AdvancedNetworking & Security

WireGuard Site-to-Site Mesh VPN for VPC Peering

Bypass expensive cloud provider VPN gateways by utilizing WireGuard to create a cryptographically secure, high-throughput overlay network between servers.

WireGuardLinux Networking

Prerequisites

UDP port 51820 open on firewalls
IP forwarding enabled

Configuration Files

wg0.conf/etc/wireguard/wg0.conf

[Interface]\nPrivateKey = <SERVER_PRIVATE_KEY>\nAddress = 10.100.0.1/24\nListenPort = 51820\n\n[Peer]\nPublicKey = <PEER_PUBLIC_KEY>\nEndpoint = 198.51.100.2:51820\nAllowedIPs = 10.100.0.2/32, 192.168.1.0/24

Explanation:Configures the local WireGuard interface and defines a remote peer, routing the peer's local subnet (192.168.1.0/24) through the tunnel.

Verification Steps

Shows active interfaces and established handshakes.

$wg show

Expected Outputinterface: wg0\n public key: ...\n peer: ...

Production Gotchas

You must enable net.ipv4.ip_forward in sysctl.conf on the WireGuard gateways to route traffic for the entire subnet.

Frequently Asked Questions

Does WireGuard support dynamic IPs?

Yes, but the peer configuration requires an initial valid Endpoint IP to perform the handshake.