🎁 Get the FREE AI Skills Starter Guide β€” Subscribe β†’
BytesAgainBytesAgain
BytesAgain β€Ί Skills β€Ί WireGuard
πŸ¦€ ClawHub

WireGuard

by @ivangdavila

Configure WireGuard VPN tunnels with secure routing and key management.

Versionv1.0.0
Downloads1,803
Stars⭐ 3
#clawhub
TERMINAL
clawhub install wireguard

πŸ“– About This Skill

name: WireGuard description: Configure WireGuard VPN tunnels with secure routing and key management. metadata: {"clawdbot":{"emoji":"πŸ”","requires":{"bins":["wg"]},"os":["linux","darwin","win32"]}}

AllowedIPs Traps (Most Common Mistakes)

  • AllowedIPs means different things on each side β€” server: what peer CAN send; client: what to ROUTE through tunnel
  • 0.0.0.0/0 routes ALL traffic including tunnel endpoint β€” breaks connectivity, must exclude server's public IP first
  • Overlapping AllowedIPs between peers = undefined routing β€” each IP range must belong to exactly one peer
  • Wrong mask silently breaks routing β€” /32 for single host, /24 for subnet, verify carefully

    • Connection Failures

  • No handshake = wrong public key, firewall blocking UDP, or wrong endpoint β€” check all three, not just one
  • One-way traffic = AllowedIPs misconfigured β€” packets go out but replies don't route back
  • Missing PersistentKeepalive = 25 breaks NAT traversal β€” peer behind NAT unreachable after ~2 minutes
  • Config file permissions must be 600 β€” wg-quick silently refuses to start with loose permissions

    • DNS Leaks

  • Without DNS = in client config, DNS queries bypass tunnel β€” leaks real IP to DNS provider
  • Full tunnel (0.0.0.0/0) without DNS config = false sense of security β€” traffic tunneled but DNS exposed

    • Routing Setup

  • IP forwarding disabled by default on Linux β€” tunnel works but packets don't route between interfaces
  • NAT required for internet access through tunnel β€” without masquerade, return packets don't find their way
  • Firewall must allow UDP on ListenPort β€” WireGuard is UDP only, no TCP fallback exists

    • Key Security

  • Private key file permissions matter β€” world-readable key is compromised, set 600 immediately after generation
  • Never transmit private keys β€” generate on each machine, exchange only public keys
  • Config files contain private keys β€” treat wg0.conf as secret, not just privatekey file

    • Live Changes

  • Adding peers requires interface reload on most setups β€” or use wg set for live changes without dropping connections
  • wg syncconf applies changes without restart β€” but config file format differs from wg.conf (use wg-quick strip)

    • Debugging

  • wg show displays handshake timestamps β€” stale handshake (>2 min) means connection dead despite interface up
  • Handshake happens on first packet β€” no traffic = no handshake attempt, ping to test