onionvps

指南

在 VPS 上 5 分钟搞定 WireGuard VPN

入门阅读时间 5 分钟更新时间 2026年5月30日
简短回答

一个可用的 WireGuard 服务器需要四样东西：一对密钥、一个 wg0 接口配置、开启 IP 转发与 NAT、每个设备一个对等段。在 4 美元实例上，整个过程大约五分钟就能完成，并且能轻松跑满千兆端口。

01 安装 WireGuard 并生成密钥

The kernel module is already present on any modern Linux distribution running on KVM.

apt update && apt install -y wireguard
umask 077
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub

02 编写服务器配置

Replace eth0 with your actual interface name if it differs — check with ip -br link. The Address line defines the tunnel subnet, not your public address.

# /etc/wireguard/wg0.conf
[Interface]
Address = 10.66.66.1/24, fd42:42::1/64
ListenPort = 51820
PrivateKey = <contents of /etc/wireguard/server.key>
PostUp   = nft add table ip nat; nft add chain ip nat post { type nat hook postrouting priority 100 \; }; nft add rule ip nat post oifname "eth0" masquerade
PostDown = nft delete table ip nat

03 启用转发并启动隧道

Forwarding must be enabled for both address families, or IPv6 clients will fail silently.

cat >/etc/sysctl.d/99-wg.conf <<'EOF'
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
EOF
sysctl --system
systemctl enable --now wg-quick@wg0
ufw allow 51820/udp

04 为每台设备添加对端

Generate a key pair per device. AllowedIPs on the server side is the address that device will hold inside the tunnel — not a range.

wg set wg0 peer <CLIENT_PUBLIC_KEY> allowed-ips 10.66.66.2/32,fd42:42::2/128
wg-quick save wg0

05 客户端配置

AllowedIPs of 0.0.0.0/0 and ::/0 routes all traffic through the tunnel. Narrow it for split tunnelling.

[Interface]
PrivateKey = <client private key>
Address = 10.66.66.2/32, fd42:42::2/128
DNS = 10.66.66.1

[Peer]
PublicKey = <server public key>
Endpoint = YOUR_SERVER_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

常见问题

一台 VPS 能处理多少设备？

一个共享核心轻松处理 20 个以上并发对端。限制在于您的上行带宽，而非实例本身。

为什么我的连接很慢？

几乎总是 MTU 的问题。尝试在客户端接口上设置 MTU = 1420；WireGuard 会增加开销，可能使数据包超过路径 MTU 并触发分片。