基于VPN的虚拟局域网搭建需求：以DigitalOcean服务器为中心实现设备安全互通

Great question—this setup balances secure cross-device communication with keeping your internet traffic routed directly through your paid VPN (bypassing your DigitalOcean server entirely for WAN traffic). Let's walk through exactly how to pull this off:

We'll use WireGuard (a lightweight, modern VPN protocol) on your DigitalOcean (DO) server as a virtual LAN (VLAN) control hub. Here's the breakdown:

• Your DO server handles device authentication and routes VLAN traffic between your personal devices.
• Each device connects to WireGuard only for device-to-device communication (VLAN traffic).
• All regular internet (WAN) traffic from your devices goes straight through your paid VPN provider—never touching the DO server.

Assuming you're running Ubuntu (the most common DO OS):

1. Install WireGuard:

   sudo apt update && sudo apt install wireguard -y
   

2. Generate the server's key pair:

   wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee /etc/wireguard/publickey
   

3. Create the WireGuard config file (/etc/wireguard/wg0.conf) with this template:

   [Interface]
   PrivateKey = <YOUR_SERVER_PRIVATE_KEY>  # Pull this from /etc/wireguard/privatekey
   Address = 10.0.0.1/24  # Pick any private subnet (e.g., 192.168.7.1/24 works too)
   ListenPort = 51820  # Default WireGuard UDP port
   PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
   PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
   

4. Enable IP forwarding on the server (required to route VLAN traffic):

   echo net.ipv4.ip_forward=1 | sudo tee -a /etc/sysctl.conf
   sudo sysctl -p
   

5. Start and enable WireGuard to run on boot:

   sudo systemctl enable --now wg-quick@wg0
   

6. Update your DO firewall to allow incoming UDP traffic on port 51820.

For every personal device (laptop, phone, desktop):

1. Install WireGuard (it's available for Windows, macOS, iOS, Android, and Linux).
2. Generate a unique key pair for the device (most WireGuard apps have a built-in "Generate" button; use wg genkey/wg pubkey on desktop if needed).
3. Add the device as a peer to your DO server's WireGuard config:
   Edit /etc/wireguard/wg0.conf on the server and append:

   [Peer]
   PublicKey = <DEVICE_PUBLIC_KEY>
   AllowedIPs = 10.0.0.2/32  # Assign a unique VLAN IP (e.g., 10.0.0.2, 10.0.0.3, etc.)
   

   Reload WireGuard to apply changes:

   sudo wg-quick down wg0 && sudo wg-quick up wg0
   

4. Create the device's WireGuard client config:

   [Interface]
   PrivateKey = <DEVICE_PRIVATE_KEY>
   Address = 10.0.0.2/32  # Match the IP you assigned in the server's peer config
   [Peer]
   PublicKey = <SERVER_PUBLIC_KEY>  # Get this from /etc/wireguard/publickey on the DO server
   Endpoint = <DO_SERVER_PUBLIC_IP>:51820
   AllowedIPs = 10.0.0.0/24  # *Critical*: Only route VLAN traffic through WireGuard—all other traffic uses your device's default route (paid VPN)
   PersistentKeepalive = 25  # Maintains connection if the device is behind a home NAT
   

5. On the device, connect to your paid VPN first, then connect to WireGuard. The order isn't strict, but ensuring your paid VPN is active guarantees WAN traffic uses it.

• Test device-to-device communication: Ping one device's VLAN IP (e.g., ping 10.0.0.3) from another—this should work if everything is configured correctly.
• Confirm WAN traffic bypasses the DO server: Check your public IP on a device (it should match your paid VPN's exit IP, not your DO server's IP).

• Add a pre-shared key (PSK) to each peer for extra encryption: Generate one with wg genpsk, then add PresharedKey = <PSK_VALUE> to both the server's peer entry and the device's client config.
• Use unique, strong keys for every device—never reuse keys across devices.
• Regularly update your DO server and WireGuard packages: sudo apt update && sudo apt upgrade -y
• If your paid VPN offers static IP ranges, restrict incoming WireGuard traffic on your DO firewall to those ranges for an extra layer of security.

内容的提问来源于stack exchange，提问作者user276833