Watch a VPN change what the network can see

short · 40 min · Objective 1.2

Task

Bring up a WireGuard tunnel between your two lab hosts and capture the traffic on both sides of it. The objective describes VPNs abstractly; this shows you exactly what an observer on the path can and cannot read.

Steps

  1. Generate a key pair on each host: wg genkey | tee private.key | wg pubkey > public.key. Keep the private keys on their own machines — this is lab practice for a real habit.
  2. Create /etc/wireguard/wg0.conf on Host A with address 10.99.0.1/24, a listen port, its own private key, and a peer block naming Host B's public key, allowed IPs 10.99.0.2/32 and endpoint 192.168.20.10.
  3. Mirror it on Host B: address 10.99.0.2/24, peer is Host A's public key, allowed IPs 10.99.0.1/32, endpoint 192.168.10.10.
  4. Bring both up with sudo wg-quick up wg0 and confirm with sudo wg show.
  5. Start sudo tcpdump -i eth0 -n -c 20 on the router, then from Host A run ping -c 5 10.99.0.2. Read what the router sees.

Verify

sudo wg show
ping -c 3 10.99.0.2
sudo tcpdump -i eth0 -n -c 5 udp

wg show must report a recent handshake and non-zero transfer in both directions. The ping must succeed. And the router's capture must show UDP between 192.168.10.10 and 192.168.20.10 — not ICMP, and not the 10.99.0.0/24 addresses at all.

Notes

That last point is the whole lesson. The router is carrying your pings and cannot see that they are pings. It knows who is talking, how much and when, and nothing about what.

Contrast the three VPN topologies from the objective while the tunnel is up. What you built is site-to-site in miniature. A client-to-site VPN is the same machinery with one end being a laptop, and split tunnel versus full tunnel is decided entirely by that AllowedIPs line: set it to 0.0.0.0/0 and every packet goes down the tunnel.