WireGuard 셋업

# On the server
wg genkey | tee server-private.key | wg pubkey > server-public.key

# On the client (laptop)
wg genkey | tee client-private.key | wg pubkey > client-public.key

# Each side keeps its private key secret, shares only the public key
cat server-public.key
cat client-public.key

[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 51820
# If you want to NAT client traffic out the server's main interface (full-tunnel VPN):
PostUp   = iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32

[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = your-server.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

# On both sides
sudo wg-quick up wg0

# Status
sudo wg show

# Stop
sudo wg-quick down wg0

# Auto-start on boot (Linux)
sudo systemctl enable wg-quick@wg0

# Test the tunnel — from client, ping the server's tunnel IP
ping 10.0.0.1

# Verify your public IP changed (full-tunnel mode)
curl -s ifconfig.me   # should show server's public IP, not your local one