Securing VPS Infrastructure with WireGuard Mesh VPN Tunnels & Strict Firewall Rules

1. Cryptographic Principles of WireGuard & Noise Protocol

Traditional VPN protocols like IPSec and OpenVPN suffer from extreme complexity, legacy cipher negotiation, and heavy codebase sizes exceeding 100,000 lines of C code.

WireGuard features an ultra-lean codebase under 4,000 lines of C. It runs directly inside Linux kernel space and relies on modern fixed cryptographic primitives: Curve25519 for ECDH, ChaCha20 for symmetric encryption, Poly1305 for authentication, and BLAKE2s for hashing.

WireGuard uses the Noise IK protocol framework, responding only to packets carrying valid cryptographic signatures, making WireGuard servers completely invisible to unauthenticated UDP port scanners.

This silent response architecture eliminates port scanning visibility across public cloud infrastructure.

# Generate WireGuard private and public key pairs
wg genkey | tee privatekey | wg pubkey > publickey

# Secure private key file permissions
chmod 600 privatekey

2. Configuring Interface Parameters in /etc/wireguard/wg0.conf

WireGuard interfaces are configured using simple INI-style configuration files in /etc/wireguard/wg0.conf.

Each node defines its own local [Interface] parameters (private key, virtual IP address, listening UDP port) and a series of [Peer] sections for remote nodes.

The AllowedIPs setting acts as both a routing table and an access control list: packets sent to an AllowedIP are routed through the tunnel, and incoming packets from the tunnel are accepted only if their source IP matches AllowedIPs.

Configuring 10.0.0.0/24 in AllowedIPs enables secure point-to-point mesh routing between multi-cloud instances.

# /etc/wireguard/wg0.conf on Gateway Server (Node A)
[Interface]
PrivateKey = 
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
# Web Server (Node B)
PublicKey = 
AllowedIPs = 10.0.0.2/32

3. Connecting Remote Multi-Cloud Peer Nodes

On Node B (Web Server), configure the peer connection pointing back to Node A's public IP and UDP port.

Setting PersistentKeepalive = 25 sends a periodic silent ping every 25 seconds, keeping NAT sessions and firewall state tables open on cloud provider gateways.

This ensures continuous tunnel connectivity without requiring re-authentication handshakes.

# /etc/wireguard/wg0.conf on Web Server (Node B)
[Interface]
PrivateKey = 
Address = 10.0.0.2/24

[Peer]
# Gateway Server (Node A)
PublicKey = 
Endpoint = 203.0.113.10:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 25

4. Binding Internal Backend Services Strictly to Mesh IPs

Once the WireGuard interface (wg0) is established, reconfigure database servers (PostgreSQL, MySQL, Redis) and internal API gateways to listen exclusively on the private WireGuard IP (e.g., 10.0.0.1).

This ensures internal infrastructure services are completely unreachable from public IPv4/IPv6 internet interfaces, even if firewall rules are misconfigured.

Strict IP binding guarantees zero public network exposure for core data storage layers.

# /etc/postgresql/15/main/postgresql.conf
listen_addresses = '10.0.0.1'

# /etc/redis/redis.conf
bind 10.0.0.1

5. Firewall Isolation & Routing Table Tuning

Configure UFW or iptables rules to allow UDP traffic on port 51820 exclusively for WireGuard handshake packets, while permitting unrestricted internal communication over the wg0 interface.

Using interface-specific firewall rules isolates private tunnel traffic from external network interfaces.

# Enable WireGuard UDP port on public interface eth0
ufw allow in on eth0 to any port 51820 proto udp comment 'WireGuard Handshakes'

# Allow all internal traffic on virtual interface wg0
ufw allow in on wg0 comment 'Internal Mesh Traffic'

# Bring up WireGuard interface
wg-quick up wg0

6. Performance Benchmark & Troubleshooting Verification

Inspect WireGuard active tunnel status, handshake timestamps, and transfer metrics using the wg command.

Verify ICMP connectivity across private mesh IP endpoints using ping.

Benchmark network throughput using iperf3 over the WireGuard interface.

# Inspect active peer status and handshake ages
wg show

# Ping private mesh node
ping 10.0.0.2

# Benchmark throughput over WireGuard mesh
iperf3 -c 10.0.0.2

Written by Zyekh Abdul Qadir Jailani

Digital Forensics & Incident Response (DFIR) Specialist & Security Researcher specializing in Linux kernel hardening, threat hunting, and system security research.

LinkedIn • GitHub • Discord • Email • PGP Key