VPNs (Virtual Private Networks) create encrypted tunnels between hosts or networks. WireGuard is the modern, fast, simple VPN that's now built into the Linux kernel. OpenVPN is the legacy choice. IPsec is the enterprise standard.
| Item | Syntax / Value | Description |
|---|---|---|
| WireGuard | wg / wg-quick — modern VPN built into Linux kernel | Fast, simple, cryptographically sound — UDP-based |
| wg genkey | wg genkey | tee server.key | wg pubkey > server.pub | Generate WireGuard private/public key pair |
| wg show | sudo wg show | Show WireGuard interface status and peers |
| wg-quick up | sudo wg-quick up wg0 | Start WireGuard interface from config |
| wg-quick down | sudo wg-quick down wg0 | Stop WireGuard interface |
| /etc/wireguard/wg0.conf | [Interface] + [Peer] sections | WireGuard server/client configuration file |
| [Interface] | PrivateKey, Address, ListenPort, DNS | Local WireGuard interface config |
| [Peer] | PublicKey, AllowedIPs, Endpoint | Remote peer configuration |
| AllowedIPs | 0.0.0.0/0, ::/0 | Route all traffic through VPN (full tunnel) |
| AllowedIPs split | 10.0.0.0/8, 192.168.0.0/16 | Route only private traffic (split tunnel) |
| PersistentKeepalive | PersistentKeepalive = 25 | Keep NAT mapping alive — needed behind NAT |
| OpenVPN | openvpn --config client.ovpn | Legacy SSL/TLS-based VPN |
| OpenVPN server | openvpn --config server.conf --daemon | Run OpenVPN server |
| EasyRSA | easyrsa init-pki, build-ca, gen-req, sign-req | PKI management for OpenVPN |
| IPsec | strongSwan / libreswan — IKEv2/IPsec | Enterprise VPN standard — complex but universal |
| IKEv2 | Internet Key Exchange v2 — IPsec key negotiation | More stable than IKEv1 — supports MOBIKE for roaming |
| PPTP | Point-to-Point Tunneling Protocol | Legacy — DO NOT USE — broken encryption |
| L2TP/IPsec | Layer 2 Tunneling + IPsec encryption | Built into iOS/Android/Windows — requires IPsec layer |
| Split tunneling | Only route specific traffic through VPN | Send corporate traffic through VPN, rest direct |
| Kill switch | Block all traffic if VPN drops | iptables rule that blocks non-VPN traffic |
| DNS leak | DNS queries bypass VPN tunnel | Test at dnsleaktest.com — set DNS in WireGuard config |
# WireGuard VPN Setup — Server and Client # ── Install WireGuard ───────────────────────────────────────── sudo apt install wireguard wireguard-tools # Ubuntu sudo modprobe wireguard # load kernel module # ── Server Setup ────────────────────────────────────────────── # Generate server keys wg genkey | sudo tee /etc/wireguard/server.key sudo chmod 600 /etc/wireguard/server.key sudo cat /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub # Generate client keys (do this for each client) wg genkey | tee client.key cat client.key | wg pubkey > client.pub echo "Client private: $(cat client.key)" echo "Client public: $(cat client.pub)" # Server config: /etc/wireguard/wg0.conf sudo tee /etc/wireguard/wg0.conf << EOF [Interface] PrivateKey = $(sudo cat /etc/wireguard/server.key) Address = 10.10.0.1/24 ListenPort = 51820 # Enable IP forwarding and NAT (acts as VPN gateway) PostUp = echo 1 > /proc/sys/net/ipv4/ip_forward; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE # Client 1: Alice's laptop [Peer] PublicKey = $(cat client.pub) AllowedIPs = 10.10.0.2/32 EOF # Start and enable WireGuard sudo wg-quick up wg0 sudo systemctl enable wg-quick@wg0 sudo wg show # ── Client Config ───────────────────────────────────────────── cat > client.conf << EOF [Interface] PrivateKey = $(cat client.key) Address = 10.10.0.2/24 DNS = 10.10.0.1 # Use VPN server as DNS (prevent DNS leaks) [Peer] PublicKey = $(sudo cat /etc/wireguard/server.pub) Endpoint = mywebuniversity.com:51820 AllowedIPs = 0.0.0.0/0, ::/0 # full tunnel: all traffic via VPN PersistentKeepalive = 25 # keep NAT alive EOF # ── Client connect ──────────────────────────────────────────── # Linux sudo wg-quick up ./client.conf sudo wg show # Test: curl https://ifconfig.me should show server's IP # QR code for mobile (iOS/Android WireGuard app) sudo apt install qrencode qrencode -t ansiutf8 < client.conf # ── Split tunnel variant ────────────────────────────────────── # Only route corporate traffic through VPN: cat > split-tunnel.conf << 'EOF' [Interface] PrivateKey = YOUR_CLIENT_PRIVATE_KEY Address = 10.10.0.2/24 [Peer] PublicKey = SERVER_PUBLIC_KEY Endpoint = vpn.mywebuniversity.com:51820 # Only route private ranges + VPN subnet through tunnel AllowedIPs = 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 10.10.0.0/24 PersistentKeepalive = 25 EOF # ── Status and troubleshooting ──────────────────────────────── sudo wg show # show all interfaces and peers sudo wg show wg0 transfer # bytes sent/received per peer ip route show table all | grep wg0 # routing table entries ping 10.10.0.1 # ping server through VPN sudo journalctl -u wg-quick@wg0 -f # service logs