0:00–0:30
Written
0:30–1:45
Practical
1:45–2:00
Review + Preview W7
Before 0:00Instructor setup
- Written assessment sheets face-down on desks.
- Practical specification prepared. Pre-generate a key pair for a "new" WireGuard peer the student must configure their end to connect to. The practical spec provides: the peer's public key, the peer's endpoint IP and port, the AllowedIPs for the peer, and the IP address the student should assign to their wg1 interface. Students must configure their side only — the peer "endpoint" is a pre-configured VM managed by the instructor.
- On board: Written — 30 min, pen and paper. Practical — 75 min, S1 and S3 available, man pages allowed, no internet, no notes.
0:00 – 0:30Written · 30 min · 30% of Mini-Assessment 5
Written — IPSec concepts, StrongSwan configuration, PKI, WireGuard
Pen and paper. No computer. 30 minutes.
Section A — IPSec Architecture (12 marks)
- Q1 (4 marks): Describe the two phases of IKE negotiation.
a) What is established in Phase 1?
b) What is established in Phase 2?
c) Why are two phases needed rather than one?
d) What protocol carries the actual encrypted data traffic after IKE completes?
- Q2 (2 marks): What is the difference between ESP and AH? Why is AH incompatible with NAT?
- Q3 (3 marks): The ipsec.conf connection on S1 contains:
left=172.17.10.1, leftsubnet=192.168.50.0/24
right=172.17.10.5, rightsubnet=192.168.51.0/24
a) What are the tunnel endpoint IPs?
b) When S2 (192.168.50.2) sends a packet to 192.168.51.10, what does the outer IP header of the ESP packet show as source and destination?
c) Why must the MASQUERADE NAT rule be modified before VPN traffic will work?
- Q4 (3 marks): Write the iptables rule that masquerades traffic from 192.168.50.0/24 going out through eth0, but excludes traffic destined for 192.168.51.0/24 (the remote VPN subnet).
Section B — Certificates and WireGuard (18 marks)
- Q5 (4 marks): Describe the PKI trust chain used in Lab 5C.
a) What makes the root CA "trusted" — what must each VPN endpoint have for this to work?
b) S1's ipsec.conf specifies leftid="C=CA, O=Andy, CN=s1.andy.net". Where does this string come from, and what happens if it doesn't match?
c) What is the --cakey argument in the ipsec pki --issue command? What value must it have, and why?
- Q6 (3 marks): To migrate from PSK to certificate authentication, three lines in ipsec.conf must change or be added. Identify the three changes and write each new line.
- Q7 (4 marks): Explain WireGuard's AllowedIPs directive.
a) What two functions does AllowedIPs serve simultaneously?
b) If a WireGuard peer's AllowedIPs is set to 10.0.0.2/32, 192.168.51.0/24 — what traffic is allowed through the tunnel to this peer?
c) What happens to a packet from S1 destined for 192.168.99.0/24 if that network is not in any peer's AllowedIPs?
- Q8 (4 marks): Write a complete WireGuard configuration for the S1 side of a tunnel, given:
S1 WireGuard IP: 10.5.0.1/24
S1 private key: (use the placeholder text "S1PRIVATEKEY")
S1 listen port: 51820
Peer (S3) public key: (use the placeholder "S3PUBLICKEY")
Peer endpoint: 172.17.20.5:51820
Traffic for 10.5.0.2/32 and 192.168.51.0/24 should go through the tunnel
- Q9 (3 marks): Compare IPSec and WireGuard on three dimensions: configuration complexity, cryptographic flexibility, and codebase size. For each, explain why the difference matters in practice.
0:30 – 1:45Practical · 75 min · 70% of Mini-Assessment 5
Configure a WireGuard tunnel on S1 using a provided specification
You are given a specification for a new WireGuard tunnel. A pre-configured peer endpoint exists and is ready to receive connections. Configure your S1 to connect to it. No notes, no internet. Man pages (man wg, man wg-quick) allowed. 75 minutes.
Tunnel specification (fill in before distributing)
| Parameter | Value |
|---|
| Your WireGuard interface name | wg1 (separate from wg0 built in Lab 5D) |
| Your tunnel IP address | 10.10.0.1/24 |
| Listen port | 51821 |
| Peer public key | [Pre-generated by instructor — paste here] |
| Peer endpoint | [Instructor VM IP]:51821 |
| Peer AllowedIPs | 10.10.0.2/32 |
Tasks and marks
- Task 1 (20 marks): Generate a WireGuard key pair for S1. Give your public key to the instructor (so they can add it to the peer config). Write it in the space below and show it to the instructor.
- Task 2 (25 marks): Write the /etc/wireguard/wg1.conf file using the specification above. Show the complete file to the instructor before running wg-quick up.
- Task 3 (25 marks): Bring up the wg1 interface:
sudo wg-quick up wg1. Show sudo wg show output to the instructor — the peer must show a recent handshake timestamp (within 30 seconds). Demonstrate: ping 10.10.0.2 — must succeed.
Student workspace
| Item | Value (fill in during practical) |
|---|
| Your S1 public key (give to instructor) | |
| Your S1 private key file path | |
| wg1.conf file contents | (write in space below) |
Marking criteria
| Task | Marks | Verified by |
|---|
| Key pair generated — public key provided to instructor | 20 | Student shows wg genkey pipeline output and public key file |
| wg1.conf written correctly — shown to instructor before startup | 25 | Instructor reviews: correct [Interface] IP, PrivateKey, ListenPort; correct [Peer] PublicKey, Endpoint, AllowedIPs |
| Handshake established — wg show confirms, ping 10.10.0.2 succeeds | 25 | wg show output shows peer with handshake timestamp; ping returns replies |
1:45 – 2:00Review + Week 6 Preview · 15 min
- Common WireGuard mistakes: wrong public key (copy-paste error), AllowedIPs missing the peer tunnel IP (10.10.0.2/32 must be in AllowedIPs or the handshake fails), UDP port not open in UFW. Walk through each.
- Week summary: students have now built a VPN in three ways — PSK, certificate, and WireGuard. The cert-based IPSec tunnel is the most enterprise-appropriate. WireGuard is the most modern and simple. Both coexist on the machines without interfering.
- Preview Week 6: "Week 6 is the capstone week before the final exam. Docker containers, docker-compose, and then a full stack: Nginx reverse proxy → Docker container → application. Everything from Week 4 (Nginx, DNS) comes back together. It's the most satisfying week of the course."
Mini-Assessment 5 — marking summary
| Component | Format | Weight | Key topics |
|---|
| Written — Section A (IPSec) | Short answer + config | 12 marks (30%) | IKE phases, ESP vs AH, tunnel endpoints, NAT exclusion rule |
| Written — Section B (PKI + WireGuard) | Short answer + config | 18 marks (30%) | PKI trust chain, cert migration changes, AllowedIPs function, WireGuard config, IPSec vs WireGuard comparison |
| Practical — Key generation | Live demonstration | 20 marks (70%) | wg genkey pipeline, public key provided to instructor |
| Practical — Config file | Written config reviewed | 25 marks (70%) | All [Interface] and [Peer] fields correct |
| Practical — Tunnel up and ping | Live demonstration | 25 marks (70%) | wg show handshake, ping 10.10.0.2 succeeds |