WireGuard VPN Mesh Network

Summary

The current OpenVPN site-to-site setup is complex to configure and slow to onboard new peers, so a lighter peer-to-peer WireGuard mesh network was built for remote access to dev infrastructure.

System Context

• •3 sites to connect: home lab, cloud VPS, personal laptop
• •Constraint: no static IP at the home lab (NAT behind ISP modem)
• •Requirement: connection must self-heal when a peer's IP changes

Checklist

• ☑Successful ping between all 3 peers over internal WireGuard addresses
• ☑Connection self-heals after the home lab's public IP changes (dynamic DNS)
• ☑Time to add a new peer measured at under 5 minutes
• ☑No traffic leaks outside the tunnel (kill switch verified)

Commands

apt install wireguard

wg genkey | tee privatekey | wg pubkey > publickey

ip link add wg0 type wireguard

wg set wg0 private-key ./privatekey

ip address add 10.0.0.1/24 dev wg0

wg-quick up wg0

Conclusion

WireGuard's simplicity is its greatest strength. Setup takes minutes compared to hours with OpenVPN. Headscale provides a self-hosted Tailscale alternative for team coordination.