Spark
Sign In
Skill

Configure Secure VPNs with WireGuard, OpenVPN, and IPSec

A skill for designing and hardening VPN deployments - WireGuard, OpenVPN, and IPSec configs, PKI, firewalls, and monitoring.

Get skill
Works with githubiptablesopenvpnwireguardstrongswan
VibeBaza
Own this? Claim it

Maintainer of this project? Claim this page to edit the listing.

78
Spark score
out of 100
Updated 10 days ago
Version 1.0.0
Models
claude
Add to Favorites

Why it matters

Establish robust and secure virtual private networks using industry-leading protocols like WireGuard, OpenVPN, and IPSec. This asset provides expert guidance and configuration examples for robust encryption, authentication, and network security.

Outcomes

What it gets done

01

Implement secure VPN server and client configurations for WireGuard, OpenVPN, and IPSec.

02

Apply advanced security hardening techniques including encryption standards, key exchange, and firewall rules.

03

Configure multi-factor authentication and certificate revocation for enhanced access control.

04

Automate VPN security tasks and monitor logs for potential threats.

Install

Add it to your toolbox

Run in your project directory:

curl -fsSL https://spark.entire.vc/get/vb-vpn-security-config | bash

Overview

VPN Security Configuration Expert

A skill for designing and hardening VPN deployments - protocol and cipher selection across WireGuard, OpenVPN, and IPSec, PKI and certificate lifecycle, firewall and DNS-leak hardening, MFA, and log-based monitoring. Use it when designing, hardening, or auditing VPN infrastructure - review and adapt generated configs to your environment before production use, since it touches keys, certificates, and firewall rules directly.

What it does

This skill applies expert VPN security configuration across protocols, encryption standards, authentication, and network security architecture. Its protocol hierarchy: WireGuard as the modern, lightweight, cryptographically sound choice for new deployments; OpenVPN as the mature, flexible option for complex requirements; IPSec/IKEv2 as the enterprise-grade, natively OS-supported choice for site-to-site links; and it explicitly flags PPTP, L2TP without IPSec, and unhardened SSL VPN as protocols to avoid. Its encryption standards: AES-256-GCM (or ChaCha20-Poly1305 on mobile) symmetrically, RSA-4096 or ECDSA P-384/P-521 asymmetrically, ECDH/DHE key exchange with perfect forward secrecy, and SHA-256 minimum hashing (SHA-384/512 for higher security).

For WireGuard it provides server and client wg0.conf templates - interface keys, allowed IPs, persistent keepalive, and iptables NAT/forwarding rules on the server. For OpenVPN it provides a hardened server configuration (AES-256-GCM cipher, SHA256 auth, TLS 1.2 minimum, restricted TLS cipher, chrooted unprivileged user, persist-key/persist-tun) plus PKI setup via easy-rsa - generating the CA, server certificate, client certificates, and a TLS-auth key with correctly restricted file permissions:

### /etc/wireguard/wg0.conf
[Interface]
PrivateKey = SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

### Client configurations
[Peer]
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32
PersistentKeepalive = 25

[Peer]
PublicKey = CLIENT2_PUBLIC_KEY
AllowedIPs = 10.0.0.3/32

For IPSec it configures strongSwan site-to-site tunnels with IKEv2, defined lifetimes/rekey margins, and named AES/SHA cipher suites. For network hardening it defines iptables rules that allow only VPN ports, permit forwarding on the VPN interface, NAT client traffic, drop invalid packets, and rate-limit connection attempts, plus DNS configuration that pins trusted resolvers and rejects DNS queries to anything else to prevent leaks. For authentication it adds multi-factor auth via the Google Authenticator PAM module wired into OpenVPN, and a certificate revocation flow for compromised clients. For monitoring it includes a Python log-analysis script that counts TLS/auth failures per IP and alerts above a threshold, and performance tuning settings (buffer sizes, MTU/MSS, max clients and routes per client).

When to use - and when NOT to

Use it when designing, hardening, or auditing a VPN deployment - protocol and cipher selection, PKI setup, firewall and DNS-leak protection, MFA, and monitoring. Because it touches private keys, certificate authorities, and firewall rules directly, generated configuration should be reviewed and adapted to the specific environment before production use, not applied blindly - it names ten standing recommendations including regular updates, 6-12 month key rotation, comprehensive audit logging, network segmentation, a kill switch on VPN failure, and an incident response procedure for compromise scenarios.

Inputs and outputs

Output spans WireGuard and OpenVPN server/client configuration files, strongSwan IPSec configuration, PKI generation and certificate revocation commands, iptables firewall and DNS-leak-prevention rules, PAM-based MFA setup, a log-analysis/alerting script, and performance tuning parameters.

Integrations

It configures WireGuard, OpenVPN with easy-rsa PKI, strongSwan for IPSec/IKEv2, iptables for firewall and NAT rules, PAM with the Google Authenticator module for MFA, and Python for log analysis and alerting.

Who it's for

Network and security engineers designing, hardening, or auditing VPN infrastructure - protocol selection, PKI and certificate lifecycle, firewall/DNS hardening, MFA, and ongoing monitoring.

Source README

VPN Security Configuration Expert

You are an expert in VPN (Virtual Private Network) security configuration with deep knowledge of protocols, encryption standards, authentication methods, and network security architectures. You provide comprehensive guidance on designing, implementing, and maintaining secure VPN solutions across various platforms and use cases.

Core Security Principles

Protocol Selection Hierarchy

  • WireGuard: Modern, lightweight, cryptographically sound (preferred for new deployments)
  • OpenVPN: Mature, flexible, widely supported (good for complex requirements)
  • IPSec/IKEv2: Enterprise-grade, native OS support (ideal for site-to-site)
  • Avoid: PPTP, L2TP without IPSec, SSL VPN without proper hardening

Encryption Standards

  • Symmetric: AES-256-GCM (preferred), ChaCha20-Poly1305 for mobile
  • Asymmetric: RSA-4096 or ECDSA P-384/P-521
  • Key Exchange: ECDH, DHE with perfect forward secrecy
  • Hashing: SHA-256 minimum, SHA-384/512 for high security

WireGuard Configuration

Server Configuration

### /etc/wireguard/wg0.conf
[Interface]
PrivateKey = SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

### Client configurations
[Peer]
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32
PersistentKeepalive = 25

[Peer]
PublicKey = CLIENT2_PUBLIC_KEY
AllowedIPs = 10.0.0.3/32

Client Configuration

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.0.0.2/32
DNS = 1.1.1.1, 1.0.0.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

OpenVPN Hardened Configuration

Server Configuration

### /etc/openvpn/server.conf
port 1194
proto udp
dev tun

### Certificates and keys
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-auth ta.key 0
tls-crypt ta.key

### Network configuration
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"

### Security hardening
cipher AES-256-GCM
auth SHA256
tls-version-min 1.2
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
remote-cert-tls client

### Additional security
user nobody
group nogroup
chroot /var/empty
persist-key
persist-tun

### Logging
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
mute 20

PKI Security Best Practices

### Generate secure CA
easyrsa init-pki
easyrsa build-ca nopass

### Generate server certificate
easyrsa gen-req server nopass
easyrsa sign-req server server

### Generate client certificates
easyrsa gen-req client1 nopass
easyrsa sign-req client client1

### Generate TLS-auth key
openvpn --genkey secret ta.key

### Set proper permissions
chown -R root:root /etc/openvpn/
chmod 700 /etc/openvpn/
chmod 600 /etc/openvpn/server.key
chmod 600 /etc/openvpn/ta.key

IPSec/strongSwan Configuration

Site-to-Site VPN

### /etc/ipsec.conf
config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=never

conn %default
    ikelifetime=60m
    keylife=20m
    rekeymargin=3m
    keyingtries=1
    keyexchange=ikev2
    authby=secret

conn site-to-site
    left=203.0.113.1
    leftsubnet=10.1.0.0/16
    leftid=@site1.example.com
    right=198.51.100.1
    rightsubnet=10.2.0.0/16
    rightid=@site2.example.com
    ike=aes256-sha256-modp2048
    esp=aes256-sha256
    auto=start

Network Security Hardening

Firewall Rules (iptables)

#!/bin/bash
### VPN server firewall rules

### Allow VPN traffic
iptables -A INPUT -p udp --dport 51820 -j ACCEPT  # WireGuard
iptables -A INPUT -p udp --dport 1194 -j ACCEPT   # OpenVPN

### Allow forwarding for VPN clients
iptables -A FORWARD -i wg0 -j ACCEPT
iptables -A FORWARD -o wg0 -j ACCEPT

### NAT for internet access
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

### Drop invalid packets
iptables -A INPUT -m state --state INVALID -j DROP

### Rate limiting
iptables -A INPUT -p udp --dport 51820 -m recent --update --seconds 1 --hitcount 5 -j DROP
iptables -A INPUT -p udp --dport 51820 -m recent --set -j ACCEPT

DNS Security

### Secure DNS configuration
echo 'nameserver 1.1.1.1' > /etc/resolv.conf
echo 'nameserver 1.0.0.1' >> /etc/resolv.conf
echo 'options edns0' >> /etc/resolv.conf

### Prevent DNS leaks
iptables -A OUTPUT -p udp --dport 53 ! -d 1.1.1.1 -j REJECT
iptables -A OUTPUT -p tcp --dport 53 ! -d 1.1.1.1 -j REJECT

Authentication and Access Control

Multi-Factor Authentication

### Install Google Authenticator PAM module
apt-get install libpam-google-authenticator

### Configure PAM for OpenVPN
echo 'auth required pam_google_authenticator.so' >> /etc/pam.d/openvpn

### OpenVPN plugin configuration
echo 'plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn' >> server.conf

Certificate Revocation

### Revoke compromised certificate
easyrsa revoke client1
easyrsa gen-crl

### Update OpenVPN configuration
echo 'crl-verify /etc/openvpn/pki/crl.pem' >> server.conf

Monitoring and Logging

Log Analysis Script

#!/usr/bin/env python3
import re
from collections import defaultdict

def analyze_vpn_logs():
    failed_attempts = defaultdict(int)
    
    with open('/var/log/openvpn.log', 'r') as f:
        for line in f:
            if 'TLS_ERROR' in line or 'AUTH_FAILED' in line:
                ip = re.search(r'\d+\.\d+\.\d+\.\d+', line)
                if ip:
                    failed_attempts[ip.group()] += 1
    
    # Alert on suspicious activity
    for ip, count in failed_attempts.items():
        if count > 10:
            print(f"ALERT: {count} failed attempts from {ip}")

if __name__ == '__main__':
    analyze_vpn_logs()

Performance and Scalability

Optimization Settings

### OpenVPN performance tuning
sndbuf 524288
rcvbuf 524288
fast-io
tun-mtu 1500
mssfix 1460

### Multi-client handling
max-clients 100
max-routes-per-client 256

Security Recommendations

  1. Regular Updates: Keep VPN software and OS updated
  2. Key Rotation: Rotate encryption keys every 6-12 months
  3. Audit Logs: Implement comprehensive logging and monitoring
  4. Network Segmentation: Isolate VPN traffic from critical systems
  5. Kill Switch: Implement automatic disconnection on VPN failure
  6. Perfect Forward Secrecy: Ensure PFS is enabled for all connections
  7. Vulnerability Scanning: Regularly scan VPN endpoints
  8. Access Control: Implement principle of least privilege
  9. Backup Configurations: Maintain secure backups of VPN configs
  10. Incident Response: Have procedures for compromise scenarios

FAQ

Common questions

Discussion

Questions & comments · 0

Sign In Sign in to leave a comment.