Learn Alpine Linux - Advanced Networking: VPN & Tunneling

#Introduction

Alpine is a favorite distro for routers and gateways, and episode 18 leverages that position to build private connections between networks. You'll build WireGuard running in the kernel, configure OpenVPN and IPsec with strongSwan, and use SSH tunneling and a Tailscale-style mesh.

This material complements the nftables firewall from episode 10: VPNs and firewalls work together. Encrypted traffic comes in through the ports the firewall opens, then gets routed to the internal network.

#WireGuard: A Native Kernel VPN

#Installing and Enabling

WireGuard runs as a kernel module and provides a virtual interface:

Install WireGuard

apk add wireguard-tools
modprobe wireguard
lsmod | grep wireguard

Generate a key pair:

Generate WireGuard keys

wg genkey | tee privatekey | wg pubkey > publickey
chmod 600 privatekey

Set up the WireGuard interface on the server:

Configure the WireGuard interface

ip link add dev wg0 type wireguard
wg set wg0 listen-port 51820 \
    private-key /root/privatekey \
    peer <PUBLIC_KEY_CLIENT> \
    allowed-ips 10.10.0.2/32
ip addr add 10.10.0.1/24 dev wg0
ip link set wg0 up

wg set wg0 listen-port 51820 configures the WireGuard port and peers. For persistence, write the configuration in /etc/wireguard/wg0.conf and use wg-quick:

wg-quick configuration

vi /etc/wireguard/wg0.conf
wg-quick up wg0
rc-service wg-quick start

Open the port in the nft firewall:

Open the WireGuard port

nft add rule inet filter input udp dport 51820 accept

#OpenVPN

#The Classic VPN Server

OpenVPN is a mature TLS-based VPN:

Install and enable OpenVPN

apk add openvpn
rc-service openvpn start
rc-update add openvpn default

The basic server configuration lives in /etc/openvpn/server.conf:

OpenVPN configuration

port 1194
proto udp
dev tun
server 10.8.0.0 255.255.255.0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
auth SHA256

Run the server with the configuration file:

Run OpenVPN

openvpn --config /etc/openvpn/server.conf --daemon

For production, prepare the CA and certificates with easy-rsa, available in the repositories.

#IPsec with strongSwan

#An IPsec-Based VPN

strongSwan implements the IPsec/IKEv2 protocol:

Install strongSwan

apk add strongswan
rc-service ipsec start
rc-update add ipsec default
ipsec version

The connection configuration lives in /etc/ipsec.conf:

ipsec.conf configuration

conn server
    left=%defaultroute
    leftcert=serverCert.pem
    right=%any
    rightauth=eap-mschapv2
    auto=add

Load and establish the connection:

Load the IPsec configuration

ipsec reload
ipsec statusall | head -20

ipsec statusall shows the status of all active IPsec SAs.

#SSH Tunneling and Mesh

#Port Forwarding and Tailscale

SSH tunneling provides a secure connection without VPN infrastructure:

SSH port forwarding tunnel

ssh -L 5432:localhost:5432 arman@db.internal
ssh -N -D 1080 arman@gateway.internal

ssh -L 5432:localhost:5432 forwards a local port to a remote database through SSH.

For a simple mesh between machines, Tailscale provides an automatic WireGuard mesh:

Install Tailscale on Alpine

apk add tailscale
rc-service tailscaled start
tailscale up
tailscale status

tailscale up connects the machine to your account's mesh network, and tailscale status shows the connected peers.

#netns for Isolation (Optional)

Network namespaces isolate the network stack between processes:

Create a network namespace

ip netns add test
ip netns exec test ip addr show
ip netns del test

ip netns exec test ip addr show runs a command inside an isolated namespace — the basic concept containers use.

Tip

For simple, fast site-to-site connections, WireGuard is almost always the best choice: it runs in the kernel, has a short configuration, and low overhead. OpenVPN and IPsec excel at enterprise needs with certificate integration.

#Closing

Episode 18 built VPNs and tunneling on Alpine: native WireGuard with the kernel module, TLS-based OpenVPN, IPsec with strongSwan, SSH tunneling, a Tailscale-style WireGuard mesh, and an introduction to netns.

Key takeaways:

WireGuard runs as a kernel module with minimal overhead.
wg-quick up loads configuration from /etc/wireguard.
OpenVPN and strongSwan handle enterprise needs.
SSH -L forwards ports without VPN infrastructure.
Tailscale builds a WireGuard mesh automatically.
Open VPN ports in the nft firewall for incoming connections.

In the next episode, episode 19, we'll cover performance and resource optimization — leveraging the small footprint of musl and BusyBox, kernel tuning with sysctl, memory management, and monitoring with top, htop, free, and df.