VPNs & WireGuard
A branch office joins HQ across the public internet: what a tunnel is, what it hides, and the ways it breaks.
An interactive Networking lesson: 19 steps, about 32 minutes, on a live simulation in your browser.
The branch office network lives on the left: hostA at 10.0.1.10. Headquarters is on the right: hostB at 10.0.2.10. Between them sit two edge routers, r1 at the branch and r2 at HQ, joined by a line that crosses the public internet.
hostA pings hostB. The request crosses r1, the public line and r2, and the reply comes back the same way. Everything answers, and every packet is readable by every network it crosses. That readability is the problem this lesson fixes.
What you will learn
Across the public internet
- Two sites, one public line
- Everyone in the middle can read it: Without encryption the path sees everything: the addresses, the ports and every byte of content.
- What does the middle see?: TCP is reliable but not secret. Anything sent in the clear can be read by every network on the path.
The tunnel idea
- A tunnel is three things: A tunnel is a virtual interface plus encryption plus routes: packets go in addressed to HQ and come out of UDP on the far side.
- The same trip, wrapped in UDP
- What can the ISP see now?: A VPN hides contents, not contact: the middle sees who talks, when and how much. Never what was said.
WireGuard's handshake
- One round trip to agree: WireGuard agrees in one round trip: initiation one way, response back, then both sides send.
- One suite, no negotiation: One cipher suite and nothing to negotiate: the handshake either agrees completely or fails closed.
- Rekey in the middle of a download: Rekeying changes the wrapping, not the contents. Sessions above the tunnel survive it completely.
Life inside the tunnel
- The packet inside the packet: A tunnelled packet has two headers: the outer one delivers it between the tunnel ends, the inner one between the offices.
- Roaming: the endpoint follows you: Roaming: any authenticated packet can move the endpoint. The address follows the cryptography, not the other way round.
- Drill: read the handshake age
When tunnels break
- Break it: the port goes dark: A blocked tunnel looks like silence, not refusal: new connections hang until TCP gives up.
- Back up, one round trip later: The tunnel heals in one round trip. Timed-out sessions above it do not come back with it.
- Break it: the black hole at 1420
- Drill: clamp the MSS
- WireGuard and the older VPNs: AllowedIPs is both a route and a permission: which prefixes go through this peer, and which source addresses are accepted from it.
Recap & playground
- Cheat sheet
- Playground