vpn
This skill covers setup and administration for three major VPN protocols: WireGuard, OpenVPN, and IPSec via strongSwan. Learn installation steps, certificate and key generation, server and client configuration, and practical scenarios like site-to-site tunnels and split routing.
VPN skill provides configuration templates and commands for WireGuard, OpenVPN, and IPSec deployment.
AI-generated summary based on this skill's SKILL.md
Install
chaterm/terminal-skills/vpn
git clone https://github.com/chaterm/terminal-skills
cp -r terminal-skills/network/vpn ~/.claude/skills/vpnnpx skillfed install chaterm/terminal-skills/vpnFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to set up WireGuard VPN on a Linux server?
WireGuard VPN setup involves installing the WireGuard package, generating public/private key pairs for the server and peers, configuring the interface with IP addresses and peer definitions, and enabling the service. The skill covers installation steps across distributions, key generation using wg genkey and wg pubkey, writing the wg0.conf configuration file with allowed IPs and endpoints, and bringing the interface up with ip link and wg-quick commands.
What are the main differences between WireGuard, OpenVPN, and IPSec?
WireGuard VPN emphasizes simplicity and modern cryptography with a minimal codebase, making it faster and easier to audit. OpenVPN offers broader compatibility and flexibility through plugin support, using TLS for key exchange and supporting various authentication methods. IPSec via strongSwan provides standards-based enterprise security with IKEv2 protocol support and is deeply integrated into Linux kernels. The skill teaches configuration approaches for all three, helping you choose based on your security and deployment needs.
How do I generate VPN keys and certificates for secure peer authentication?
WireGuard VPN key generation uses simple command-line tools: wg genkey creates private keys and wg pubkey derives public keys from them. OpenVPN relies on Easy-RSA for PKI management—you initialize a CA, generate server and client certificates, and sign them with your CA key. IPSec uses strongSwan's pki tool to create certificates and manage the PKI hierarchy. The skill covers all three approaches, including best practices for key storage, rotation, and peer management across multi-user scenarios.
How can I troubleshoot VPN connectivity and handshake failures?
WireGuard VPN troubleshooting uses wg show to inspect peer status, allowed IPs, and data transfer statistics. Check firewall rules with iptables or ufw, verify routing with ip route, and examine kernel logs via dmesg. OpenVPN diagnostics involve reviewing log verbosity levels and checking certificate validity. IPSec troubleshooting uses strongSwan's status command and IKE/ESP protocol debugging. The skill teaches systematic debugging of connection issues, routing problems, and handshake failures across all three protocols.
What is site-to-site VPN and how do I configure it with WireGuard?
WireGuard VPN site-to-site configuration connects two remote networks by configuring WireGuard peers at each site's gateway. Each gateway runs WireGuard with the other site's public key and endpoint, and allowed IPs are set to the remote network's subnet. The skill covers setting up persistent connections between office and data center, managing multiple peer configurations, and ensuring proper routing so traffic destined for the remote subnet flows through the VPN tunnel.
How do I set up VPN clients and establish secure remote connections?
VPN client setup varies by protocol. WireGuard VPN clients require the server's public key and endpoint; you generate a client key pair, add it as a peer on the server, and configure the client interface with the server's public key and endpoint address. OpenVPN clients use certificate-based or username/password authentication with a .ovpn configuration file. IPSec clients authenticate via certificates or pre-shared keys. The skill teaches client installation, configuration file generation, and connection establishment for remote workers and multi-user scenarios.
SKILL.md
rendered from the published skill — quoted content, verbatim
VPN 配置与管理
概述
OpenVPN、WireGuard、IPSec VPN 配置与管理技能。
WireGuard
安装
# Debian/Ubuntu
apt install wireguard
# CentOS/RHEL
yum install epel-release elrepo-release
yum install kmod-wireguard wireguard-tools
# 验证安装
wg --version
生成密钥
# 生成私钥
wg genkey > privatekey
# 从私钥生成公钥
wg pubkey < privatekey > publickey
# 一步生成
wg genkey | tee privatekey | wg pubkey > publickey
# 生成预共享密钥（可选，增强安全）
wg genpsk > presharedkey
服务端配置
# /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>
# 启用 IP 转发
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.0.0.2/32
客户端配置
```bash
/etc/wireguard/wg0.conf
[Interface] Address = 10.0.0.2/24 PrivateKey = <client_private_key> DNS = 8.8.8.8
[Peer] PublicKey = <server_public_key> Endpoint =
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
network/vpn/SKILL.md