majiayu000 VPN Setup
Configure secure VPN tunnels for remote access and site connectivity.
WireGuard
# Generate keys
wg genkey | tee privatekey | wg pubkey > publickey
# Server config (/etc/wireguard/wg0.conf)
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server-private-key>
[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32
# Enable
wg-quick up wg0
systemctl enable wg-quick@wg0
OpenVPN
# Install
apt install openvpn easy-rsa
# Generate certificates
cd /etc/openvpn/easy-rsa
./easyrsa init-pki
./easyrsa build-ca
./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-dh
AWS Site-to-Site VPN
aws ec2 create-vpn-gateway --type ipsec.1
aws ec2 create-customer-gateway \
--type ipsec.1 \
--bgp-asn 65000 \
--public-ip <on-prem-ip>
aws ec2 create-vpn-connection \
--type ipsec.1 \
--customer-gateway-id cgw-xxx \
--vpn-gateway-id vgw-xxx
Best Practices
- Use WireGuard for modern deployments
- Implement MFA for VPN access
- Regular key rotation
- Monitor VPN connections
- Segment VPN access by role
Related Skills
- zero-trust - Modern access patterns
- ssl-tls-management - Certificate management