Mohammed Shareek

About This Project

Built a self-hosted WireGuard relay on a cloud VPS that gives me secure remote access to my whole lab — without forwarding a single port or exposing any internal service to the internet.

Architecture

• WireGuard relay on a hardened cloud VPS acts as the meeting point
• A site-to-site tunnel from my pfSense firewall to the relay, so one connection reaches every internal network instead of one host
• Per-device peer profiles for laptop, phone, and desktop, each with its own key pair and an additional preshared key

Least Privilege by Design

• The phone uses a split tunnel and can reach only the one VLAN it actually needs
• The laptop has two profiles: a home profile for local use, and a travel profile with full tunnel and kill switch for untrusted networks
• Routing is defined per peer, so a compromised device does not equal a compromised lab

Hardening

SSH key-only access to the relay, restricted cloud firewall rules, and a documented key rotation procedure.

Problems Solved

• Resolved an address overlap between the VPN tunnel network and a DNS blocklist component
• Diagnosed missing kernel routes after runtime peer changes — the configuration looked correct but traffic did not flow until the service was reloaded properly
• Traced a tunnel that failed with no error message at all to a wrong public key, because WireGuard silently ignores an invalid self-referencing peer

Skills Demonstrated

• VPN architecture
• WireGuard
• Firewall rule design
• Cloud server hardening
• Network routing and troubleshooting