VPN با WireGuard روی Rocky و AlmaLinux و firewalld

sudo dnf install -y wireguard-tools
sudo mkdir -p /etc/wireguard && sudo chmod 700 /etc/wireguard
wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub
sudo chmod 600 /etc/wireguard/server.key

[Interface]
Address = 10.66.0.1/24
ListenPort = 51820
PrivateKey = <contents of server.key>

[Peer]
# ali-laptop
PublicKey = <ali public key>
AllowedIPs = 10.66.0.10/32

sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --permanent --new-zone=vpn
sudo firewall-cmd --permanent --zone=vpn --add-interface=wg0
sudo firewall-cmd --permanent --new-policy=vpn-to-lan
sudo firewall-cmd --permanent --policy=vpn-to-lan --add-ingress-zone=vpn
sudo firewall-cmd --permanent --policy=vpn-to-lan --add-egress-zone=public
sudo firewall-cmd --permanent --policy=vpn-to-lan --set-target=REJECT
sudo firewall-cmd --permanent --policy=vpn-to-lan --add-rich-rule='rule family="ipv4" destination address="192.168.10.0/24" accept'
sudo firewall-cmd --permanent --policy=vpn-to-lan --add-masquerade
sudo firewall-cmd --reload
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/90-wireguard.conf && sudo sysctl --system

sudo systemctl enable --now wg-quick@wg0
sudo wg show

[Interface]
PrivateKey = <ali private key>
Address = 10.66.0.10/32
DNS = 192.168.10.5

[Peer]
PublicKey = <contents of server.pub>
Endpoint = vpn.sahor.ir:51820
AllowedIPs = 192.168.10.0/24, 10.66.0.0/24
PersistentKeepalive = 25

sudo wg set wg0 peer <new public key> allowed-ips 10.66.0.11/32
sudo wg-quick save wg0
sudo wg set wg0 peer <old public key> remove && sudo wg-quick save wg0