用WireGuard和RouterOS实现多局域网直连：让异地办公室像在同一个房间聊天！

# 使用SSH登录你的云服务器
ssh root@你的服务器IP
# 输入密码，然后我们就进入战斗状态！

# 更新系统（就像每天早上刷新朋友圈）
sudo apt update && sudo apt upgrade -y

# 安装WireGuard（一键安装，毫无难度）
sudo apt install wireguard wireguard-tools -y

# 检查是否安装成功（看到版本号就OK）
wg --version

# 进入WireGuard配置目录
cd /etc/wireguard

# 生成密钥对（公钥私钥，就像账号密码）
sudo wg genkey | tee server-private.key | wg pubkey > server-public.key

# 查看公钥（记下来，后面要用）
echo "服务器的公钥是："
cat server-public.key

# 创建配置文件
sudo nano /etc/wireguard/wg0.conf

[Interface]
Address = 10.200.200.1/24
ListenPort = 51820
PrivateKey = [你的服务器私钥]

# 允许IP转发（重要！不然数据包就卡住了）
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# 注意：这里先不添加[Peer]部分，等客户端准备好再加

# 创建项目目录
sudo mkdir -p /opt/wg-mesh
cd /opt/wg-mesh

# 创建Python虚拟环境（就像给应用单独一个房间）
sudo apt install python3 python3-pip python3-venv -y
sudo python3 -m venv venv

# 激活虚拟环境并安装Flask
sudo venv/bin/pip install flask

# 创建主程序文件
sudo nano /opt/wg-mesh/mesh-api.py

#!/usr/bin/env python3
"""
WireGuard Mesh API - 让所有局域网自动找到彼此
作者：Huwencai.com
功能：自动发现、自动连接、自动更新
"""

from flask import Flask, request, jsonify
import subprocess
import re
from datetime import datetime
import threading

app = Flask(__name__)

# 线程锁，防止多个人同时修改数据打架
lock = threading.Lock()

def parse_wg_show():
    """解析wg show的输出，提取所有对端信息"""
    try:
        # 执行wg show命令
        result = subprocess.run(
            ['wg', 'show', 'wg0'],
            capture_output=True,
            text=True,
            check=True
        )

        peers = {}
        current_peer = None

        # 逐行解析输出
        for line in result.stdout.split('\n'):
            line = line.strip()

            # 发现新的对等端
            if line.startswith('peer:'):
                if current_peer and 'public_key' in current_peer:
                    peers[current_peer['public_key']] = current_peer

                public_key = line[5:].strip()
                current_peer = {
                    'public_key': public_key,
                    'endpoint': None,
                    'allowed_ips': [],
                    'latest_handshake': None,
                    'wireguard_ip': None,
                    'lan_networks': []
                }

            # 提取endpoint（打洞信息）
            elif line.startswith('endpoint:'):
                if current_peer:
                    current_peer['endpoint'] = line[9:].strip()

            # 提取允许的IP地址
            elif line.startswith('allowed ips:'):
                if current_peer:
                    ips = line[12:].strip().split(', ')
                    current_peer['allowed_ips'] = ips

                    # 区分WireGuard隧道IP和局域网网段
                    for ip in ips:
                        if ip.endswith('/32'):
                            current_peer['wireguard_ip'] = ip.split('/')[0]
                        else:
                            current_peer['lan_networks'].append(ip)

            # 提取最近握手时间
            elif line.startswith('latest handshake:'):
                if current_peer:
                    current_peer['latest_handshake'] = line[18:].strip()

        # 别忘了最后一个对等端
        if current_peer and 'public_key' in current_peer:
            peers[current_peer['public_key']] = current_peer

        return peers

    except Exception as e:
        print(f"解析wg show时出错: {e}")
        return {}

@app.route('/api/peers', methods=['GET'])
def get_peers():
    """
    获取所有可连接的对端（排除自己和没有endpoint的）
    客户端通过这个接口找到其他局域网
    """
    with lock:
        # 解析当前WireGuard状态
        all_peers = parse_wg_show()

        # 获取客户端IP（从WireGuard隧道）
        client_ip = request.remote_addr

        # 找出客户端对应的对等端信息
        client_info = None
        for peer in all_peers.values():
            if peer.get('wireguard_ip') == client_ip:
                client_info = peer
                break

        # 如果客户端不在列表中，拒绝访问
        if not client_info:
            return jsonify({
                'error': '未授权的访问',
                'message': '请先连接到WireGuard服务器'
            }), 403

        # 收集其他对端信息（排除自己，且必须有endpoint）
        other_peers = []
        for pub_key, peer in all_peers.items():
            # 排除自己
            if pub_key == client_info['public_key']:
                continue

            # 只返回有endpoint的对端（已经成功打洞的）
            if peer.get('endpoint'):
                other_peers.append({
                    'public_key': pub_key,
                    'endpoint': peer['endpoint'],
                    'wireguard_ip': peer.get('wireguard_ip'),
                    'lan_networks': peer.get('lan_networks', []),
                    'latest_handshake': peer.get('latest_handshake')
                })

        return jsonify({
            'client': {
                'public_key': client_info['public_key'],
                'wireguard_ip': client_info.get('wireguard_ip'),
                'lan_networks': client_info.get('lan_networks', [])
            },
            'peers': other_peers,
            'total': len(other_peers),
            'timestamp': datetime.now().isoformat()
        })

@app.route('/api/status', methods=['GET'])
def get_status():
    """查看系统状态（管理员用）"""
    with lock:
        peers = parse_wg_show()

        status = {
            'total_peers': len(peers),
            'active_peers': len([p for p in peers.values() if p.get('endpoint')]),
            'inactive_peers': len([p for p in peers.values() if not p.get('endpoint')]),
            'peers': []
        }

        for pub_key, peer in peers.items():
            status['peers'].append({
                'public_key_short': pub_key[:16] + '...',
                'has_endpoint': peer.get('endpoint') is not None,
                'endpoint': peer.get('endpoint', '等待连接...'),
                'wireguard_ip': peer.get('wireguard_ip'),
                'lan_networks': peer.get('lan_networks', []),
                'latest_handshake': peer.get('latest_handshake')
            })

        return jsonify(status)

@app.route('/api/health', methods=['GET'])
def health():
    """健康检查"""
    return jsonify({
        'status': 'healthy',
        'service': 'wireguard-mesh',
        'time': datetime.now().isoformat()
    })

if __name__ == '__main__':
    print("WireGuard Mesh API 启动中...")
    print("监听地址: 10.200.200.1:8000")
    print("访问 http://10.200.200.1:8000/api/status 查看状态")
    app.run(host='10.200.200.1', port=8000, debug=False)

# 创建服务文件
sudo nano /etc/systemd/system/wg-mesh-api.service

[Unit]
Description=WireGuard Mesh API Service
[email protected]
[email protected]

[Service]
Type=simple
User=root
WorkingDirectory=/opt/wg-mesh
ExecStart=/opt/wg-mesh/venv/bin/python /opt/wg-mesh/mesh-api.py
Restart=always
RestartSec=10
Environment="PYTHONUNBUFFERED=1"

[Install]
WantedBy=multi-user.target

# 启用IP转发（让数据包能通过服务器转发）
sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
sudo sysctl -p

# 启动WireGuard
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

# 启动API服务
sudo systemctl enable wg-mesh-api
sudo systemctl start wg-mesh-api

# 检查状态（两个都应该是active）
sudo systemctl status wg-quick@wg0
sudo systemctl status wg-mesh-api

# 测试API是否正常工作
curl http://localhost:8000/api/health
# 应该返回：{"status":"healthy","service":"wireguard-mesh"}

# 查看WireGuard状态
sudo wg show
# 这时应该只有服务器信息，没有peers

# 添加RouterOS-A为对等端
sudo wg set wg0 peer [粘贴RouterOS-A的公钥] allowed-ips 10.200.200.2/32,192.168.88.0/24 persistent-keepalive 25

# 保存配置
sudo wg-quick save wg0

# 检查是否添加成功
sudo wg show
# 现在应该能看到一个peer，但endpoint还是空的（等客户端连接后才有）

{
# ============================================
# WireGuard Mesh 自动发现脚本
# 功能：自动发现其他局域网并建立直连
# 作者：Huwencai.com
# ============================================

# 配置信息
:local apiServer "10.200.200.1:8000"
:local wgInterface "wg-mesh"
:local myLanNetworks "192.168.88.0/24"

# 记录开始时间（用来计算执行时间）
:local startTime [/system clock get time]

# 1. 从API获取所有可连接的对端
:log info "开始搜索其他局域网..."
/tool fetch url="http://$apiServer/api/peers" mode=http dst-path="/tmp/peers.json"

:local response [/file get [/file find name="peers.json"] contents]
/file remove [/file find name="peers.json"]

:if ([:len $response] < 10) do={
    :log warning "API无响应，请检查网络连接"
    :return
}

:try {
    # 解析JSON响应
    :local jsonObj [:parse $response]
    :local peers ($jsonObj->"peers")
    :local totalPeers ($jsonObj->"total")

    :log info "发现 $totalPeers 个可连接的对端"

    # 2. 获取当前已存在的动态对等端
    :local existingDynamicPeers [:toarray ""]
    :local allCurrentPeers [/interface wireguard peers find where interface=$wgInterface]

    :foreach peerIdx in $allCurrentPeers do={
        :local peerComment [/interface wireguard peers get $peerIdx comment]
        :if ([:find $peerComment "mesh-auto:"] = 0) do={
            :local pubKey [/interface wireguard peers get $peerIdx public-key]
            :set ($existingDynamicPeers->[:len $existingDynamicPeers]) $pubKey
        }
    }

    # 3. 处理每个发现的對端
    :local addedCount 0
    :local updatedCount 0

    :foreach i in=[:range 0 $totalPeers - 1] do={
        :local peer ($peers->$i)
        :local peerPubKey ($peer->"public_key")
        :local peerEndpoint ($peer->"endpoint")
        :local peerLanNetworks ($peer->"lan_networks")
        :local peerWireguardIp ($peer->"wireguard_ip")

        # 只处理有endpoint的对端（已经打洞成功的）
        :if ([:len $peerEndpoint] > 0) do={
            # 构建allowed addresses（允许访问的IP范围）
            :local allowedAddresses ""
            :foreach lanNet in $peerLanNetworks do={
                :if ([:len $allowedAddresses] = 0) do={
                    :set allowedAddresses $lanNet
                } else={
                    :set allowedAddresses ($allowedAddresses . "," . $lanNet)
                }
            }

            # 添加WireGuard隧道IP
            :if ([:len $peerWireguardIp] > 0) do={
                :if ([:len $allowedAddresses] = 0) do={
                    :set allowedAddresses ($peerWireguardIp . "/32")
                } else={
                    :set allowedAddresses ($allowedAddresses . "," . $peerWireguardIp . "/32")
                }
            }

            # 检查是否已存在此对等端
            :local existingPeer [/interface wireguard peers find where interface=$wgInterface && public-key=$peerPubKey]

            :if ([:len $existingPeer] = 0) do={
                # 添加新的对等端（建立直连）
                /interface wireguard peers add interface=$wgInterface \
                    public-key=$peerPubKey \
                    endpoint=$peerEndpoint \
                    allowed-address=$allowedAddresses \
                    persistent-keepalive=25s \
                    comment=("mesh-auto:" . $peerWireguardIp)

                :set addedCount ($addedCount + 1)
                :log info "✅ 新增直连: $peerWireguardIp ($peerEndpoint)"
            } else={
                # 检查是否需要更新
                :local currentEndpoint [/interface wireguard peers get $existingPeer value-name=endpoint-address]
                :local currentAllowed [/interface wireguard peers get $existingPeer value-name=allowed-address]

                :local needsUpdate false

                :if ($currentEndpoint != $peerEndpoint) do={
                    /interface wireguard peers set $existingPeer endpoint-address=$peerEndpoint
                    :set needsUpdate true
                }

                :if ($currentAllowed != $allowedAddresses) do={
                    /interface wireguard peers set $existingPeer allowed-address=$allowedAddresses
                    :set needsUpdate true
                }

                :if ($needsUpdate = true) do={
                    :set updatedCount ($updatedCount + 1)
                    :log info "🔄 更新连接: $peerWireguardIp"
                }
            }

            # 从现有列表中移除（表示这个对端还存在）
            :local newExistingPeers [:toarray ""]
            :foreach existingPubKey in $existingDynamicPeers do={
                :if ($existingPubKey != $peerPubKey) do={
                    :set ($newExistingPeers->[:len $newExistingPeers]) $existingPubKey
                }
            }
            :set existingDynamicPeers $newExistingPeers
        }
    }

    # 4. 清理不再存在的对等端
    :foreach stalePubKey in $existingDynamicPeers do={
        :local stalePeer [/interface wireguard peers find where interface=$wgInterface && public-key=$stalePubKey]
        :if ([:len $stalePeer] > 0) do={
            /interface wireguard peers remove $stalePeer
            :log info "🗑️ 移除过期连接: $stalePubKey"
        }
    }

    # 5. 添加路由（让数据包知道怎么走）
    :foreach i in=[:range 0 $totalPeers - 1] do={
        :local peer ($peers->$i)
        :local peerLanNetworks ($peer->"lan_networks")
        :local peerWireguardIp ($peer->"wireguard_ip")

        :foreach lanNet in $peerLanNetworks do={
            :local routeExists [/ip route find where dst-address=$lanNet]
            :if ([:len $routeExists] = 0) do={
                /ip route add dst-address=$lanNet gateway=$peerWireguardIp distance=1
                :log info "🛣️ 添加路由: $lanNet -> $peerWireguardIp"
            }
        }
    }

    # 6. 记录执行结果
    :local endTime [/system clock get time]
    :local duration ($endTime - $startTime)

    :log info "========================================"
    :log info "自动发现完成！"
    :log info "新增连接: $addedCount 个"
    :log info "更新连接: $updatedCount 个"
    :log info "移除连接: [:len $existingDynamicPeers] 个"
    :log info "总对端数: $totalPeers 个"
    :log info "执行时间: $duration 秒"
    :log info "========================================"

} :catch (error) {
    :log error "脚本执行出错: $error"
}
}

   sudo wg set wg0 peer [RouterOS-B的公钥] allowed-ips 10.200.200.3/32,192.168.89.0/24 persistent-keepalive 25

# 在云服务器上执行
sudo wg show
# 应该看到两个peer，都有endpoint信息

curl http://localhost:8000/api/status
# 应该看到两个活跃对端

ping 192.168.89.1

   # 假设是第三个局域网，网段192.168.90.0/24
   sudo wg set wg0 peer [新路由器公钥] allowed-ips 10.200.200.4/32,192.168.90.0/24 persistent-keepalive 25
   sudo wg-quick save wg0

   /interface wireguard disable wg-mesh
   /interface wireguard enable wg-mesh

# 在云服务器上检查
sudo systemctl status wg-mesh-api
sudo netstat -tlnp | grep 8000
# 如果端口没监听，重启服务
sudo systemctl restart wg-mesh-api

{
:local wgInterface "wg-mesh"
:local peers [/interface wireguard peers find where interface=$wgInterface]

:foreach peerIdx in $peers do={
    :local lastHandshake [/interface wireguard peers get $peerIdx latest-handshake]
    :local now [/system clock get time]

    :if ($now - $lastHandshake > 180) do={
        :log warning "对端 $peerIdx 超过3分钟无响应"
        # 可以在这里添加自动修复逻辑
    }
}
}