WireGuard: Author a Road-Warrior Gateway Config

MediumNetworking20-30 min

The brief

A remote user needs to tunnel all their traffic through your server: the box must terminate a WireGuard tunnel AND NAT the peer's packets out to the internet. Write /etc/wireguard/wg0.conf from the parameters in /root/case/assignment.env.

It needs an [Interface] (the VPN-side Address, the ListenPort, the server PrivateKey, and a PostUp MASQUERADE rule out the egress interface that makes it a gateway; iptables or the nft equivalent both count) and a [Peer] (the peer's PublicKey and its AllowedIPs). The MASQUERADE rule is the difference between a working gateway and a tunnel that connects but reaches nothing. Grading parses the config; see /root/case/brief.txt.

What you'll do

Set the [Interface] Address and ListenPort from the assignment
Place the server PrivateKey
Add the PostUp NAT/MASQUERADE rule on the egress interface (the gateway step)
Add the [Peer] with its PublicKey and AllowedIPs

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.