VPN با WireGuard روی Debian و قوانین nftables

sudo apt install -y wireguard
umask 077
wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub

[Interface]
Address = 10.66.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>

[Peer]
# sara-laptop
PublicKey = <sara public key>
AllowedIPs = 10.66.0.10/32

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/90-wireguard.conf && sudo sysctl --system
sudo systemctl enable --now wg-quick@wg0
sudo wg show

table inet filter {
  chain input {
    # ... existing rules ...
    udp dport 51820 accept
  }
  chain forward {
    type filter hook forward priority 0; policy drop;
    ct state established,related accept
    iifname "wg0" oifname "ens18" ip daddr 192.168.10.0/24 accept
  }
}

table ip nat {
  chain postrouting {
    type nat hook postrouting priority srcnat;
    iifname "wg0" oifname "ens18" masquerade
  }
}

sudo nft -c -f /etc/nftables.conf && sudo systemctl reload nftables
sudo nft list ruleset | grep -A3 forward

[Interface]
PrivateKey = <sara private key>
Address = 10.66.0.10/32
DNS = 192.168.10.5

[Peer]
PublicKey = <contents of server.pub>
Endpoint = vpn.sahor.ir:51820
AllowedIPs = 192.168.10.0/24
PersistentKeepalive = 25

sudo wg show wg0 latest-handshakes
sudo nft list chain inet filter forward -a
ping -c2 10.66.0.10