Why WireGuard?

When I joined NetBridge ISP, the existing IPSec VPN between offices was a nightmare — slow, complex to manage, and constantly causing issues. WireGuard changed everything. It's faster, simpler, and the kernel-level implementation makes it incredibly reliable.

The Architecture

8 sites, full mesh = 28 WireGuard tunnels total. Each site connects directly to every other site with no hub-and-spoke bottleneck.

WireGuard Configuration

# /etc/wireguard/wg0.conf — Site A (HQ)
[Interface]
PrivateKey = <SITE_A_PRIVATE_KEY>
Address = 10.200.0.1/16
ListenPort = 51820
PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Site B — Pristina Office
[Peer]
PublicKey  = <SITE_B_PUBLIC_KEY>
Endpoint   = b.azimstech.com:51820
AllowedIPs = 10.200.1.0/24, 192.168.10.0/24
PersistentKeepalive = 25

# Site C — Prizren Office
[Peer]
PublicKey  = <SITE_C_PUBLIC_KEY>
Endpoint   = c.azimstech.com:51820
AllowedIPs = 10.200.2.0/24, 192.168.20.0/24
PersistentKeepalive = 25

Automation Script

#!/bin/bash
# Generate WireGuard keypairs for all sites
SITES=(hq pristina prizren peja gjilan ferizaj mitrovica gjakova)

for site in "${SITES[@]}"; do
  mkdir -p /etc/wireguard/keys/$site
  wg genkey | tee /etc/wireguard/keys/$site/private | wg pubkey > /etc/wireguard/keys/$site/public
  echo "Site: $site"
  echo "  Public: $(cat /etc/wireguard/keys/$site/public)"
done

BGP with BIRD for Failover

router id 10.200.0.1;

protocol bgp site_b {
  neighbor 10.200.1.1 as 65002;
  local as 65001;
  export all;
  import all;
}

protocol bgp site_c {
  neighbor 10.200.2.1 as 65003;
  local as 65001;
  export all;
  import all;
}

Monitoring Tunnel Health

#!/bin/bash
# Check all WireGuard peers and alert if handshake > 3 minutes ago
wg show all latest-handshakes | while read iface peer timestamp; do
  age=$(( $(date +%s) - timestamp ))
  if [ $age -gt 180 ]; then
    echo "ALERT: Peer $peer on $iface — last handshake ${age}s ago"
    # Send alert to monitoring system
  fi
done

Results After 18 Months

The mesh has been running for 18 months with 99.99% uptime across all tunnels. The only downtime was a 4-minute outage during an ISP backbone cut — and even then, 6 of 8 sites maintained connectivity through alternative paths.