Configure Secure VPNs with WireGuard, OpenVPN, and IPSec

This skill applies expert VPN security configuration across protocols, encryption standards, authentication, and network security architecture. Its protocol hierarchy: WireGuard as the modern, lightweight, cryptographically sound choice for new deployments; OpenVPN as the mature, flexible option for complex requirements; IPSec/IKEv2 as the enterprise-grade, natively OS-supported choice for site-to-site links; and it explicitly flags PPTP, L2TP without IPSec, and unhardened SSL VPN as protocols to avoid. Its encryption standards: AES-256-GCM (or ChaCha20-Poly1305 on mobile) symmetrically, RSA-4096 or ECDSA P-384/P-521 asymmetrically, ECDH/DHE key exchange with perfect forward secrecy, and SHA-256 minimum hashing (SHA-384/512 for higher security).

For WireGuard it provides server and client wg0.conf templates - interface keys, allowed IPs, persistent keepalive, and iptables NAT/forwarding rules on the server. For OpenVPN it provides a hardened server configuration (AES-256-GCM cipher, SHA256 auth, TLS 1.2 minimum, restricted TLS cipher, chrooted unprivileged user, persist-key/persist-tun) plus PKI setup via easy-rsa - generating the CA, server certificate, client certificates, and a TLS-auth key with correctly restricted file permissions:

### /etc/wireguard/wg0.conf
[Interface]
PrivateKey = SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

### Client configurations
[Peer]
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32
PersistentKeepalive = 25

[Peer]
PublicKey = CLIENT2_PUBLIC_KEY
AllowedIPs = 10.0.0.3/32

For IPSec it configures strongSwan site-to-site tunnels with IKEv2, defined lifetimes/rekey margins, and named AES/SHA cipher suites. For network hardening it defines iptables rules that allow only VPN ports, permit forwarding on the VPN interface, NAT client traffic, drop invalid packets, and rate-limit connection attempts, plus DNS configuration that pins trusted resolvers and rejects DNS queries to anything else to prevent leaks. For authentication it adds multi-factor auth via the Google Authenticator PAM module wired into OpenVPN, and a certificate revocation flow for compromised clients. For monitoring it includes a Python log-analysis script that counts TLS/auth failures per IP and alerts above a threshold, and performance tuning settings (buffer sizes, MTU/MSS, max clients and routes per client).

Use it when designing, hardening, or auditing a VPN deployment - protocol and cipher selection, PKI setup, firewall and DNS-leak protection, MFA, and monitoring. Because it touches private keys, certificate authorities, and firewall rules directly, generated configuration should be reviewed and adapted to the specific environment before production use, not applied blindly - it names ten standing recommendations including regular updates, 6-12 month key rotation, comprehensive audit logging, network segmentation, a kill switch on VPN failure, and an incident response procedure for compromise scenarios.

Output spans WireGuard and OpenVPN server/client configuration files, strongSwan IPSec configuration, PKI generation and certificate revocation commands, iptables firewall and DNS-leak-prevention rules, PAM-based MFA setup, a log-analysis/alerting script, and performance tuning parameters.

It configures WireGuard, OpenVPN with easy-rsa PKI, strongSwan for IPSec/IKEv2, iptables for firewall and NAT rules, PAM with the Google Authenticator module for MFA, and Python for log analysis and alerting.

Network and security engineers designing, hardening, or auditing VPN infrastructure - protocol selection, PKI and certificate lifecycle, firewall/DNS hardening, MFA, and ongoing monitoring.