VPNs with WireGuard
You build remote-access and site-to-site VPNs with WireGuard, manage keys and set up routing and DNS through the tunnel correctly.
Level 201 · 17 lessons · 15 practice labs
Lessons
VPN basics
- What a VPN is: tunnel, encryption, authentication
- Remote-access and site-to-site VPNs
- WireGuard concepts: peers, keys, AllowedIPs
- Short task: choose the right VPN type for three scenarios
The first tunnel
- Generating keys with wg
- The configuration file with wg-quick
- The first tunnel between two machines
- Watching handshakes and transfer with wg show
- Short task: build and verify a tunnel between two servers
Real scenarios
- Remote access for travelling staff
- Full tunnel and split tunnel
- DNS through the tunnel
- Linking two offices with WireGuard
- Peers behind NAT and PersistentKeepalive
- Rotating keys and removing peers
- Short task: revoke a departing employee’s VPN access
Wrap-up
- Capstone: a WireGuard remote-access service for a company
Practice labs
- No handshake: the keys are mixed up: Find the wrongly entered public key keeping a WireGuard tunnel between two servers from ever shaking hands, fix it and show the latest handshake in "wg show".
- Handshake yes, ping no: Starting from the transfer counters, find the AllowedIPs mistake in a tunnel that shakes hands but passes no traffic, fix it and prove it with ping both ways.
- The tunnel only works one way: Find the three faults (wrong endpoint port, filtered UDP, forwarding off) in Cinnamon Café’s head-office-to-branch tunnel, fix them and show access from the branch LAN to the head-office LAN.
- VPN access for a new field worker: Add a peer for a new field worker to Caravan Travel’s server, produce the client configuration file and show access to an internal server from the client.
- All internet traffic goes through the VPN: Change a configuration that carries all client traffic to head office so only company subnets use the tunnel, and prove it with the client’s routing table and traceroutes to two targets.
- DNS and IPv6 leak from the full tunnel: Show with a capture that DNS queries and IPv6 traffic leave outside the tunnel on a full-tunnel client, fix the configuration so nothing leaks and prove it with the same capture.
- Tunnel ends talk, the LANs do not: Find why the tunnel addresses reach each other between two offices but the LANs do not (subnet missing from AllowedIPs, missing route), fix it and show LAN-to-LAN ping.
- A third office joined: branches cannot see each other: Adjust AllowedIPs and forwarding at the hub and branches so Ekin Co-op’s two branches, connected through head office, can reach each other, and show the path with a branch-to-branch traceroute.
- Two offices use the same subnet: Link two offices that use the same address block without renumbering by setting up network translation inside the tunnel, and show a server in each office reached from the other through its translated address.
- The link drops after five idle minutes: Solve a peer behind NAT becoming unreachable from head office after a while with PersistentKeepalive, and prove it with a ping started from head office after an idle wait.
- Ping works, file transfers stall: Find the MTU value stalling large transfers over the tunnel by measuring the smallest MTU on the path, adjust the tunnel and prove it with a large file transfer.
- Both ends are behind NAT: Connect two offices that cannot tunnel directly because both sit behind NAT through a relay server with a public address, and show the relay forwards only between these two networks.
- Cut off the lost phone: Remove a lost phone’s peer from the running tunnel and the configuration file without dropping other users, and show that key can no longer complete a handshake.
- Rotate the server key: Rotate the key pair of Tulip Pharmacy’s VPN server, update the client configurations and show the old public key no longer works while the new one does.
- Who are these peers? A VPN audit: On a WireGuard server that has grown for years, find peers with no recent handshake, overlapping AllowedIPs or no known owner, fix the world-readable private key file and write the clean-up report.
About this course
You build remote-access and site-to-site VPNs with WireGuard, manage keys and set up routing and DNS through the tunnel correctly.
What you will learn
- VPN basics
- The first tunnel
- Real scenarios
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.