homelab-wireguard-vpn

npx skills add mturac/everything-openai-codex --skill homelab-wireguard-vpn --agent codex

Same command for any agent — swap --agent for claude-code, cursor, copilot.

# Homelab WireGuard VPN WireGuard is a fast, modern VPN protocol. It is the right choice for remote access to a home network — simpler to configure than OpenVPN and faster than most alternatives. All configuration examples show common setups. Review each command — especially the iptables forwarding rules and key file permissions — before applying them to your system, and make changes in a maintenance window. ## When to Use - Setting up WireGuard server on a Raspberry Pi, Linux host, pfSense, or router - Generating WireGuard keypairs and writing peer config files - Configuring remote access from a phone or laptop to a home network - Explaining split tunneling (route only home traffic) vs full tunnel (route all traffic) - Troubleshooting WireGuard connections that will not come up - Automating peer configuration generation for multiple clients ## How WireGuard Works ``` Your phone (WireGuard client) │ │ Encrypted UDP tunnel (port 51820) │ Your home router (WireGuard server — needs a public IP or DDNS) │ Your home network (192.168.1.0/24, NAS, Pi, etc.) Every device has a keypair (public + private key). The server knows each client's public key. The client knows the server's public ke

Install WireGuard
sudo apt update && sudo apt install wireguard -y
Generate server keypair — create files with private permissions from the start
sudo mkdir -p /etc/wireguard
sudo sh -c 'umask 077; wg genkey > /etc/wireguard/server_private.key'
sudo sh -c 'wg pubkey < /etc/wireguard/server_private.key > /etc/wireguard/server_public.key'
Write server config — substitute the actual private key value
Do not store private keys in version control or share them
sudo tee /etc/wireguard/wg0.conf << 'EOF'
sudo chmod 600 /etc/wireguard/wg0.conf