Agent skill · security · affaan-m
homelab-wireguard-vpn
ホームラボWireGuard VPN設定、リモートアクセス、キー管理、およびエンドツーエンド暗号化。
Why this skill is useful
Adds executable scripts for WireGuard VPN setup, including server and client configuration that are not commonly found in public documentation.
What it needs
Requires wireguard installed locally. About 6k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
Homelab WireGuard VPN WireGuard is a fast, modern VPN protocol. It is the right choice for remote access to a home network — simpler to configure than OpenVPN and faster than most alternatives. All configuration examples show common setups. Review each command — especially the iptables forwarding rules and key file permissions — before applying them to your system, and make changes in a maintenance window. When to Use Setting up WireGuard server on a Raspberry Pi, Linux host, pfSense, or router Generating WireGuard keypairs and writing peer config files Configuring remote access from a phone or laptop to a home network Explaining split tunneling (route only home traffic) vs full tunnel (route all traffic) Troubleshooting WireGuard connections that will not come up Automating peer configuration generation for multiple clients How WireGuard Works Server Setup (Linux) Client Configuration Split Tunnel vs Full Tunnel Key Generation and Peer Management Keep private keys out of source control. If you use this script, write key material to files with mode 600 and never log or print it. pfSense / OPNsense WireGuard DDNS (Dynamic DNS) for Home Servers Most home internet connections have a dynamic IP. Use DDNS so your VPN endpoint stays reachable after an IP change. Troubleshooting Anti-Patterns Best Practices Generate a unique keypair per client device — never reuse keys Use split tunneling (AllowedIPs = <home subnets>) for mobile Set PersistentKeepalive = 25 on all mobile clients Use DDNS if your ISP assigns a dynamic IP; store credentials in env files, not inline Use scoped iptables forwarding rules (inbound on wg0 only) rather than a blanket FORWARD ACCEPT Add Pi-hole's IP as DNS = in client configs to get ad blocking over the VPN Rotate the server keypair periodically and update all client configs Related Skills homelab-network-setup homelab-vlan-segmentation homelab-pihole-dns
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/homelab-wireguard-vpn