How do I install the WireGuard skill?

Run npx skillmds add modbender/wireguard in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the WireGuard skill do?

Configure WireGuard VPN tunnels with secure routing and key management. It is listed under Coding & Dev Tools on SkillMD.

Is WireGuard safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with WireGuard?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is WireGuard free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published WireGuard?

modbender (@modbender) published this skill. Their other Agent Skills are listed on their SkillMD profile.

WireGuard by modbender — Agent Skill

Name: WireGuard
Rating: 4.2 (5 reviews)
Author: modbender

File contents

AllowedIPs Traps (Most Common Mistakes)

AllowedIPs means different things on each side — server: what peer CAN send; client: what to ROUTE through tunnel
0.0.0.0/0 routes ALL traffic including tunnel endpoint — breaks connectivity, must exclude server's public IP first
Overlapping AllowedIPs between peers = undefined routing — each IP range must belong to exactly one peer
Wrong mask silently breaks routing — /32 for single host, /24 for subnet, verify carefully

Connection Failures

No handshake = wrong public key, firewall blocking UDP, or wrong endpoint — check all three, not just one
One-way traffic = AllowedIPs misconfigured — packets go out but replies don't route back
Missing PersistentKeepalive = 25 breaks NAT traversal — peer behind NAT unreachable after ~2 minutes
Config file permissions must be 600 — wg-quick silently refuses to start with loose permissions

DNS Leaks

Without DNS = in client config, DNS queries bypass tunnel — leaks real IP to DNS provider
Full tunnel (0.0.0.0/0) without DNS config = false sense of security — traffic tunneled but DNS exposed

Routing Setup

IP forwarding disabled by default on Linux — tunnel works but packets don't route between interfaces
NAT required for internet access through tunnel — without masquerade, return packets don't find their way
Firewall must allow UDP on ListenPort — WireGuard is UDP only, no TCP fallback exists

Key Security

Private key file permissions matter — world-readable key is compromised, set 600 immediately after generation
Never transmit private keys — generate on each machine, exchange only public keys
Config files contain private keys — treat wg0.conf as secret, not just privatekey file

Live Changes

Adding peers requires interface reload on most setups — or use wg set for live changes without dropping connections
wg syncconf applies changes without restart — but config file format differs from wg.conf (use wg-quick strip)

Debugging

wg show displays handshake timestamps — stale handshake (>2 min) means connection dead despite interface up
Handshake happens on first packet — no traffic = no handshake attempt, ping to test

---name: wireguarddescription: Configure WireGuard VPN tunnels with secure routing and key management.--- ## AllowedIPs Traps (Most Common Mistakes) - `AllowedIPs` means different things on each side — server: what peer CAN send; client: what to ROUTE through tunnel - `0.0.0.0/0` routes ALL traffic including tunnel endpoint — breaks connectivity, must exclude server's public IP first - Overlapping AllowedIPs between peers = undefined routing — each IP range must belong to exactly one peer - Wrong mask silently breaks routing — `/32` for single host, `/24` for subnet, verify carefully ## Connection Failures - No handshake = wrong public key, firewall blocking UDP, or wrong endpoint — check all three, not just one - One-way traffic = AllowedIPs misconfigured — packets go out but replies don't route back - Missing `PersistentKeepalive = 25` breaks NAT traversal — peer behind NAT unreachable after ~2 minutes - Config file permissions must be 600 — wg-quick silently refuses to start with loose permissions ## DNS Leaks - Without `DNS =` in client config, DNS queries bypass tunnel — leaks real IP to DNS provider - Full tunnel (`0.0.0.0/0`) without DNS config = false sense of security — traffic tunneled but DNS exposed ## Routing Setup - IP forwarding disabled by default on Linux — tunnel works but packets don't route between interfaces - NAT required for internet access through tunnel — without masquerade, return packets don't find their way - Firewall must allow UDP on ListenPort — WireGuard is UDP only, no TCP fallback exists ## Key Security - Private key file permissions matter — world-readable key is compromised, set 600 immediately after generation - Never transmit private keys — generate on each machine, exchange only public keys - Config files contain private keys — treat wg0.conf as secret, not just privatekey file ## Live Changes - Adding peers requires interface reload on most setups — or use `wg set` for live changes without dropping connections - `wg syncconf` applies changes without restart — but config file format differs from wg.conf (use `wg-quick strip`) ## Debugging - `wg show` displays handshake timestamps — stale handshake (>2 min) means connection dead despite interface up - Handshake happens on first packet — no traffic = no handshake attempt, ping to test

Frequently asked questions