WireGuard Mesh VPN

Why WireGuard

Vultr, Oracle Cloud, and AWS are completely separate networks. By default they cannot reach each other at all. Active Directory relies on constant communication — LDAP, Kerberos, DNS, replication — between all machines. Without a VPN, a machine on Oracle Cloud has no way to contact the Domain Controller on Vultr.

WireGuard creates an encrypted Layer 3 tunnel. Each machine gets a private IP in the 10.10.0.0/24 range. DC01 at 10.10.0.1 is the hub — every other machine connects to it as a peer. The hub routes traffic between all peers.

Step 1 — Install WireGuard on DC01 (Windows)

Downloaded and installed WireGuard on the Windows Server from PowerShell:

After installation, opened the WireGuard GUI. The first step is creating a new tunnel from the dropdown.

Step 2 — Key Generation

WireGuard uses public/private key pairs. Each machine generates its own pair. On Windows, the GUI generates keys automatically when you create a new tunnel. On Linux, you generate them manually.

The keys used for DC01 in this lab:

PublicKey  = /qe58vBz5fDxhCmq9OQ3Nc+CjVHWluCsD7IQfb+UsAc=
# PrivateKey stays on the server — never share it

Step 3 — Create the Hub Tunnel on DC01

In WireGuard on DC01, clicked "Add Tunnel" → "Create New Tunnel". The interface section was filled in like this:

[Interface]
PrivateKey = <DC01-PRIVATE-KEY>
Address = 10.10.0.1/24
ListenPort = 51820
DNS = 127.0.0.1

After saving and activating, the tunnel shows as active with the public key, listener port, and address.

Step 4 — Verify the Interface on Windows

Ran ipconfig to confirm the WireGuard virtual adapter appeared with the right IP:

Also confirmed the Windows Firewall had the WireGuard inbound rule enabled:

Step 5 — Oracle Machine Peer Config

For the Oracle Windows machine (VOUGHT-HQ), a tunnel was created pointing back at DC01. The Oracle machine gets WireGuard IP 10.10.0.2.

[Interface]
PrivateKey = <ORACLE-MACHINE-PRIVATE-KEY>
Address = 10.10.0.2/24
ListenPort = 51820

[Peer]
PublicKey = /qe58vBz5fDxhCmq9OQ3Nc+CjVHWluCsD7IQfb+UsAc=
AllowedIPs = 10.10.0.0/24
Endpoint = <DC01-VULTR-PUBLIC-IP>:51820
PersistentKeepalive = 25

Both machines' WireGuard GUIs side by side — machine 1 at 10.10.0.1 and machine 2 at 10.10.0.2:

Step 6 — Add Oracle Machine as Peer on DC01

Back on DC01, edited the existing tunnel and added the Oracle machine as a peer. Each new machine you add gets its own [Peer] block:

[Peer]
PublicKey = OVSXZgFPNAVYFGWiAiZX+1ZO+wtFZs7fLeePju9eAB0=
AllowedIPs = 10.10.0.2/32
Endpoint = <ORACLE-PUBLIC-IP>:51820
PersistentKeepalive = 25

# Add one [Peer] block per machine:
# 10.10.0.3/32 = BATCAVE (Oracle Linux)
# 10.10.0.5/32 = WATCHTOWER (AWS Jenkins)

Step 7 — Verify the Tunnel is Working

Pinged from DC01 to the Oracle machine and back. Both should reply through the tunnel.

Step 8 — DNS Configuration for Active Directory

WireGuard only creates a routed tunnel — it does not handle DNS. Every machine that needs to contact AD must use the DC's WireGuard IP (10.10.0.1) as its primary DNS server. Without this, the machine cannot resolve hq.apex-corp.xyz and domain join will fail.

# Point DNS at DC01 via WireGuard IP
$adapter = Get-NetAdapter | Where-Object {$_.Status -eq "Up"} | Select-Object -First 1
Set-DnsClientServerAddress -InterfaceIndex $adapter.ifIndex `
  -ServerAddresses "10.10.0.1","8.8.8.8"

# Verify it resolves AD names
nslookup stark-tower.hq.apex-corp.xyz

# Create /etc/netplan/99-custom-dns.yaml
network:
  version: 2
  ethernets:
    enp39s0:          # replace with your interface name (ip link show)
      nameservers:
        addresses: [10.10.0.1, 8.8.8.8]
        search: [hq.apex-corp.xyz]
      dhcp4-overrides:
        use-dns: false
        use-domains: false

# Apply
sudo chmod 600 /etc/netplan/99-custom-dns.yaml
sudo netplan try

# /etc/krb5.conf — required for Linux AD domain join
[libdefaults]
    default_realm = HQ.APEX-CORP.XYZ
    rdns = false       # ← without this, domain join fails silently

[realms]
    HQ.APEX-CORP.XYZ = {
        kdc = stark-tower.hq.apex-corp.xyz
        admin_server = stark-tower.hq.apex-corp.xyz
    }

[domain_realm]
    .hq.apex-corp.xyz = HQ.APEX-CORP.XYZ
    hq.apex-corp.xyz = HQ.APEX-CORP.XYZ

Full Tunnel Map

Mesh Verification Checklist

• DC01 (STARK-TOWER) — hub configured with all peer public keys
• VOUGHT-HQ (Oracle) — connects to hub, reachable at 10.10.0.2
• BATCAVE (Oracle Linux) — connects to hub, reachable at 10.10.0.3
• FLATIRON (Vultr) — connects to hub, reachable at 10.10.0.4
• WATCHTOWER (AWS) — connects to hub, reachable at 10.10.0.5
• DNS configured — all peers use 10.10.0.1 for AD name resolution
• PersistentKeepalive = 25 set on all peers behind NAT