WireGuard¶

WireGuard is the tunnel between the VPS and the home LAN. Its job today is narrow and important: it carries the Minecraft game traffic. Human remote access has moved to Tailscale — do not build new access paths on this tunnel.

Topology¶

The VPS is the hub. Interface wg0 on the VPS is 10.10.0.1/24, listening on UDP 51820 (allowed through UFW).

Peer	Tunnel IP	Identity	Purpose
(hub)	10.10.0.1	VPS	Hub; NPM forwards Minecraft UDP down the tunnel
`mc`	10.10.0.2	Minecraft VM (guest `minecraft`, VMID 103 on Proxmox)	Receives the game traffic
`io`	10.10.0.3	Unknown to these docs	Unknown to these docs

ASK ELLIOTT: what is the io peer?

The io peer (10.10.0.3, public key on the VPS since 2025-08-21) exists in the hub config, but nothing in the estate survey identifies which device it is or whether it is still in use. Ask Elliott, then either document it here or remove the peer from the hub config. An unused peer with a valid key is standing remote access — it should not stay undocumented.

What flows through it¶

Minecraft Bedrock players connect to the VPS's public IP on UDP 19132/19134/19136. NPM does a stream passthrough and forwards each port over the tunnel to the Minecraft VM at 10.10.0.2. That is the entire production role of WireGuard today.

player ──UDP 19132/19134/19136──▶ VPS (NPM passthrough)
                                    │
                                    ▼  wg0 tunnel (UDP 51820)
                              10.10.0.2  Minecraft VM (103)

What it no longer does

Backups: the VPS backup leg was fully retired 2026-08-11 — no rsync rides this tunnel anymore.
Remote admin: Tailscale (with the ops subnet router) is the supported way for humans to reach the LAN. WireGuard peers should not be added for personal devices.

Where the config lives¶

Thing	Location	Notes
Hub (server) config	`/etc/wireguard/` on the VPS	Root-only; contains the hub private key — never copy it into docs
Client public keys	`/home/elliott/mc_public.key`, `/home/elliott/io_public.key` on the VPS	Public halves only
Client (peer) configs	On each peer (e.g. the Minecraft VM)	Each peer holds its own private key

This page is written from the outside

It documents what is visible without root on the VPS: the wg0 address, the UFW port, and the two client public-key files in ~elliott. The authoritative peer list is /etc/wireguard/ (root). Next time you are on the VPS with sudo, run sudo wg show and reconcile this table — especially endpoints, allowed-IPs, and last-handshake times.

Health checks¶

Read-only, from the VPS:

ip -br addr show wg0          # interface up, 10.10.0.1/24
sudo wg show                  # peers, last handshake, transfer counters

Quick functional test: join one of the Minecraft servers from outside the LAN — if the world loads, the tunnel is passing traffic. See the Minecraft runbook for server-side checks, and topology for where this tunnel sits in the wider network.