在Windows上设置WireGuard

> 本文由 [简悦 SimpRead](http://ksria.com/simpread/) 转码， 原文地址 [golb.hplar.ch](https://golb.hplar.ch/2019/07/wireguard-windows.html)

> A few months ago, I wrote a tutorial on installing WireGuard, a simple, fast, and modern VPN, on Linu......几个月前，我写了一个关于在 Linu 上安装 WireGuard 的教程，这是一种简单、快速且现代的 VPN......

A few months ago, [I wrote a tutorial](https://golb.hplar.ch/2018/10/wireguard-on-amazon-lightsail.html) on installing WireGuard, a simple, fast, and modern VPN, on Linux and opening a VPN connection from an Android device. Because I work most of the time on Windows, I was also especially interested in connecting my computer to a WireGuard VPN, but there was no Windows client available at that time.  
几个月前，[我写了一个关于](https://golb.hplar.ch/2018/10/wireguard-on-amazon-lightsail.html)在 Linux 上安装 WireGuard（一种简单、快速且现代的 VPN）并从 Android 设备打开 VPN 连接的教程。因为我大部分时间都在 Windows 上工作，所以我也对将我的计算机连接到 WireGuard VPN 特别感兴趣，但当时没有可用的 Windows 客户端。

In the meantime, the developers of WireGuard released a Windows version. This blog post shows you how to install and configure WireGuard on Windows and establish a VPN connection to a WireGuard server running on a VPS.  
与此同时，WireGuard 的开发人员发布了 Windows 版本。这篇博文向您展示了如何在 Windows 上安装和配置 WireGuard，并与 VPS 上运行的 WireGuard 服务器建立 VPN 连接。

This tutorial assumes that you already have a WireGuard server running somewhere. I connect the Windows client to a WireGuard server running on Amazon Lightsail, which is set up according to [my previous blog post](https://golb.hplar.ch/2018/10/wireguard-on-amazon-lightsail.html). If you follow my previous tutorial, skip the client setup section, and you also don't have to generate the public/private key pair for the client.  
本教程假定您已经在某处运行了 WireGuard 服务器。我将 Windows 客户端连接到在 Amazon Lightsail 上运行的 WireGuard 服务器，该服务器是根据[我之前的博客文章](https://golb.hplar.ch/2018/10/wireguard-on-amazon-lightsail.html)进行设置的。如果您按照我之前的教程进行作，请跳过客户端设置部分，并且也不必为客户端生成公钥/私钥对。

The topology of our VPN that we will build in this tutorial looks like this:  
我们将在本教程中构建的 VPN 拓扑如下所示：

![](https://golb.hplar.ch/2019/07/wireguard_topo.svg)

I'm using WireGuard in this example as a VPN and route all IP traffic from my Windows computer to the Internet through the Linux server.  
在此示例中，我将 WireGuard 用作 VPN，并通过 Linux 服务器将所有 IP 流量从我的 Windows 计算机路由到 Internet。

You can also use WireGuard to connect to a private network like a company LAN or connect two private networks over the public Internet; however, I will not cover these use cases.  
您还可以使用 WireGuard 连接到私有网络（如公司 LAN）或通过公共 Internet 连接两个私有网络;但是，我不会介绍这些用例。

Installation [¶](#installation)  安装 [¶](#installation)
------------------------------------------------------

The first step is to download the software from the download page: [https://www.wireguard.com/install/](https://www.wireguard.com/install/)  
第一步是从下载页面下载软件： [https://www.wireguard.com/install/](https://www.wireguard.com/install/)

Install the `msi` file. After the installation, you should see the WireGuard icon in the icon bar.  
安装 `msi` 文件。安装后，您应该会在图标栏中看到 WireGuard 图标。

![](https://golb.hplar.ch/2019/07/wireguard-01.png)

WireGuard for Windows runs on Windows 7, 8, 8.1, 10, 2012, 2016, and 2019 and is available in a 64-bit and a 32-bit version. I'm testing the 64-bit version on Windows 10.  
适用于 Windows 的 WireGuard 可在 Windows 7、8、8.1、10、2012、2016 和 2019 上运行，并提供 64 位和 32 位版本。我正在 Windows 10 上测试 64 位版本。

**Be aware** that all the WireGuard software packages are in a pre-release state and should only be used for testing. If you are concerned about security, I recommend waiting until the official release, and an independent third party has audited the software.  
**请注意**，所有 WireGuard 软件包都处于预发布状态，只能用于测试。如果您担心安全性，我建议您等到正式发布，并且独立的第三方已经审核了该软件。

Configuration [¶](#configuration)  配置 [¶](#configuration)
---------------------------------------------------------

Next, we configure the VPN tunnel. This includes setting up the endpoints and exchanging the public keys.  
接下来，我们配置 VPN 隧道。这包括设置终端节点和交换公钥。

#### Windows [¶](#windows)  窗口 [¶](#windows)

Open the WireGuard GUI and click on _Add Tunnel_ -> _Add empty tunnel..._ ![](https://golb.hplar.ch/2019/07/wireguard-02.png)  
打开 WireGuard GUI，然后单击 _Add Tunnel_ -> _Add empty tunnel..._ ![](https://golb.hplar.ch/2019/07/wireguard-02.png)

The software automatically creates the public/private key pair and displays it on the screen.  
软件会自动创建公钥/私钥对并将其显示在屏幕上。![](https://golb.hplar.ch/2019/07/wireguard-03.png)

Give the tunnel a name and insert the following configuration. Change IP addresses and keys according to your environment.  
为隧道命名并插入以下配置。根据您的环境更改 IP 地址和密钥。

```
[Interface]
PrivateKey = 6I79zNsp26O2gCYkScEXdypB2UZ8IbNv2pV36QstKlo=
Address = 192.168.2.2/32
DNS = 192.168.2.1

[Peer]
PublicKey = uZik78EWgYCLQRMdG6k6QK0mzHFqfr4uhOEjPyXe5WE=
AllowedIPs = 0.0.0.0/0
Endpoint = 35.174.118.17:54321
```

*   **PrivateKey**: Private key of this client  
    **PrivateKey**：此客户端的私钥
*   **Address**: IP address of this client. It must be unique among all clients.  
    **地址**：此客户端的 IP 地址。它必须在所有客户端中是唯一的。
*   **DNS**: IP address of a DNS server. In this case, I use the DNS server running on the WireGuard server.  
    **DNS：**DNS 服务器的 IP 地址。在本例中，我使用在 WireGuard 服务器上运行的 DNS 服务器。

*   **PublicKey**: Public key of the server  
    **PublicKey**：服务器的公钥
*   **AllowedIPs**: Specifies what IP addresses should be routed over the VPN. For example, 0.0.0.0/0 is a catch-all configuration and routes everything over the VPN.  
    **AllowedIPs**：指定应通过 VPN 路由的 IP 地址。例如，0.0.0.0/0 是一个 catch-all 配置，它通过 VPN 路由所有内容。
*   **Endpoint**: External IP address of the server and listening port. Port must match the `ListenPort` server configuration.  
    **Endpoint**：服务器的外部 IP 地址和监听端口。端口必须与 `ListenPort` 服务器配置匹配。

#### Server [¶](#server)  服务器 [¶](#server)

On the server-side, you need to add a `[Peer]` section to the WireGuard configuration file (`/etc/wireguard/wg0.conf`)  
在服务器端，您需要在 WireGuard 配置文件 （`/etc/wireguard/wg0.conf`） 中添加`一个 [Peer]` 部分

```
[Peer]
PublicKey = rbkuZ+3SyPtT/QLZhFhiTo555ekSCJRsHf3jJb5kdkI=
AllowedIPs = 192.168.2.2/32
```

*   **PublicKey**: Public key of the Windows client  
    **PublicKey**：Windows 客户端的公钥
*   **AllowedIPs**: Specifies what IP addresses are allowed through this tunnel. This is the VPN IP address of the Windows computer.  
    **AllowedIPs**：指定允许通过此隧道的 IP 地址。这是 Windows 计算机的 VPN IP 地址。

Here is a screenshot showing the Windows client (left) and the Linux server (right) configuration.  
下面是一个屏幕截图，显示了 Windows 客户端（左）和 Linux 服务器（右）配置。

![](https://golb.hplar.ch/2019/07/wireguard-04.png)

Ensure that you exchange the correct keys and the IP addresses are correct.  
确保交换正确的密钥并且 IP 地址正确。

#### Block untunneled traffic [¶](#block-untunneled-traffic)  
阻止未隧道流量 [¶](#block-untunneled-traffic)

You might notice the option _Block untunneled traffic_. You can enable this option when your configuration has precisely one `[Peer]` section and `AllowedIPs` is set to a catch-all address.  
您可能会注意到 _Block untunneled traffic （阻止未隧道流量_） 选项。当您的配置只有一个 `[Peer]` 部分并且 `AllowedIPs` 设置为全捕获地址时，您可以启用此选项。

If the option is enabled, the WireGuard client adds Windows Firewall rules to block all traffic that is neither to nor from the tunnel interface.  
如果启用该选项，则 WireGuard 客户端将添加 Windows 防火墙规则，以阻止所有既不进出隧道接口的流量。

As mentioned before, I use this configuration to route all IP traffic through the VPN, so it makes sense to enable this option to prevent accidentally sending IP packets outside the VPN.  
如前所述，我使用此配置通过 VPN 路由所有 IP 流量，因此启用此选项以防止意外将 IP 数据包发送到 VPN 外部是有意义的。

If you use WireGuard to connect to a private network, like a company LAN or your home network, you don't need to enable this option. Instead, configure `AllowedIPs` so that only your private network IP addresses are routed through the VPN.  
如果您使用 WireGuard 连接到专用网络，例如公司 LAN 或家庭网络，则无需启用此选项。相反，请配置 `AllowedIPs`，以便仅通过 VPN 路由您的私有网络 IP 地址。

#### Activate [¶](#activate)  激活 [¶](#activate)

You should now be able to activate the VPN connection. Click on _Activate_.  
您现在应该能够激活 VPN 连接。单击 _Activate（激活_）。

![](https://golb.hplar.ch/2019/07/wireguard-05.png)

After a few seconds, the status should change to **Active**  
几秒钟后，状态应更改为 **Active （活动）**

![](https://golb.hplar.ch/2019/07/wireguard-06.png)

If that's not the case, check the _Log_ tab and double-check the client and server configuration.  
如果不是这种情况，请检查 _Log_ 选项卡并仔细检查客户端和服务器配置。

_Deactivate_ closes the VPN connection.  
_Deactivate_ 关闭 VPN 连接。

Checking VPN connection [¶](#checking-vpn-connection)  
检查 VPN 连接 [¶](#checking-vpn-connection)
-----------------------------------------------------------------------------------------------

To check if the VPN works correctly, open a browser with the URL: [https://www.whatismyip.com/](https://www.whatismyip.com/) Or enter the search term "my ip" into the Google search.  
要检查 VPN 是否正常工作，请打开一个 URL 为：[https://www.whatismyip.com/](https://www.whatismyip.com/) 或在 Google 搜索中输入搜索词“my ip”。

If the connection is routed through the VPN, it should show the IP address of the WireGuard server as the public address.  
如果连接是通过 VPN 路由的，它应该将 WireGuard 服务器的 IP 地址显示为公共地址。

If you run your own DNS server, as I do in this example, check if DNS requests are routed through the VPN. Go to [https://www.dnsleaktest.com](https://www.dnsleaktest.com/) and run the extended test. The test runs for a few seconds and displays a list of servers that answered the DNS queries. Make sure that this list only contains the IP address of your DNS server.  
如果您运行自己的 DNS 服务器，就像我在此示例中所做的那样，请检查 DNS 请求是否通过 VPN 路由。转到 [https://www.dnsleaktest.com](https://www.dnsleaktest.com/) 并运行扩展测试。测试将运行几秒钟，并显示回答 DNS 查询的服务器列表。确保此列表仅包含 DNS 服务器的 IP 地址。

Read this [guide about DNS leaks](https://pixelprivacy.com/resources/dns-leak/) to learn more about why you want to test for DNS leaks and it also shows you other methods for preventing leaks.  
阅读这份[关于 DNS 泄漏的指南](https://pixelprivacy.com/resources/dns-leak/)，了解更多关于为什么要测试 DNS 泄漏的信息，它还向您展示了防止泄漏的其他方法。

Adding more clients [¶](#adding-more-clients)  
添加更多客户端 [¶](#adding-more-clients)
---------------------------------------------------------------------------------

You can connect multiple clients to one server. Follow the configuration above and add a `[Peer]` section to the server configuration file for each client. Make sure that you assign a unique IP address for each client.  
您可以将多个客户端连接到一个服务器。按照上述配置，将 `[对等]` 部分添加到每个客户端的服务器配置文件中。确保为每个客户端分配唯一的 IP 地址。

Don't forget to restart WireGuard on Linux after you changed the configuration:  
更改配置后，不要忘记在 Linux 上重新启动 WireGuard：

```
wg-quick down wg0 && wg-quick up wg0
```

I've been running the Windows client for a few days, and even though it's a pre-release, it is remarkably stable and works without any problems.  
我已经运行 Windows 客户端几天了，尽管它是预发行版，但它非常稳定并且运行没有任何问题。

One feature I like is that the Windows version of WireGuard remembers the VPN connection state. So when you reboot Windows while WireGuard is connected to the server, the software automatically reconnects and re-establishes the VPN tunnel when it starts up. This prevents you from accidentally connecting without a VPN.  
我喜欢的一个功能是 Windows 版本的 WireGuard 会记住 VPN 连接状态。因此，当您在 WireGuard 连接到服务器时重新启动 Windows 时，软件会在启动时自动重新连接并重新建立 VPN 隧道。这可以防止您在没有 VPN 的情况下意外连接。