Настройка WireGuard + Xray-Gateway на хосте

Данное руководство описывает настройку сервера WireGuard, прозрачного прокси Xray-Gateway и управление ими. Все команды выполняются от root.

apt update
apt install wireguard -y

wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key

Файл: /etc/wireguard/wg0.conf

[Interface]
Address = 10.10.10.1/24
ListenPort = 51820
PrivateKey = <SERVER_PRIVATE_KEY>

# Разрешить форвардинг
PostUp   = sysctl -w net.ipv4.ip_forward=1
PostUp   = iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE

PostDown = iptables -t nat -D POSTROUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE

systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0

wg show

mkdir -p /opt/xray-gateway
cd /opt/xray-gateway

Файл: docker-compose.yml

services:
  xray:
    image: ghcr.io/xtls/xray-core:latest
    container_name: xray-gateway
    restart: unless-stopped
    command: ["run", "-c", "/etc/xray/config.json"]
    network_mode: host
    volumes:
      - ./config.json:/etc/xray/config.json:ro

Файл: config.json

{
  "log": {
    "loglevel": "warning"
  },
 
  "inbounds": [
    {
      "tag": "socks",
      "port": 10808,
      "listen": "0.0.0.0",
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    },
    {
      "tag": "transparent",
      "port": 12345,
      "listen": "0.0.0.0",
      "protocol": "dokodemo-door",
      "settings": {
        "network": "tcp,udp",
        "followRedirect": true
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls"]
      }
    }
  ],
 
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "185.238.168.59",
            "port": 443,
            "users": [
              {
                "id": "eac6da3c-e718-4661-80d5-d96838618122",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "fingerprint": "chrome",
          "serverName": "google.com",
          "publicKey": "Ks7lJ4awVwB_yxTXNadU0CWUdIP3Jie28tJv60omWFk",
          "shortId": "0f432ce5",
          "spiderX": "/"
        }
      }
    },
 
    {
      "tag": "dns-proxy",
      "protocol": "dns",
      "settings": {}
    },
 
    {
      "tag": "direct",
      "protocol": "freedom"
    }
  ],
 
  "dns": {
    "servers": [
      {
        "tag": "dns-remote",
        "address": "8.8.8.8",
        "port": 53,
        "skipFallback": true
      }
    ]
  },
 
  "routing": {
    "rules": [
      {
        "type": "field",
        "port": 53,
        "outboundTag": "proxy"
      },
      {
        "type": "field",
        "ip": ["10.10.10.0/24", "192.168.0.0/24", "geoip:private"],
        "outboundTag": "direct"
      }
    ]
  }
}

iptables -t nat -A PREROUTING -i wg0 -p tcp -j REDIRECT --to-ports 12345
iptables -t nat -A PREROUTING -i wg0 -p udp --dport 53 -j REDIRECT --to-ports 12345

iptables -t nat -I PREROUTING -i wg0 -d 10.10.10.0/24 -j RETURN
iptables -t nat -I PREROUTING -i wg0 -d 192.168.0.0/24 -j RETURN

iptables -t nat -L -n --line-numbers

iptables -t nat -D PREROUTING <номер строки>

cd /opt/xray-gateway
docker compose up -d

docker compose down

docker restart xray-gateway

docker logs -f xray-gateway

ss -tulnp | grep 12345
ss -tulnp | grep 10808

dig @127.0.0.1 -p 12345 google.com

curl --socks5 127.0.0.1:10808 https://api.ipify.org

curl https://api.ipify.org
dig google.com

docker compose down
rm -rf /opt/xray-gateway

Сервер WireGuard + Xray-Gateway полностью работает с прозрачным проксированием и исключением локальных сетей.