What you will do
Two offices each have a private network that the other cannot see. A VPN tunnel joins them across the internet by wrapping every packet in an encrypted one, and WireGuard is a small, modern way to make one. You will look around two sites and see what is there before any tunnel. You will not build it: that is the lab's own task.
Before you start
Note
Press Start the lab on the bar at the top of this lesson. This lab is a whole Ubuntu machine of your own, with two sites built inside it, so it takes a little longer to come up than a container. Each Run button below types its command into the machine's terminal, one after another. If one says the machine is still starting, wait a few seconds and press it again. To watch them, or to type your own, press Open terminal on the bar.
1. Meet the machines
Everything here is built inside your one Ubuntu machine: each host and each gateway is a separate network namespace, with its own addresses. wglab status lists them. a1 is a host at site A and gwA is its gateway, and b1 and gwB are the same at site B. Each gateway has a second address on wan0, the link that stands for the internet, in 203.0.113.0/24.
wglab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. Try to reach the other site
ping sends a small packet and waits for an answer. Ask for b1 at the other site, 10.2.0.2. Nothing gets through, and the gateway next to a1 says why: Destination Net Unreachable, "I do not know a way to that network". The two private networks have never heard of each other.
sudo ip netns exec a1 ping -c 2 -W 1 10.2.0.2Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
3. Read the gateway's routes
A route says where to send packets for a network. gwA has exactly two: its own site, 10.1.0.0/24, and the internet link, 203.0.113.0/24. There is no line for 10.2.0.0/24, which is why the ping in step 2 stopped here.
sudo ip netns exec gwA ip routeShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
4. Is there a tunnel?
wg show lists WireGuard's interfaces with their keys and their peers. It prints nothing at all: there is no tunnel yet, and no keys. A command that finds nothing often says nothing, and that is an answer too.
sudo ip netns exec gwA wg showShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Now do the lab
Tip
You have found what is missing: keys, a configuration on each gateway and routes into a tunnel. Making them is the task of this lab: open README.md in your home folder with cat README.md in the terminal. It says what to do and gives none of the answers.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. This lesson is worked in a VM lab: each student has an Ubuntu machine of their own with two small sites inside it, and a Run types into its terminal and shows what it printed. The lab itself has a check that marks the tunnel from what was saved: a handshake, the traffic on the internet link, the routes and the keys. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.