WireGuard VPN AI Skill Guide (Claude)

Overview & Engine Architecture

WireGuard is a UDP tunnel with Noise-based handshake and a single critical idea: cryptokey routing. Each peer’s AllowedIPs is both the ACL (which source packets may arrive as that peer) and the route table (which destinations are sent to that peer). There is no user/password plane—only keys, endpoints, and OS forwarding. Agents must generate keys on-box, never paste private keys into repos/chat, and separate “no handshake” from “handshake OK but AllowedIPs/routes wrong.”