edgesecurityaccess-wireguard-vpn

EdgeSecurityAccess WireGuard VPN Skill Skill by ara.so — Security Skills collection. EdgeSecurityAccess (ESA) is a WireGuard-based rapid networking software suite for setting up virtual private networks. It consists of three components: ESA mainframe (Go server), ESA utility software package (C/C++ tools), and ESA desktop client (C# Windows GUI). The server exposes an HTTP API for retrieving WireGuard configurations based on username/password authentication. Installation Prerequisites Linux Server: Windows Client: Build ESA Mainframe Build ESA Desktop (Windows) Configuration Generate WireGuar…

\n\n# Check logs\njournalctl -u esa -f\n```\n\n### Authentication Fails\n\n```bash\n# Verify user exists\ngrep \"^username:\" /etc/esa/users.txt\n\n# Check users.txt format (should be username:password:ip:pubkey)\ncat /etc/esa/users.txt\n\n# Regenerate usrwg.conf\ncd /etc/esa\n./ESAProc\n```\n\n### WireGuard Connection Issues\n\n```bash\n# Check WireGuard interface status\nwg show wg0\n\n# Verify server can reach UDP port\nnc -u -v vpn.example.com 50000\n\n# Check routing\nip route show\n\n# Test from client\nping 172.16.16.1\n\n# Check server firewall\niptables -L -n -v\nufw status\n\n# Allow WireGuard port\nufw allow 50000/udp\n```\n\n### Cannot Forward Traffic\n\n```bash\n# Verify IP forwarding is enabled\nsysctl net.ipv4.ip_forward\n# Should output: net.ipv4.ip_forward = 1\n\n# Check NAT rules\niptables -t nat -L -n -v\n\n# Re-add NAT rule\niptables -t nat -A POSTROUTING -s 172.16.16.0/24 -o eth0 -j MASQUERADE\n\n# Save iptables rules\niptables-save > /etc/iptables/rules.v4\n```\n\n### HTTP API Returns Empty\n\n```bash\n# Test with verbose curl\ncurl -v -X POST \\\n --data \"username=alice&password=secure_password\" \\\n http://127.0.0.1:50001\n\n# Check if users.txt is properly formatted\ncat /etc/esa/users.txt | sed 's/:/ : /g'\n\n# Verify usrwg.conf was generated\ncat /etc/esa/usrwg.conf\n\n# Restart ESA server\nsystemctl restart esa\n```\n\n### Key Security Issues\n\n**Note:** ESA stores user private keys on the server (architectural limitation). For production use:\n\n```bash\n# Restrict file permissions\nchmod 600 /etc/esa/users.txt\nchmod 600 /etc/esa/usrwg.conf\nchown root:root /etc/esa/*.txt /etc/esa/*.conf\n\n# Encrypt sensitive files (future improvement)\n# Current version does NOT encrypt username/password\n# Use HTTPS reverse proxy to protect credentials in transit\n```\n\n### Performance Tuning\n\n```bash\n# Increase WireGuard MTU if needed\nip link set dev wg0 mtu 1420\n\n# Optimize sysctl for VPN\ncat >> /etc/sysctl.conf \u003c\u003cEOF\nnet.core.rmem_max = 134217728\nnet.core.wmem_max = 134217728\nnet.ipv4.tcp_rmem = 4096 87380 67108864\nnet.ipv4.tcp_wmem = 4096 65536 67108864\nEOF\nsysctl -p\n```\n\n## Security Considerations\n\n1. **Use HTTPS reverse proxy** (Nginx/Caddy) to protect credentials\n2. **Passwords are stored in plaintext** in users.txt - restrict access\n3. **User private keys stored on server** - architectural limitation\n4. **No rate limiting** - implement fail2ban or reverse proxy rate limits\n5. **Enable firewall rules** to restrict HTTP API access\n6. **Regular backups** of configuration files\n7. **Monitor logs** for authentication attempts\n\n```bash\n# Example fail2ban filter for ESA\n# /etc/fail2ban/filter.d/esa.conf\n[Definition]\nfailregex = ^.*Authentication failed for user \u003cHOST>.*$\nignoreregex =\n\n# /etc/fail2ban/jail.local\n[esa]\nenabled = true\nport = 50001\nfilter = esa\nlogpath = /var/log/esa/access.log\nmaxretry = 5\nbantime = 3600\n```","attachment_filenames":[],"attachments":[],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"EdgeSecurityAccess WireGuard VPN Skill","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"Skill by ","type":"text"},{"text":"ara.so","type":"text","marks":[{"type":"link","attrs":{"href":"https://ara.so","title":null}}]},{"text":" — Security Skills collection.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"EdgeSecurityAccess (ESA) is a WireGuard-based rapid networking software suite for setting up virtual private networks. It consists of three components: ESA mainframe (Go server), ESA utility software package (C/C++ tools), and ESA desktop client (C# Windows GUI). The server exposes an HTTP API for retrieving WireGuard configurations based on username/password authentication.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Installation","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"paragraph","content":[{"text":"Linux Server:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Install WireGuard\napt install wireguard # Debian/Ubuntu\n# or\nyum install wireguard-tools # RHEL/CentOS\n\n# Install Go 1.26+ for building ESA mainframe\nwget https://go.dev/dl/go1.26.linux-amd64.tar.gz\ntar -C /usr/local -xzf go1.26.linux-amd64.tar.gz\nexport PATH=$PATH:/usr/local/go/bin","type":"text"}]},{"type":"paragraph","content":[{"text":"Windows Client:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"powershell"},"content":[{"text":"# Install WireGuard\nwinget install WireGuard.WireGuard\n\n# Install .NET Runtime for ESA Desktop\n# Download from Microsoft official website","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Build ESA Mainframe","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"git clone https://github.com/KochiyaSanaeNya/EdgeSecurityAccess.git\ncd EdgeSecurityAccess\n\n# Build the main server\ngo build -o esa-server ./main.go\n\n# Build utility tools (C/C++)\ncd tools\ngcc -o ESAusr ESAusr.c\ngcc -o ESAProc ESAProc.c\ngcc -o ESAInit ESAInit.c\ncd ..","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Build ESA Desktop (Windows)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Open solution in Visual Studio and build\n# Or use dotnet CLI\ncd ESADesktop\ndotnet build -c Release","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuration","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Generate WireGuard Keys","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Generate server keys\nwg genkey | tee server_private.key | wg pubkey > server_public.key\n\n# Generate client keys (done automatically by ESAProc)\nwg genkey | tee client_private.key | wg pubkey > client_public.key","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create esa.conf","type":"text"}]},{"type":"paragraph","content":[{"text":"Create ","type":"text"},{"text":"/etc/esa/esa.conf","type":"text","marks":[{"type":"code_inline"}]},{"text":":","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"$servip = 172.16.16.1/24\n$subnet = 172.16.16.0/24\n$endpoint = vpn.example.com:50000\n$keeptime = 25\n$wgport = 50000\n$httport = 50001\n$servpriv = $(cat server_private.key)\n$servpub = $(cat server_public.key)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Configuration File Structure","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"go"},"content":[{"text":"// Configuration keys reference\ntype Config struct {\n ServIP string // $servip - Server IP in virtual network\n Subnet string // $subnet - Virtual network subnet\n Endpoint string // $endpoint - External WireGuard access point\n KeepTime int // $keeptime - NAT traversal keepalive interval\n WGPort int // $wgport - WireGuard UDP port\n HTTPPort int // $httport - HTTP API port\n ServPriv string // $servpriv - Server WireGuard private key\n ServPub string // $servpub - Server WireGuard public key\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"User Management","type":"text"}]},{"type":"paragraph","content":[{"text":"Add users with ESAusr:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Copy ESAusr to config directory\ncp tools/ESAusr /etc/esa/\ncd /etc/esa\n\n# Run and follow prompts\n./ESAusr\n# Enter username: alice\n# Enter password: secure_password\n# User added to users.txt","type":"text"}]},{"type":"paragraph","content":[{"text":"users.txt format:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"alice:secure_password:172.16.16.2/32:client_public_key_here\nbob:another_password:172.16.16.3/32:another_public_key_here","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Generate User WireGuard Configs","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Copy ESAProc to config directory\ncp tools/ESAProc /etc/esa/\ncd /etc/esa\n\n# Generate usrwg.conf from users.txt\n./ESAProc\n# Output: usrwg.conf created with all user WireGuard configurations","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Initialize Local WireGuard","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Copy ESAInit to config directory\ncp tools/ESAInit /etc/esa/\ncd /etc/esa\n\n# Configure local WireGuard interface\n./ESAInit\n# Output: /etc/wireguard/wg0.conf configured","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Running the Server","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Start ESA Mainframe","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Start the server\n./esa-server -config /etc/esa/esa.conf\n\n# Or run as systemd service\ncat > /etc/systemd/system/esa.service \u003c\u003cEOF\n[Unit]\nDescription=EdgeSecurityAccess VPN Server\nAfter=network.target\n\n[Service]\nType=simple\nExecStart=/usr/local/bin/esa-server -config /etc/esa/esa.conf\nRestart=on-failure\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsystemctl daemon-reload\nsystemctl enable esa\nsystemctl start esa","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Start WireGuard Interface","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Bring up WireGuard interface\nwg-quick up wg0\n\n# Check status\nwg show\n\n# Enable at boot\nsystemctl enable wg-quick@wg0","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Enable Kernel Forwarding","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Enable IP forwarding\nsysctl -w net.ipv4.ip_forward=1\n\n# Persist across reboots\necho \"net.ipv4.ip_forward=1\" >> /etc/sysctl.conf\nsysctl -p\n\n# Configure NAT (replace eth0 with your interface)\niptables -t nat -A POSTROUTING -s 172.16.16.0/24 -o eth0 -j MASQUERADE\niptables -A FORWARD -i wg0 -j ACCEPT\niptables -A FORWARD -o wg0 -j ACCEPT","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"HTTP API Usage","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Retrieve User Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"cURL Example:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Get WireGuard config for user\ncurl -X POST \\\n --data \"username=alice&password=secure_password\" \\\n http://127.0.0.1:50001\n\n# Response (WireGuard config):\n# [Interface]\n# PrivateKey = client_private_key\n# Address = 172.16.16.2/32\n# [Peer]\n# PublicKey = server_public_key\n# AllowedIPs = 172.16.16.0/24\n# Endpoint = vpn.example.com:50000\n# PersistentKeepalive = 25","type":"text"}]},{"type":"paragraph","content":[{"text":"Go Client Example:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"go"},"content":[{"text":"package main\n\nimport (\n \"fmt\"\n \"io\"\n \"net/http\"\n \"net/url\"\n \"strings\"\n)\n\nfunc getWireGuardConfig(username, password, apiURL string) (string, error) {\n data := url.Values{}\n data.Set(\"username\", username)\n data.Set(\"password\", password)\n\n resp, err := http.Post(\n apiURL,\n \"application/x-www-form-urlencoded\",\n strings.NewReader(data.Encode()),\n )\n if err != nil {\n return \"\", err\n }\n defer resp.Body.Close()\n\n body, err := io.ReadAll(resp.Body)\n if err != nil {\n return \"\", err\n }\n\n return string(body), nil\n}\n\nfunc main() {\n config, err := getWireGuardConfig(\n \"alice\",\n \"secure_password\",\n \"http://127.0.0.1:50001\",\n )\n if err != nil {\n panic(err)\n }\n fmt.Println(config)\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Python Client Example:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"import requests\n\ndef get_wireguard_config(username, password, api_url):\n response = requests.post(\n api_url,\n data={\n 'username': username,\n 'password': password\n }\n )\n return response.text\n\nconfig = get_wireguard_config(\n 'alice',\n 'secure_password',\n 'http://127.0.0.1:50001'\n)\nprint(config)\n\n# Save to file and connect\nwith open('wg_client.conf', 'w') as f:\n f.write(config)\n\nimport subprocess\nsubprocess.run(['wg-quick', 'up', 'wg_client.conf'])","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Client Connection","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Linux/macOS CLI","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Get config and save\ncurl -X POST \\\n --data \"username=alice&password=secure_password\" \\\n http://127.0.0.1:50001 > esa_user.conf\n\n# Connect\nwg-quick up esa_user.conf\n\n# Test connection\nping 172.16.16.1\n\n# Disconnect\nwg-quick down esa_user.conf","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Using ESA Desktop (Windows)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"1. Launch ESA Desktop application\n2. Enter:\n - Username: alice\n - Password: secure_password\n - Server URL: http://vpn.example.com:50001\n3. Click \"Connect\"\n4. WireGuard tunnel establishes automatically","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reverse Proxy Setup (HTTPS)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Nginx Configuration","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"nginx"},"content":[{"text":"server {\n listen 443 ssl http2;\n server_name vpn.example.com;\n\n ssl_certificate /etc/ssl/certs/vpn.example.com.crt;\n ssl_certificate_key /etc/ssl/private/vpn.example.com.key;\n\n location / {\n proxy_pass http://127.0.0.1:50001;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n }\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Caddy Configuration","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"vpn.example.com {\n reverse_proxy 127.0.0.1:50001\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Update client requests to use HTTPS:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"curl -X POST \\\n --data \"username=alice&password=secure_password\" \\\n https://vpn.example.com","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Common Patterns","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Automated User Provisioning","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"go"},"content":[{"text":"package main\n\nimport (\n \"crypto/rand\"\n \"encoding/base64\"\n \"fmt\"\n \"os\"\n \"strings\"\n\n \"golang.org/x/crypto/curve25519\"\n)\n\n// Generate WireGuard key pair\nfunc generateKeyPair() (privKey, pubKey string, err error) {\n var private [32]byte\n if _, err := rand.Read(private[:]); err != nil {\n return \"\", \"\", err\n }\n\n public, err := curve25519.X25519(private[:], curve25519.Basepoint)\n if err != nil {\n return \"\", \"\", err\n }\n\n privKey = base64.StdEncoding.EncodeToString(private[:])\n pubKey = base64.StdEncoding.EncodeToString(public)\n return privKey, pubKey, nil\n}\n\n// Add user to users.txt\nfunc addUser(username, password, ip string) error {\n _, pubKey, err := generateKeyPair()\n if err != nil {\n return err\n }\n\n userLine := fmt.Sprintf(\"%s:%s:%s:%s\\n\", username, password, ip, pubKey)\n\n f, err := os.OpenFile(\"/etc/esa/users.txt\", os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0600)\n if err != nil {\n return err\n }\n defer f.Close()\n\n _, err = f.WriteString(userLine)\n return err\n}\n\nfunc main() {\n err := addUser(\"newuser\", \"newpass\", \"172.16.16.10/32\")\n if err != nil {\n panic(err)\n }\n fmt.Println(\"User added successfully\")\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Health Check Endpoint","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"go"},"content":[{"text":"package main\n\nimport (\n \"fmt\"\n \"net/http\"\n)\n\nfunc healthCheckHandler(w http.ResponseWriter, r *http.Request) {\n w.WriteHeader(http.StatusOK)\n fmt.Fprintf(w, \"OK\")\n}\n\nfunc main() {\n http.HandleFunc(\"/health\", healthCheckHandler)\n http.ListenAndServe(\":50002\", nil)\n}","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"User Config Backup Script","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"#!/bin/bash\n# backup_esa_users.sh\n\nBACKUP_DIR=\"/var/backups/esa\"\nCONFIG_DIR=\"/etc/esa\"\nTIMESTAMP=$(date +%Y%m%d_%H%M%S)\n\nmkdir -p \"$BACKUP_DIR\"\n\n# Backup user files\ntar -czf \"$BACKUP_DIR/esa_backup_$TIMESTAMP.tar.gz\" \\\n \"$CONFIG_DIR/users.txt\" \\\n \"$CONFIG_DIR/usrwg.conf\" \\\n \"$CONFIG_DIR/esa.conf\"\n\n# Keep only last 7 backups\nls -t \"$BACKUP_DIR\"/esa_backup_*.tar.gz | tail -n +8 | xargs -r rm\n\necho \"Backup completed: esa_backup_$TIMESTAMP.tar.gz\"","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Troubleshooting","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Server Won't Start","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Check if port is already in use\nnetstat -tuln | grep 50001\nlsof -i :50001\n\n# Check WireGuard port\nnetstat -tuln | grep 50000\n\n# Verify configuration syntax\ncat /etc/esa/esa.conf | grep -E '^\\

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\n\n# Check logs\njournalctl -u esa -f","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Authentication Fails","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Verify user exists\ngrep \"^username:\" /etc/esa/users.txt\n\n# Check users.txt format (should be username:password:ip:pubkey)\ncat /etc/esa/users.txt\n\n# Regenerate usrwg.conf\ncd /etc/esa\n./ESAProc","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"WireGuard Connection Issues","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Check WireGuard interface status\nwg show wg0\n\n# Verify server can reach UDP port\nnc -u -v vpn.example.com 50000\n\n# Check routing\nip route show\n\n# Test from client\nping 172.16.16.1\n\n# Check server firewall\niptables -L -n -v\nufw status\n\n# Allow WireGuard port\nufw allow 50000/udp","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Cannot Forward Traffic","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Verify IP forwarding is enabled\nsysctl net.ipv4.ip_forward\n# Should output: net.ipv4.ip_forward = 1\n\n# Check NAT rules\niptables -t nat -L -n -v\n\n# Re-add NAT rule\niptables -t nat -A POSTROUTING -s 172.16.16.0/24 -o eth0 -j MASQUERADE\n\n# Save iptables rules\niptables-save > /etc/iptables/rules.v4","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"HTTP API Returns Empty","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Test with verbose curl\ncurl -v -X POST \\\n --data \"username=alice&password=secure_password\" \\\n http://127.0.0.1:50001\n\n# Check if users.txt is properly formatted\ncat /etc/esa/users.txt | sed 's/:/ : /g'\n\n# Verify usrwg.conf was generated\ncat /etc/esa/usrwg.conf\n\n# Restart ESA server\nsystemctl restart esa","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Key Security Issues","type":"text"}]},{"type":"paragraph","content":[{"text":"Note:","type":"text","marks":[{"type":"strong"}]},{"text":" ESA stores user private keys on the server (architectural limitation). For production use:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Restrict file permissions\nchmod 600 /etc/esa/users.txt\nchmod 600 /etc/esa/usrwg.conf\nchown root:root /etc/esa/*.txt /etc/esa/*.conf\n\n# Encrypt sensitive files (future improvement)\n# Current version does NOT encrypt username/password\n# Use HTTPS reverse proxy to protect credentials in transit","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Performance Tuning","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Increase WireGuard MTU if needed\nip link set dev wg0 mtu 1420\n\n# Optimize sysctl for VPN\ncat >> /etc/sysctl.conf \u003c\u003cEOF\nnet.core.rmem_max = 134217728\nnet.core.wmem_max = 134217728\nnet.ipv4.tcp_rmem = 4096 87380 67108864\nnet.ipv4.tcp_wmem = 4096 65536 67108864\nEOF\nsysctl -p","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Security Considerations","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Use HTTPS reverse proxy","type":"text","marks":[{"type":"strong"}]},{"text":" (Nginx/Caddy) to protect credentials","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Passwords are stored in plaintext","type":"text","marks":[{"type":"strong"}]},{"text":" in users.txt - restrict access","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"User private keys stored on server","type":"text","marks":[{"type":"strong"}]},{"text":" - architectural limitation","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"No rate limiting","type":"text","marks":[{"type":"strong"}]},{"text":" - implement fail2ban or reverse proxy rate limits","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Enable firewall rules","type":"text","marks":[{"type":"strong"}]},{"text":" to restrict HTTP API access","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Regular backups","type":"text","marks":[{"type":"strong"}]},{"text":" of configuration files","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Monitor logs","type":"text","marks":[{"type":"strong"}]},{"text":" for authentication attempts","type":"text"}]}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Example fail2ban filter for ESA\n# /etc/fail2ban/filter.d/esa.conf\n[Definition]\nfailregex = ^.*Authentication failed for user \u003cHOST>.*$\nignoreregex =\n\n# /etc/fail2ban/jail.local\n[esa]\nenabled = true\nport = 50001\nfilter = esa\nlogpath = /var/log/esa/access.log\nmaxretry = 5\nbantime = 3600","type":"text"}]}]},"metadata":{"date":"2026-11-02","name":"edgesecurityaccess-wireguard-vpn","author":"@skillopedia","source":{"stars":12,"repo_name":"security-skills","origin_url":"https://github.com/reason-machines/security-skills/blob/HEAD/skills/edgesecurityaccess-wireguard-vpn/SKILL.md","repo_owner":"reason-machines","body_sha256":"2e9dce88b03edecb554f7bb772e0036abcc7c8ead9ef60c1b83637a527c7bc2c","cluster_key":"6c5e85d76cf130c1d910cf2fcca83e3a48a6503a788ce877bd2b9592d6b30a99","clean_bundle":{"format":"clean-skill-bundle-v1","source":"reason-machines/security-skills/skills/edgesecurityaccess-wireguard-vpn/SKILL.md","text_bytes":0,"source_commit":"1722e18788818fff1b0144132437936c2095971c","skills_sh_rank":15343,"attachment_count":0,"text_attachments":0,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/edgesecurityaccess-wireguard-vpn/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","triggers":["set up EdgeSecurityAccess VPN server","configure ESA WireGuard networking","create ESA VPN users and configuration","deploy EdgeSecurityAccess server","manage WireGuard users with ESA","build ESA utility tools","connect to ESA VPN server","troubleshoot EdgeSecurityAccess issues"],"import_tag":"skills-sh-top20k-2026-11","description":"WireGuard-based rapid VPN networking software for Linux with HTTP API and utility tools"}},"renderedAt":1793661830434}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.