ""
echo "=== 导出完成 ==="
echo "迁移包: $MIGRATION_FILE"
echo ""
echo "传输到新服务器:"
echo "scp $MIGRATION_FILE user@new-server:/tmp/"
在新服务器上：
#!/bin/bash
# import-config.sh
MIGRATION_FILE=$1
if [ -z "$MIGRATION_FILE" ]; then
echo "用法: $0 <迁移包文件>"
exit 1
fi
echo "=== 导入WireGuard配置 ==="
# 1. 安装WireGuard
echo "[1] 安装WireGuard..."
if ! command -v wg &> /dev/null; then
sudo apt update
sudo apt install -y wireguard wireguard-tools
echo "✓ WireGuard已安装"
else
echo "✓ WireGuard已存在"
fi
# 2. 解压迁移包
echo ""
echo "[2] 解压迁移包..."
TEMP_DIR="/tmp/wireguard-import"
mkdir -p $TEMP_DIR
tar xzf $MIGRATION_FILE -C $TEMP_DIR
echo "✓ 迁移包已解压"
# 3. 导入配置
echo ""
echo "[3] 导入配置文件..."
sudo cp -r $TEMP_DIR/wireguard-export/* /etc/wireguard/
sudo chmod 600 /etc/wireguard/*.conf
sudo chmod 600 /etc/wireguard/*.key 2>/dev/null
sudo chown -R root:root /etc/wireguard/
echo "✓ 配置文件已导入"
# 4. 配置网络
echo ""
echo "[4] 配置网络..."
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
echo "✓ IP转发已启用"
# 5. 导入iptables规则
echo ""
echo "[5] 导入iptables规则..."
echo "请手动检查并导入iptables规则："
echo "cat $TEMP_DIR/wireguard-export/network-config.txt"
echo ""
read -p "按回车继续..."
# 6. 启动服务
echo ""
echo "[6] 启动服务..."
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
if systemctl is-active --quiet wg-quick@wg0; then
echo "✓ 服务启动成功"
else
echo "✗ 服务启动失败"
exit 1
fi
# 7. 验证
echo ""
echo "[7] 验证配置..."
sudo wg show wg0
echo ""
echo "=== 导入完成 ==="
echo ""
echo "重要提示:"
echo "1. 更新DNS记录指向新服务器IP"
echo "2. 通知所有客户端更新Endpoint"
echo "3. 测试所有客户端连接"
echo "4. 确认防火墙规则正确"
31.3.2 更改服务器IP
IP变更流程：
#!/bin/bash
# change-server-ip.sh
OLD_IP=$1
NEW_IP=$2
if [ -z "$OLD_IP" ] || [ -z "$NEW_IP" ]; then
echo "用法: $0 <旧IP> <新IP>"
echo "示例: $0 192.168.1.66 192.168.1.100"
exit 1
fi
echo "=== 更改服务器IP ==="
echo "旧IP: $OLD_IP"
echo "新IP: $NEW_IP"
echo ""
# 1. 更新客户端配置
echo "[1] 生成新的客户端配置..."
CONFIG_DIR="/etc/wireguard/clients"
NEW_CONFIG_DIR="/etc/wireguard/clients-new-ip"
sudo mkdir -p $NEW_CONFIG_DIR
for conf in $CONFIG_DIR/*.conf; do
if [ -f "$conf" ]; then
filename=$(basename "$conf")
# 替换Endpoint
sudo sed "s/$OLD_IP/$NEW_IP/g" "$conf" > "$NEW_CONFIG_DIR/$filename"
echo "✓ 已更新: $filename"
fi
done
echo ""
echo "新配置文件位于: $NEW_CONFIG_DIR"
# 2. 生成更新说明
cat > /tmp/ip-change-notice.txt << EOF
WireGuard服务器IP地址变更通知
尊敬的用户：
我们的WireGuard VPN服务器IP地址已更新：
- 旧IP: $OLD_IP
- 新IP: $NEW_IP
请更新您的客户端配置：
方法1: 手动修改
1. 打开WireGuard客户端
2. 编辑配置
3. 将Endpoint从 $OLD_IP:51820 改为 $NEW_IP:51820
4. 保存并重新连接
方法2: 导入新配置
我们已为您生成新的配置文件，请联系管理员获取。
如有问题，请联系技术支持。
更新日期: $(date)
EOF
echo ""
echo "通知文件已生成: /tmp/ip-change-notice.txt"
# 3. 测试新IP
echo ""
echo "[3] 测试新IP连接..."
if ping -c 3 $NEW_IP > /dev/null 2>&1; then
echo "✓ 新IP可访问"
else
echo "⚠ 警告: 新IP无法访问"
fi
echo ""
echo "=== 变更准备完成 ==="
echo ""
echo "下一步:"
echo "1. 发送通知给所有用户"
echo "2. 分发新的配置文件"
echo "3. 监控客户端迁移进度"
echo "4. 旧IP保持运行一段时间以确保平稳过渡"
31.4 配置版本控制
31.4.1 使用Git管理配置
初始化Git仓库：
#!/bin/bash
# setup-git-versioning.sh
CONFIG_DIR="/etc/wireguard"
echo "=== 设置配置版本控制 ==="
# 1. 初始化Git
cd $CONFIG_DIR
sudo git init
# 2. 配置.gitignore
cat << 'EOF' | sudo tee .gitignore
# 私钥文件
*_private.key
server_private.key
# 临时文件
*.tmp
*.bak
*~
# 日志文件
*.log
EOF
echo "✓ .gitignore已配置"
# 3. 配置Git属性
cat << 'EOF' | sudo tee .gitattributes
*.conf diff=ini
*.key -diff
EOF
echo "✓ .gitattributes已配置"
# 4. 初始提交
sudo git add .
sudo git commit -m "Initial WireGuard configuration"
echo "✓ 初始提交完成"
# 5. 创建提交脚本
cat << 'EOF' | sudo tee /usr/local/bin/commit-wireguard-config.sh
#!/bin/bash
cd /etc/wireguard
git add -A
git commit -m "Configuration update: $(date '+%Y-%m-%d %H:%M:%S')"
git log --oneline -5
EOF
sudo chmod +x /usr/local/bin/commit-wireguard-config.sh
echo "✓ 提交脚本已创建"
echo ""
echo "=== 设置完成 ==="
echo ""
echo "提交配置变更:"
echo "sudo /usr/local/bin/commit-wireguard-config.sh"
echo ""
echo "查看历史:"
echo "cd /etc/wireguard && sudo git log"
echo ""
echo "回滚到之前版本:"
echo "cd /etc/wireguard && sudo git checkout <commit-hash> wg0.conf"
31.4.2 配置变更追踪
自动追踪配置变更：
#!/bin/bash
# track-config-changes.sh
CONFIG_FILE="/etc/wireguard/wg0.conf"
CHANGES_LOG="/var/log/wireguard-changes.log"
# 记录变更前的MD5
OLD_MD5=$(md5sum $CONFIG_FILE 2>/dev/null | awk '{print $1}')
# 等待变更
inotifywait -m -e modify $CONFIG_FILE | while read path action file; do
# 记录变更后的MD5
NEW_MD5=$(md5sum $CONFIG_FILE | awk '{print $1}')
# 如果MD5不同，记录变更
if [ "$OLD_MD5" != "$NEW_MD5" ]; then
{
echo "=== 配置变更 ==="
echo "时间: $(date)"
echo "文件: $file"
echo "操作: $action"
echo "旧MD5: $OLD_MD5"
echo "新MD5: $NEW_MD5"
echo ""
# 记录变更内容
diff -u <(git show HEAD:wg0.conf) $CONFIG_FILE 2>/dev/null || echo "无法显示diff"
echo ""
} | tee -a $CHANGES_LOG
# 自动提交到Git
cd /etc/wireguard
sudo git add $CONFIG_FILE
sudo git commit -m "Auto-commit: Configuration changed at $(date)"
OLD_MD5=$NEW_MD5
fi
done
配置为systemd服务：
sudo nano /etc/systemd/system/wireguard-config-tracker.service
内容：
[Unit]
Description=WireGuard Configuration Change Tracker
After[email protected]
[Service]
Type=simple
ExecStart=/usr/local/bin/track-config-changes.sh
Restart=always
[Install]
WantedBy=multi-user.target
启用：
sudo systemctl enable wireguard-config-tracker
sudo systemctl start wireguard-config-tracker
32. 系统升级
32.1 升级WireGuard
32.1.1 检查当前版本
查看版本信息：
# WireGuard工具版本
wg --version
# 内核模块版本
sudo modinfo wireguard
# 包版本
dpkg -l | grep wireguard
# 或使用apt
apt list --installed | grep wireguard
32.1.2 升级流程
标准升级流程：
#!/bin/bash
# upgrade-wireguard.sh
echo "=== WireGuard升级流程 ==="
# 1. 备份配置
echo ""
echo "[1] 备份当前配置..."
BACKUP_FILE="/var/backups/wireguard/pre-upgrade-$(date +%Y%m%d_%H%M%S).tar.gz"
sudo mkdir -p /var/backups/wireguard
sudo tar czf $BACKUP_FILE /etc/wireguard/
echo "✓ 配置已备份到: $BACKUP_FILE"
# 2. 记录当前版本
echo ""
echo "[2] 当前版本信息..."
CURRENT_VERSION=$(wg --version 2>&1)
echo "WireGuard: $CURRENT_VERSION"
echo "$CURRENT_VERSION" > /tmp/wireguard-version-before.txt
# 3. 检查可用更新
echo ""
echo "[3] 检查可用更新..."
sudo apt update
apt list --upgradable 2>/dev/null | grep wireguard
# 4. 确认升级
echo ""
read -p "确认升级WireGuard? (y/n) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
echo "升级已取消"
exit 0
fi
# 5. 停止服务
echo ""
echo "[5] 停止WireGuard服务..."
sudo systemctl stop wg-quick@wg0
echo "✓ 服务已停止"
# 6. 执行升级
echo ""
echo "[6] 执行升级..."
sudo apt install --only-upgrade wireguard wireguard-tools
if [ $? -eq 0 ]; then
echo "✓ 升级成功"
else
echo "✗ 升级失败"
echo "恢复配置..."
sudo tar xzf $BACKUP_FILE -C /
exit 1
fi
# 7. 验证新版本
echo ""
echo "[7] 验证新版本..."
NEW_VERSION=$(wg --version 2>&1)
echo "新版本: $NEW_VERSION"
echo "$NEW_VERSION" > /tmp/wireguard-version-after.txt
# 8. 验证配置
echo ""
echo "[8] 验证配置文件..."
if sudo wg-quick strip wg0 > /dev/null 2>&1; then
echo "✓ 配置验证成功"
else
echo "✗ 配置验证失败"
echo "恢复旧版本..."
sudo apt install wireguard=$(cat /tmp/wireguard-version-before.txt | awk '{print $2}')
exit 1
fi
# 9. 启动服务
echo ""
echo "[9] 启动WireGuard服务..."
sudo systemctl start wg-quick@wg0
if systemctl is-active --quiet wg-quick@wg0; then
echo "✓ 服务启动成功"
else
echo "✗ 服务启动失败"
sudo journalctl -u wg-quick@wg0 -n 50
exit 1
fi
# 10. 功能测试
echo ""
echo "[10] 功能测试..."
sleep 3
# 测试接口
if ip link show wg0 > /dev/null 2>&1; then
echo "✓ 接口正常"
else
echo "✗ 接口异常"
fi
# 测试peer
peer_count=$(sudo wg show wg0 peers | wc -l)
echo "Peer数量: $peer_count"
echo ""
echo "=== 升级完成 ==="
echo "旧版本: $CURRENT_VERSION"
echo "新版本: $NEW_VERSION"
echo ""
echo "建议:"
echo "1. 测试所有客户端连接"
echo "2. 监控日志是否有异常"
echo "3. 保留备份文件一段时间"
32.2 升级内核
32.2.1 内核升级注意事项
检查WireGuard内核模块：
# 检查当前内核
uname -r
# 检查WireGuard模块
lsmod | grep wireguard
# 检查模块信息
modinfo wireguard
内核升级流程：
#!/bin/bash
# kernel-upgrade.sh
echo "=== 内核升级准备 ==="
# 1. 当前信息
echo "当前内核: $(uname -r)"
echo "WireGuard模块:"
modinfo wireguard | grep -E "filename|version|description"
# 2. 检查可用内核
echo ""
echo "可用内核更新:"
apt list --upgradable 2>/dev/null | grep linux-image
# 3. 备份
echo ""
echo "开始备份..."
sudo bash /usr/local/bin/backup-wireguard.sh
# 4. 升级提示
cat << 'EOF'
内核升级步骤:
1. 升级内核包
sudo apt install linux-image-generic
2. 重启系统
sudo reboot
3. 重启后验证
uname -r
lsmod | grep wireguard
sudo wg show wg0
4. 如果WireGuard模块未加载
sudo modprobe wireguard
sudo systemctl restart wg-quick@wg0
注意事项:
- 升级前确保已备份配置
- 准备好物理访问或带外管理
- 计划维护窗口
- 通知用户服务中断
EOF
32.3 系统更新
32.3.1 定期更新检查
更新检查脚本：
#!/bin/bash
# check-updates.sh
echo "=== 系统更新检查 ==="
echo "检查时间: $(date)"
echo ""
# 更新包列表
sudo apt update
# 检查可用更新
echo "可用更新:"
UPDATES=$(apt list --upgradable 2>/dev/null | grep -v "Listing")
UPDATE_COUNT=$(echo "$UPDATES" | grep -c upgradable)
echo "$UPDATES"
echo ""
echo "总计: $UPDATE_COUNT 个更新"
# 安全更新
echo ""
echo "安全更新:"
apt list --upgradable 2>/dev/null | grep -i security
# WireGuard相关
echo ""
echo "WireGuard相关更新:"
apt list --upgradable 2>/dev/null | grep wireguard
# 内核更新
echo ""
echo "内核更新:"
apt list --upgradable 2>/dev/null | grep linux-image
# 生成报告
REPORT_FILE="/var/log/update-check-$(date +%Y%m%d).txt"
{
echo "系统更新报告"
echo "生成时间: $(date)"
echo ""
echo "可用更新数量: $UPDATE_COUNT"
echo ""
echo "详细列表:"
echo "$UPDATES"
} > $REPORT_FILE
echo ""
echo "报告已保存: $REPORT_FILE"
自动更新安全补丁：
#!/bin/bash
# auto-security-updates.sh
# 安装unattended-upgrades
sudo apt install -y unattended-upgrades
# 配置自动更新
sudo dpkg-reconfigure -plow unattended-upgrades
# 编辑配置
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
配置示例：
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}-security";
};
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::MinimalSteps "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";
// 发送邮件通知
Unattended-Upgrade::Mail "[email protected]";
Unattended-Upgrade::MailReport "on-change";
32.3.2 更新策略
维护窗口更新：
#!/bin/bash
# maintenance-update.sh
echo "=== 系统维护更新 ==="
# 检查是否在维护窗口
CURRENT_HOUR=$(date +%H)
MAINTENANCE_START=2
MAINTENANCE_END=4
if [ $CURRENT_HOUR -lt $MAINTENANCE_START ] || [ $CURRENT_HOUR -ge $MAINTENANCE_END ]; then
echo "不在维护窗口内 (02:00-04:00)"
echo "当前时间: $(date)"
exit 0
fi
echo "维护窗口: 02:00-04:00"
echo "开始时间: $(date)"
echo ""
# 1. 备份
echo "[1] 备份配置..."
sudo bash /usr/local/bin/backup-wireguard.sh
# 2. 更新包列表
echo ""
echo "[2] 更新包列表..."
sudo apt update
# 3. 升级包
echo ""
echo "[3] 升级系统..."
sudo apt upgrade -y
# 4. 清理
echo ""
echo "[4] 清理..."
sudo apt autoremove -y
sudo apt autoclean
# 5. 检查WireGuard
echo ""
echo "[5] 检查WireGuard..."
if systemctl is-active --quiet wg-quick@wg0; then
echo "✓ WireGuard运行正常"
else
echo "⚠ WireGuard服务异常，尝试重启..."
sudo systemctl restart wg-quick@wg0
fi
# 6. 检查是否需要重启
echo ""
echo "[6] 检查是否需要重启..."
if [ -f /var/run/reboot-required ]; then
echo "⚠ 系统需要重启"
cat /var/run/reboot-required.pkgs
# 可选：自动重启
# echo "将在5分钟后重启..."
# sudo shutdown -r +5 "System update requires reboot"
else
echo "✓ 无需重启"
fi
echo ""
echo "=== 更新完成 ==="
echo "完成时间: $(date)"
定时任务配置：
# 编辑crontab
sudo crontab -e
# 每周日凌晨3点执行维护更新
0 3 * * 0 /usr/local/bin/maintenance-update.sh >> /var/log/maintenance-update.log 2>&1