Lesson 4.13: WireGuard: reviewing VPN peers
WireGuard is a modern, small VPN built into the Linux kernel. Each peer is a public key plus the list of addresses it may use (AllowedIPs), which acts as both a routing table and an access list: 'cryptokey routing'. That simplicity makes reviews easy and mistakes costly: a key nobody removed keeps working forever, and a peer with AllowedIPs 0.0.0.0/0 on the server may claim any address. In the lab you review Northwind's VPN server: who is connected and when they last were, which keys belong to people who left, a dangerous AllowedIPs entry, and you add a new employee's key the right way.
16 min
You will learn to
- Explain WireGuard peers, keys and AllowedIPs
- Read wg show output
- Find stale and orphaned peers
- Fix AllowedIPs on the server
- Add a peer without handling its private key
Key terms
- WireGuard
- A small, modern VPN protocol in the Linux kernel, using Curve25519 keys and ChaCha20-Poly1305.
- Peer
- The other end of a tunnel, identified only by its public key.
- AllowedIPs (cryptokey routing)
- Addresses a peer may send from and that are routed to it.
- Handshake
- The key exchange a peer repeats about every two minutes while traffic flows.
- wg syncconf
- Applies a configuration file to a running interface, changing only what differs.
- Access review
- Periodic check that every access still belongs to someone who needs it.
← Ports and sockets: which program gets the data · All lessons · Auditing scheduled tasks →