How WireGuard works: cryptokey routing
AllowedIPs is the routing table and the access list at once. Learn cryptokey routing, the Noise handshake and rotation, and every wg0.conf reads clearly.
Networking & VPNs
The networking layer under a Linux server. Interfaces, routing, NAT and firewall rules, plus the VPN setups that keep a service off the public internet.
Filtering by topic #linux-networking · clear
WireGuard vs Tailscale vs Headscale
Tailscale is WireGuard plus a control plane. What that coordination server buys you, what it costs you, and which of the three belongs on your VPS.
WireGuard vs OpenVPN: which to self-host
WireGuard wins for almost every self hoster on speed, config size and audit surface. Here is the evidence, and the four cases where OpenVPN still wins.
WireGuard: route to your home LAN
Your WireGuard handshake works but no host on the home LAN answers. Four settings decide whether a packet reaches 192.168.20.10 and finds its way back.
Self-host a WireGuard VPN on your VPS
Set up WireGuard on your own Linux VPS: key generation, wg0.conf, IP forwarding, NAT, AllowedIPs semantics, DNS, and the handshake failures that bite.
Fix DNS over WireGuard: three failure modes
Your WireGuard tunnel is up but names do not resolve, or the queries leak to the local router. Find which of the three DNS failures you have, and fix it.
Add a WireGuard peer without restarting the VPN
Add a new WireGuard client with wg syncconf and wg-quick strip so connected peers stay up, plus wg set, wg-quick save, AllowedIPs collisions and PostUp rules.
firewalld basics for a Rocky or AlmaLinux VPS
Open SSH, allow a web port, close one, and survive a reboot with firewalld on Rocky or AlmaLinux. Zones explained, plus the --permanent trap.