# Vpn Implementation Patterns

> Use when implementing VPN tunnels and remote access.

- Skill: `loopyluci/vpn-implementation-patterns` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/vpn-implementation-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/vpn-implementation-patterns/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/vpn-implementation-patterns

---


# VPN Implementation Patterns

Implementing VPN tunnels and remote access — from WireGuard and OpenVPN through IPsec/IKEv2, site-to-site VPNs, and remote access design patterns.

## When to Use

- Providing secure remote access for employees
- Connecting branch offices via site-to-site VPN
- Building secure communication between cloud and on-premise
- Implementing zero-trust network access alongside VPN
- Replacing legacy VPN with modern alternatives

## VPN Protocols

```python
VPN_PROTOCOLS = {
    'wireguard': {
        'strength': 'Modern, fast, simple, kernel-level, audited',
        'use_case': 'General purpose, site-to-site, remote access',
        'setup': 'Minimal config, single file, public/private keys',
    },
    'openvpn': {
        'strength': 'Mature, widely supported, rich auth options',
        'use_case': 'Remote access, enterprise, complex auth needs',
        'setup': 'Certificate-based, more config options',
    },
    'ipsec': {
        'strength': 'Industry standard, hardware offload, strong encryption',
        'use_case': 'Site-to-site, cloud-to-on-premise, legacy compatibility',
        'setup': 'IKEv2 with strongSwan or built-in OS support',
    },
}

# WireGuard config template
WIREGUARD_CONFIG = """
[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32
"""
```

## Common Pitfalls

1. **Split tunneling not configured** — all traffic through VPN slows internet access; route only private ranges
2. **Key management** — WireGuard keys on compromised clients; implement key rotation
3. **No failover** — single VPN server = single point of failure; cluster or have backup
4. **MTU issues** — VPN encapsulation reduces MTU; adjust MTU (typically 1420 for WireGuard)
5. **Performance bottleneck** — VPN server CPU can't handle throughput; consider kernel-level WireGuard

## Verification Checklist

- [ ] Protocol selected (WireGuard, OpenVPN, IPsec)
- [ ] Split tunneling configured (only route private IPs)
- [ ] Authentication method defined (keys, certificates, SSO)
- [ ] MTU configured correctly
- [ ] Firewall allows VPN protocol on correct port
- [ ] DNS configuration for internal resources
- [ ] Monitoring on connection count, bandwidth, errors
- [ ] Revocation process for compromised devices
- [ ] Failover/high availability for production VPN