Week 5, Day 4 — Certificate IPSec & WireGuard

Lab 5D — Part 1: Migrate IPSec to cert auth. Part 2: Build WireGuard tunnel. Part 3: Compare.

Part 1 — Migrate to certificate authentication (45 min)

• On S1, edit /etc/ipsec.secrets. Remove or comment out the PSK line. Add the RSA private key reference:
  : RSA s1Key.pem
  The colon at the start means "this server's identity." The filename is relative to /etc/ipsec.d/private/.
• On S3, do the same:
  : RSA s3Key.pem
• On S1, edit /etc/ipsec.conf. Update the connection block:
  conn S1_to_S3
keyexchange=ikev2
type=tunnel
authby=pubkey (was: authby=secret)
  leftcert=s1Cert.pem
leftid="C=CA, O=YourName, CN=s1.yourname.net"
rightid="C=CA, O=YourName, CN=s3.yourname.net"
left=[S1-External-IP]
leftsubnet=192.168.50.0/24
right=[S3-External-IP]
rightsubnet=192.168.51.0/24
ike=aes256-sha2_256-modp1024!
esp=aes256-sha2_256!
keyingtries=0
ikelifetime=1h
lifetime=8h
dpddelay=30
dpdtimeout=120
dpdaction=restart
auto=start
  The leftid and rightid must match exactly the DN embedded in each certificate — check with ipsec pki --print.
• On S3, write the mirror configuration with leftcert=s3Cert.pem and the DNs swapped appropriately.
• Restart ipsec on both: sudo ipsec restart. Wait 30 seconds. Check status:
  sudo ipsec status
  A successful cert-based SA shows the certificate DN in the output rather than the PSK identifier. Verify S2 can still ping S3's LAN IP.
• If the tunnel doesn't come up, check syslog:
  sudo grep charon /var/log/syslog | tail -30
  Common cert errors: "no trusted CA found" (caCert.pem not in cacerts/), "no matching peer config found" (DN mismatch between leftid/rightid and actual cert DN).

Part 2 — Build a WireGuard tunnel (45 min)

• Install WireGuard on S1 and S3:
  sudo apt install wireguard
  WireGuard is built into the Linux kernel since 5.6. The package installs the userspace tools (wg, wg-quick) and the kernel module.
• Generate key pairs on S1:
  wg genkey | sudo tee /etc/wireguard/s1_private.key | wg pubkey | sudo tee /etc/wireguard/s1_public.key
  This generates a private key, saves it, then derives the public key from it. Both are in base64 format.
  sudo chmod 600 /etc/wireguard/s1_private.key
  Display the public key: sudo cat /etc/wireguard/s1_public.key — copy this, you'll need it on S3.
• Generate key pairs on S3:
  Same commands, saving to s3_private.key and s3_public.key.
  Display S3's public key — copy it, you'll need it on S1.
• Create the WireGuard config on S1:
  sudo nano /etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.1/24
PrivateKey = [S1's private key contents]
ListenPort = 51820

[Peer]
PublicKey = [S3's public key]
AllowedIPs = 10.0.0.2/32, 192.168.51.0/24
Endpoint = [S3-External-IP]:51820
  
  Explanation: WireGuard gives each tunnel interface a new virtual IP (10.0.0.x). AllowedIPs acts as both an access control list and a routing table — traffic for 10.0.0.2 and 192.168.51.0/24 goes through the tunnel.
• Create the WireGuard config on S3:
  [Interface]
Address = 10.0.0.2/24
PrivateKey = [S3's private key contents]
ListenPort = 51820

[Peer]
PublicKey = [S1's public key]
AllowedIPs = 10.0.0.1/32, 192.168.50.0/24
Endpoint = [S1-External-IP]:51820
• Bring up the WireGuard interface:
  sudo wg-quick up wg0 on both S1 and S3.
  Check the interface: sudo wg show — shows peers, latest handshake, bytes transferred, allowed IPs.
  Test: ping from S1 to S3's WireGuard IP: ping 10.0.0.2. Should succeed.
  Test: ping from S1 to S3's internal LAN IP through the WireGuard tunnel.
• Make WireGuard persistent:
  sudo systemctl enable wg-quick@wg0
  This enables the WireGuard interface to start automatically on boot.

Part 3 — Compare IPSec and WireGuard (10 min)

• Complete the comparison table in the lab sheet. Both tunnels are running simultaneously — the IPSec cert tunnel and the WireGuard tunnel coexist on the same machines. This demonstrates they are independent technologies.
• Key differences to highlight:
  Codebase: IPSec (StrongSwan charon daemon) ~400,000 lines. WireGuard kernel module ~4,000 lines. Smaller code = smaller attack surface.
  Cryptography: IPSec is configurable (and therefore misconfigurable). WireGuard uses fixed modern algorithms (ChaCha20-Poly1305, Curve25519, BLAKE2s) — no cipher negotiation possible, which is a feature not a limitation.
  Configuration: IPSec requires ipsec.secrets + ipsec.conf on both sides + NAT changes. WireGuard requires one config file per side.
  State: IPSec maintains complex SA state, IKE negotiation, DPD. WireGuard is stateless — a peer is "up" if it's sending packets, "down" if it's not. No keepalives required.
  Use cases: IPSec is the standard for enterprise-grade site-to-site VPNs and mobile client VPNs (IKEv2). WireGuard is increasingly popular for modern deployments, particularly for remote access VPNs where simplicity matters.