V N Sysadmin & Security
← Back to articles

WireGuard Site-to-Site Architecture: Resilient VPN Tunnels

Published:
• Category: Networking
• Compliance: ISO/IEC 27001
#networking#wireguard#vpn#routing#linux

Legacy IPSec and OpenVPN setups frequently suffer from protocol negotiation latency, fragile daemon states, and cumbersome MTU discovery issues.

WireGuard provides an in-kernel, noise-protocol-based tunnel implementation that treats VPN connections like lightweight network interfaces.

Architecture Overview

Consider two primary sites:

  • Site A (London Gateway): Subnet 10.10.0.0/24, WireGuard IP 192.168.100.1/30
  • Site B (Edinburgh Gateway): Subnet 10.20.0.0/24, WireGuard IP 192.168.100.2/30

1. Key Generation

On each endpoint, generate cryptographic keypairs with restrictive file modes:

umask 077
wg genkey | tee privatekey | wg pubkey > publickey

Pre-shared symmetric keys (PSK) add an additional layer of post-quantum resistance:

wg genpsk > preshared.key

2. Gateway Configuration

London Gateway (/etc/wireguard/wg0.conf)

[Interface]
Address = 192.168.100.1/30
ListenPort = 51820
PrivateKey = <LONDON_PRIVATE_KEY>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT

[Peer]
# Edinburgh Gateway
PublicKey = <EDINBURGH_PUBLIC_KEY>
PresharedKey = <PRESHARED_KEY>
Endpoint = 198.51.100.20:51820
AllowedIPs = 192.168.100.2/32, 10.20.0.0/24
PersistentKeepalive = 25

Edinburgh Gateway (/etc/wireguard/wg0.conf)

[Interface]
Address = 192.168.100.2/30
ListenPort = 51820
PrivateKey = <EDINBURGH_PRIVATE_KEY>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT

[Peer]
# London Gateway
PublicKey = <LONDON_PUBLIC_KEY>
PresharedKey = <PRESHARED_KEY>
Endpoint = 203.0.113.10:51820
AllowedIPs = 192.168.100.1/32, 10.10.0.0/24
PersistentKeepalive = 25

3. MTU Tuning and Verification

When tunnelling over consumer broadband with PPPoE (MTU 1492) or cellular handshakes, standard MTU 1500 packets will fragment:

# Recommended WireGuard interface MTU
MTU = 1420

Verify the tunnel state and handshake timestamps:

wg show wg0
← All Articles Top ↑