One of my favorite pieces of work at a security consultancy was also one of the smallest: a VPN tunnel "blackbox" - a device you plug into a network, and everything behind it transparently reaches the other side of an encrypted tunnel. No client software, no per-machine configuration, no questions asked of the user.
Why WireGuard
The requirements were portability, auditability and encrypted transit across distributed systems. That shortlist eliminates most of the field:
- IPsec is powerful and miserable - configuration surface measured in RFCs, and debugging sessions to match.
- OpenVPN drags a userspace daemon, certificates and a config dialect.
- WireGuard is ~a few thousand lines in the kernel, one keypair per peer, and a config file that fits on a screen.
When the whole point of a box is that you can trust it, the option you can read end to end wins.
# /etc/wireguard/wg0.conf - the entire mental model
[Interface]
PrivateKey = <box key>
Address = 10.8.0.2/24
[Peer]
PublicKey = <hub key>
Endpoint = hub.example:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25Why Alpine
The OS exists to run one kernel module and forward packets, so the OS
should be nearly nothing: Alpine boots from a few megabytes, runs from RAM
if you want it to, has no service sprawl to harden, and apk keeps the
attack surface countable on one hand. A minimal base isn't an aesthetic
preference here - every package you don't install is a CVE feed you don't
follow.
The blackbox property
The interesting engineering isn't the tunnel, it's the appliance
behavior: the box has to come up from cold power with no hands - bring up
wg0, NAT what's behind it, keep the tunnel alive through DHCP lease
changes and ISP flaps (PersistentKeepalive does more work than any other
line in the config), and fail closed rather than leak traffic around a
dead tunnel.
That last property is the one that earns the name. A VPN client that fails open is an inconvenience; an appliance that fails open is a silent breach. Firewall rules go in before the tunnel comes up, not after.
What I'd tell a younger me
Small systems are a security feature. The blackbox was trustworthy not because of any clever component but because there was so little of it - every byte of config fit in working memory, and that meant every failure mode could actually be enumerated. Most hardening advice is about adding things; the best hardening is usually subtraction.