What WireGuard is
WireGuard is a modern VPN protocol built around a small set of cryptographic primitives and a simple peer model. Each peer is identified by a public key and is assigned the network ranges it is allowed to send or receive through the tunnel.
Why I use it
I use WireGuard directly and indirectly across the lab. It provides the encrypted transport behind Tailscale, supports point-to-point and routed access, and is suitable for travel-router connections where I want devices to reach selected home services without exposing administrative interfaces publicly.
How it fits the network
WireGuard peers terminate on controlled network points such as Linux systems, pfSense or a travel router. Firewall rules then decide which VLANs and services are reachable. This separates the encrypted tunnel from the authorisation policy instead of treating VPN access as unrestricted access to the whole LAN.
What I monitor
- Peer handshakes and stale connections
- Allowed IP ranges and route overlap
- DNS behaviour through the tunnel
- Firewall rules between VPN and internal VLANs
- MTU and path issues on mobile or hotel networks
WireGuard peer configuration
[Interface]
Address = 10.20.30.2/32
PrivateKey = <CLIENT_PRIVATE_KEY>
DNS = 10.20.30.1
[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = vpn.example.invalid:51820
AllowedIPs = 10.20.0.0/16
PersistentKeepalive = 25Restrict the listening port at the firewall, protect private keys and test handshake, routing, DNS and revocation before wider use.
Generate a unique key pair for each peer, configure a small private tunnel subnet and add only the routes each peer needs.