• A JOURNAL OF EXPERIMENTS •

NIR / Lab

Minimal WireGuard setup notes#

Context#

These are notes from setting up a small WireGuard network for personal infrastructure.

This is not a full guide. It documents what worked, what did not, and what would change later.

Goal#

  • use a single VPS as a small WireGuard hub
  • give peers private service access
  • avoid unnecessary site-to-site routing complexity

Environment#

  • single VPS acting as a hub
  • a few personal machines as peers
  • no mesh or automation

The Final State#

Server-side configuration for a restricted peer#

Used when I only wanted a peer to access the server itself.

[Interface]
Address = 10.88.0.1/24
PrivateKey = <server private key>

[Peer]
PublicKey = <peer public key>
AllowedIPs = 10.88.0.2/32
PersistentKeepalive = 25

This limits the peer to a single IP and avoids accidental routing leaks.

Server-side configuration for full subnet access#

Used when I wanted the peer to reach other services behind the tunnel.

[Interface]
Address = 10.88.0.1/24
PrivateKey = <server private key>

[Peer]
PublicKey = <peer public key>
AllowedIPs = 10.88.0.0/24
PersistentKeepalive = 25

This trades isolation for convenience and requires more trust in the peer.

Verification#

Bring the interface up:

wg-quick up wg0

Expected proof:

  • the interface comes up cleanly
  • the peer can reach only the intended addresses for the chosen AllowedIPs model

Failure Modes Worth Caring About#

  • accidentally broadening AllowedIPs and turning a restricted peer into a routed subnet peer
  • treating convenience as isolation
  • assuming the hub-only topology scales without later design cleanup