Blog

  1. WireGuard With Overlapping Client Networks

    by Justin Ludwig
  2. WireGuard
  3. Networking
  4. Routing
  5. nftables
  6. Point to Point
    7.
    How to avoid address space collisions when connecting to networks you don’t control.
    Read more…

  7. WireGuard Port Forwarding From the Internet to Other Networks

    by Justin Ludwig
  8. WireGuard
  9. Networking
  10. Routing
  11. Hub and Spoke
  12. Point to Site
    13.
    How to forward traffic from the Internet through multiple hops to another server (using netfilter connmark).
    Read more…

  13. Pro Custodibus On-Premises With Rootless Podman

    by Justin Ludwig
  14. Pro Custodibus
  15. Containers
    16.
    How to use Podman, Firewalld, and Let’s Encrypt to run Pro Custodibus Community Edition.
    Read more…

  16. Quick Start for Pro Custodibus On-Premises

    by Justin Ludwig
  17. Pro Custodibus
  18. Containers
    19.
    How to get started with Pro Custodibus Community Edition, using Docker containers.
    Read more…

  19. Troubleshooting WireGuard DNS Issues

    by Jennifer Ormond
  20. WireGuard
  21. Networking
  22. DNS
    23.
    How to debug WireGuard DNS problems.
    Read more…

  23. Troubleshooting WireGuard with Tcpdump

    by Justin Ludwig
  24. WireGuard
  25. Networking
    26.
    How to debug WireGuard connection issues using tcpdump.
    Read more…

  26. WireGuard Transparent Tunnel

    by Justin Ludwig
  27. WireGuard
  28. Networking
  29. Routing
  30. Point to Point
    31.
    How to use the same IP addresses for a point-to-point tunnel when WireGuard is up as when down.
    Read more…

  31. Using WireGuard For Specific Apps on Linux

    by Justin Ludwig
  32. WireGuard
  33. Networking
  34. Routing
  35. Point to Site
    36.
    How to selectively enable or disable a WireGuard tunnel for any program via network namespaces.
    Read more…

  36. An Opinionated YubiKey Set-Up Guide

    by Justin Ludwig
  37. Smart Cards
  38. Keys
  39. SSH
    40.
    How to set up a YubiKey 5 in 2023.
    Read more…

  40. WireGuard Key on an OpenPGP Card

    by Justin Ludwig
  41. WireGuard
  42. Smart Cards
  43. Keys
    44.
    How to use a WireGuard key stored on an OpenPGP card.
    Read more…

  44. Installing GnuPG 2.4 on Ubuntu 22.04

    by Justin Ludwig
  45. Smart Cards
    46.
    How to build and install GPG 2.4.x on Ubuntu 22.04.
    Read more…

  46. 3 Ways to Protect WireGuard With YubiKey

    (updated )
    by Justin Ludwig
  47. WireGuard
  48. Smart Cards
  49. Keys
    50.
    How to use a YubiKey to protect your WireGuard private keys.
    Read more…

  50. More Tools for Monitoring WireGuard Data Usage

    by Jennifer Ormond
  51. WireGuard
  52. Monitoring
  53. Pro Custodibus
    54.
    Some recently-added features of Pro Custodibus for monitoring WireGuard usage.
    Read more…

  54. Internal DNS Names With WireGuard

    by Jennifer Ormond
  55. WireGuard
  56. DNS
    57.
    How to set up a WireGuard peer as a CoreDNS server.
    Read more…

  57. Preventing Lateral Movement With WireGuard

    by Justin Ludwig
  58. WireGuard
  59. Networking
  60. Security
  61. nftables
  62. Point to Point
  63. Hub and Spoke
    64.
    How to use micro-segmentation with WireGuard to stop an attacker from moving laterally in your network.
    Read more…

  64. Limiting WireGuard Bandwidth

    by Justin Ludwig
  65. WireGuard
  66. Networking
    67.
    How to limit the bandwidth used by a WireGuard connection.
    Read more…

  67. WireGuard Performance Tuning

    (updated )
    by Justin Ludwig
  68. WireGuard
  69. Networking
    70.
    A guide to testing and tuning WireGuard network performance.
    Read more…

  70. Best Linux Firewall for WireGuard

    by Jennifer Ormond
  71. WireGuard
  72. Networking
  73. Firewall
  74. firewalld
  75. nftables
    76.
    Best options for setting up a simple firewall for WireGuard on Linux.
    Read more…

  76. How to Set Up a WireGuard Jumphost

    by Jennifer Ormond
  77. WireGuard
  78. Networking
  79. Firewall
  80. nftables
  81. Point to Site
    82.
    A simple WireGuard jumphost tutorial.
    Read more…

  82. Installing Libsodium on Amazon Linux 2023

    (updated )
    by Justin Ludwig
  83. Cloud
  84. AWS
    85.
    How to install libsodium on Amazon Linux 2022/2023.
    Read more…

  85. WireGuard in Podman Rootless Containers

    by Justin Ludwig
  86. WireGuard
  87. Containers
    88.
    13 common patterns for running WireGuard in Podman containers.
    Read more…

  88. OPNsense Push Routes Through WireGuard Via OSPF

    by Justin Ludwig
  89. WireGuard
  90. Networking
  91. Routing
  92. Site to Site
    93.
    How to use OSPF to share routes from an OPNsense router over WireGuard.
    Read more…

  93. OPNsense WireGuard Site to Site

    by Justin Ludwig
  94. WireGuard
  95. Networking
  96. Site to Site
    97.
    How to connect an OPNsense router to a Linux router over WireGuard.
    Read more…

  97. WireGuard Port Forwarding From the Internet

    by Justin Ludwig
  98. WireGuard
  99. Networking
  100. Routing
  101. Point to Site
    102.
    How to forward inbound traffic from the Internet to another server using WireGuard.
    Read more…

  102. Zero Trust Architecture With WireGuard

    by Justin Ludwig
  103. WireGuard
  104. Networking
  105. Firewall
  106. nftables
  107. Hub and Spoke
    108.
    How to get started implementing a zero-trust architecture.
    Read more…

  108. Connecting WireGuard and OpenVPN

    by Justin Ludwig
  109. WireGuard
  110. Networking
  111. Hub and Spoke
    112.
    How to connect WireGuard and OpenVPN networks.
    Read more…

  112. WireGuard Automatic Key Rotation With Pro Custodibus

    by Jennifer Ormond
  113. WireGuard
  114. Security
  115. Keys
  116. Pro Custodibus
    117.
    Why and how to set up automatic WireGuard preshared key rotation with Pro Custodibus.
    Read more…

  117. Set Up a New User Device With WireGuard MFA

    by Jennifer Ormond
  118. WireGuard
  119. Security
  120. Pro Custodibus
    121.
    How to enroll a new user and device into WireGuard MFA with Pro Custodibus.
    Read more…

  121. WireGuard Multi-Factor Authentication With Pro Custodibus

    by Justin Ludwig
  122. WireGuard
  123. Security
  124. Pro Custodibus
    125.
    How to set up and use WireGuard MFA with Pro Custodibus.
    Read more…

  125. Multi-Hop WireGuard

    by Justin Ludwig
  126. WireGuard
  127. Networking
  128. Routing
  129. Hub and Spoke
  130. Point to Site
    131.
    Combine hub-and-spoke with other topologies for a multi-hop WireGuard network.
    Read more…

  131. Configure WireGuard via AWS SSM Parameter Store

    by Justin Ludwig
  132. WireGuard
  133. Cloud
  134. AWS
  135. Containers
    136.
    How to configure a WireGuard container with parameters from the Amazon Systems Manager.
    Read more…

  136. WireGuard on AWS ECS

    by Justin Ludwig
  137. WireGuard
  138. Cloud
  139. AWS
  140. Containers
  141. Point to Site
    142.
    How to run a WireGuard container on the Amazon Elastic Container Service.
    Read more…

  142. Installing WireGuard on Amazon Linux

    (updated )
    by Justin Ludwig
  143. WireGuard
  144. Cloud
  145. AWS
    146.
    How to install WireGuard on Amazon Linux 2 and Amazon Linux 2023.
    Read more…

  146. Firewalld Policy-Based Access Control for WireGuard

    by Justin Ludwig
  147. WireGuard
  148. Networking
  149. Firewall
  150. firewalld
    151.
    How to use firewalld policies for network access control.
    Read more…

  151. Push WireGuard Logs to Datadog SIEM

    by Justin Ludwig
  152. WireGuard
  153. Security
  154. Monitoring
  155. Pro Custodibus
    156.
    How to connect Pro Custodibus to Datadog.
    Read more…

  156. WireGuard DNS Configuration for Systemd

    by Jennifer Ormond
  157. WireGuard
  158. DNS
    159.
    Systemd-resolved DNS settings for WireGuard.
    Read more…

  159. Poor Man’s BeyondCorp with WireGuard

    by Justin Ludwig
  160. WireGuard
  161. Networking
  162. Firewall
  163. nftables
  164. Hub and Spoke
    165.
    Implementing BeyondCorp-like access control with WireGuard and nftables.
    Read more…

  165. WireGuard Over TCP

    by Justin Ludwig
  166. WireGuard
  167. Networking
  168. Point to Point
    169.
    How to use udp2raw to tunnel Wireguard over TCP.
    Read more…

  169. WireGuard Remote Access to Docker Containers

    by Justin Ludwig
  170. WireGuard
  171. Containers
    172.
    How to safely expose container services through WireGuard.
    Read more…

  172. Wg-quick Default Firewall Rules

    by Justin Ludwig
  173. WireGuard
  174. Firewall
  175. iptables
  176. nftables
    177.
    An explanation of the firewall rules wg-quick sets up by default.
    Read more…

  177. WireGuard With AWS Split DNS

    by Jennifer Ormond
  178. WireGuard
  179. Cloud
  180. AWS
  181. DNS
    182.
    Use a Route 53 private hosted zone to access internal AWS resources with WireGuard.
    Read more…

  182. WireGuard End-to-End Encrypted Hub-and-Spoke

    by Justin Ludwig
  183. WireGuard
  184. Networking
  185. Hub and Spoke
    186.
    How to use end-to-end encryption with a WireGuard hub-and-spoke topology.
    Read more…

  186. SSH Jumphost Vs WireGuard Jumphost

    by Justin Ludwig
  187. SSH
  188. WireGuard
  189. Point to Site
    190.
    Why WireGuard is better for jump servers than SSH.
    Read more…

  190. How to Use WireGuard With Nftables

    (updated )
    by Justin Ludwig
  191. WireGuard
  192. Networking
  193. Firewall
  194. nftables
    195.
    How to set up nftables for WireGuard under five different scenarios.
    Read more…

  195. Building, Using, and Monitoring WireGuard Containers

    (updated )
    by Justin Ludwig
  196. WireGuard
  197. Pro Custodibus
  198. Containers
    199.
    Running Docker containers with WireGuard and the Pro Custodibus agent.
    Read more…

  199. High Availability WireGuard Site to Site

    by Justin Ludwig
  200. WireGuard
  201. Networking
  202. Routing
  203. High Availability
  204. Site to Site
    205.
    How to connect sites with redundant WireGuard routers.
    Read more…

  205. WireGuard Key Rotation With Pro Custodibus

    by Justin Ludwig
  206. WireGuard
  207. Security
  208. Keys
  209. Pro Custodibus
    210.
    How to rotate WireGuard keys the easy way with the Pro Custodibus GUI.
    Read more…

  210. Add a WireGuard Peer With the Pro Custodibus GUI

    by Jennifer Ormond
  211. WireGuard
  212. Pro Custodibus
    213.
    How to add a WireGuard peer with the Pro Custodibus web UI.
    Read more…

  213. Securing Operational Technology With WireGuard

    by Justin Ludwig
  214. WireGuard
  215. Networking
  216. iptables
  217. Site to Site
    218.
    How to secure Operational Technology systems with WireGuard
    Read more…

  218. Use a GUI to Set Up WireGuard Point-to-Site

    (updated )
    by Justin Ludwig
  219. WireGuard
  220. Pro Custodibus
  221. Point to Site
    222.
    How to set up a WireGuard network with the Pro Custodibus web UI.
    Read more…

  222. How to Use WireGuard With Firewalld

    by Justin Ludwig
  223. WireGuard
  224. Networking
  225. Firewall
  226. firewalld
    227.
    How to set up firewalld for WireGuard under four different scenarios.
    Read more…

  227. DNS Updates to WireGuard Endpoints

    by Jennifer Ormond
  228. WireGuard
  229. Pro Custodibus
  230. DNS
    231.
    How to solve the DNS re-resolution problem for WireGuard endpoints with Pro Custodibus.
    Read more…

  231. High Availability WireGuard on Azure

    by Justin Ludwig
  232. WireGuard
  233. Cloud
  234. Networking
  235. High Availability
    236.
    How to set up WireGuard in a high-availability configuration on Microsoft Azure.
    Read more…

  236. WireGuard SysV Init Script

    by Justin Ludwig
  237. WireGuard
    238.
    How to start up WireGuard on Linux at system boot with an SysV-style init script.
    Read more…

  238. Point to Cloud WireGuard With an Azure Hub VNet

    by Justin Ludwig
  239. WireGuard
  240. Cloud
  241. Networking
  242. Point to Site
    243.
    How to set up WireGuard to access internal applications in Azure with isolated virtual networks.
    Read more…

  243. WireGuard Usage Monitoring

    by Justin Ludwig
  244. WireGuard
  245. Monitoring
  246. Pro Custodibus
    247.
    How to monitor WireGuard server usage with Pro Custodibus.
    Read more…

  247. How to Use WireGuard With UFW

    by Justin Ludwig
  248. WireGuard
  249. Networking
  250. Firewall
  251. UFW
    252.
    How to set up the Uncomplicated FireWall (UFW) for WireGuard.
    Read more…

  252. Friendly Names for WireGuard Peers

    by Jennifer Ormond
  253. WireGuard
  254. Pro Custodibus
    255.
    How to set human-readable names for WireGuard peers.
    Read more…

  255. WireGuard Point to Site Routing

    by Justin Ludwig
  256. WireGuard
  257. Networking
  258. Point to Site
    259.
    Routing strategies for the WireGuard Point to Site topology.
    Read more…

  259. WireGuard Point to Site With a Site Gateway

    by Justin Ludwig
  260. WireGuard
  261. Networking
  262. Point to Site
    263.
    How to set up a WireGuard Point to Site topology with a site gateway.
    Read more…

  263. WireGuard Point to Site With Port Forwarding

    by Justin Ludwig
  264. WireGuard
  265. Networking
  266. iptables
  267. Point to Site
    268.
    How to set up a WireGuard Point to Site topology with port forwarding (DNAT).
    Read more…

  268. WireGuard Access Control With Iptables

    by Justin Ludwig
  269. WireGuard
  270. Networking
  271. Firewall
  272. iptables
    273.
    How to apply WireGuard ACLs with an iptables firewall.
    Read more…

  273. Python 3 WireGuard Health Check

    by Justin Ludwig
  274. WireGuard
  275. Cloud
    276.
    AWS ELB WireGuard health-check service for Python 3.
    Read more…

  276. WireGuard AllowedIPs Calculator

    by Justin Ludwig
  277. WireGuard
    278.
    How to “subtract” blocks from your WireGuard AllowedIPs setting.
    Read more…

  278. WireGuard Network Map

    by Jennifer Ormond
  279. WireGuard
  280. Pro Custodibus
    281.
    How to visualize the connections between WireGuard peers.
    Read more…

  281. Four Ways to View WireGuard Logs

    by Justin Ludwig
  282. WireGuard
  283. Monitoring
    284.
    How to enable and view WireGuard logging.
    Read more…

  284. When to Use WireGuard

    by Jennifer Ormond
  285. WireGuard
    286.
    Three use-cases for using WireGuard for secure access to business/enterprise networks.
    Read more…

  286. How to Monitor for WireGuard Key Compromise

    by Justin Ludwig
  287. WireGuard
  288. Security
  289. Keys
  290. Monitoring
  291. Pro Custodibus
    292.
    How to know when your WireGuard private keys have been compromised.
    Read more…

  292. High Availability WireGuard on AWS

    (updated )
    by Justin Ludwig
  293. WireGuard
  294. Cloud
  295. AWS
  296. Networking
  297. High Availability
    298.
    How to set up WireGuard in a high-availability configuration on AWS.
    Read more…

  298. Point to Cloud WireGuard With AWS Private Subnets

    by Justin Ludwig
  299. WireGuard
  300. Cloud
  301. AWS
  302. Networking
  303. Point to Site
    304.
    How to set up WireGuard to access internal applications in AWS private subnets.
    Read more…

  304. Why You Shouldn’t Use the Same WireGuard Key on Multiple Clients

    by Justin Ludwig
  305. WireGuard
  306. Security
  307. Keys
    308.
    Reusing keys is bad security practice, and will result in a bad user experience.
    Read more…

  308. Getting Started With Pro Custodibus

    by Justin Ludwig
  309. Pro Custodibus
    310.
    How to start monitoring and managing your first WireGuard host.
    Read more…

  310. How to Monitor Who’s Connected to Your WireGuard VPN

    by Justin Ludwig
  311. WireGuard
  312. Monitoring
    313.
    Best tools for checking who’s connecting to your VPN.
    Read more…

  313. WireGuard Endpoints and IP Addresses

    by Justin Ludwig
  314. WireGuard
  315. Networking
    316.
    How packets flow between WireGuard endpoints.
    Read more…

  316. WireGuard Terminology

    by Justin Ludwig
  317. WireGuard
    318.
    What is a WireGuard Tunnel? What is a WireGuard Peer? For answers, read on!
    Read more…

  318. WireGuard Site to Site Configuration

    by Justin Ludwig
  319. WireGuard
  320. Networking
  321. iptables
  322. Site to Site
    323.
    How to set up two WireGuard peers in a Site to Site topology.
    Read more…

  323. WireGuard Point to Site Configuration

    by Justin Ludwig
  324. WireGuard
  325. Networking
  326. iptables
  327. Point to Site
    328.
    How to set up two WireGuard peers in a Point to Site (masquerading) topology.
    Read more…

  328. WireGuard Hub and Spoke Configuration

    by Justin Ludwig
  329. WireGuard
  330. Networking
  331. iptables
  332. Hub and Spoke
    333.
    How to set up three WireGuard peers in a Hub and Spoke topology.
    Read more…

  333. WireGuard Point to Point Configuration

    by Justin Ludwig
  334. WireGuard
  335. Networking
  336. iptables
  337. Point to Point
    338.
    How to set up two WireGuard peers in a Point to Point topology.
    Read more…

  338. Primary WireGuard Topologies

    (updated )
    by Justin Ludwig
  339. WireGuard
  340. Networking
    341.
    These are the four main topologies you’d consider when deciding how to connect endpoints over a WireGuard network.
    Read more…