Production VPN

Operating a VPN at scale:

Server placement:

• Geographic: multiple regions for low latency.
• Bandwidth: 10Gbps NIC + AES-NI hardware.
• BGP: announce VPN endpoints for failover.

Multi-tenancy:

• Per-customer ACLs.
• Bandwidth limits.
• Connection limits.
• Logging (or not — privacy).

Authentication:

• WireGuard keys + key rotation.
• Add OAuth/SAML layer (Tailscale/Headscale do this).
• Hardware tokens (YubiKey).
• Time-limited keys for ephemeral access.

Key management:

• HSM for high-security CAs (some VPN systems use cert-based).
• Rotation cadence: monthly is common.
• Revocation: WireGuard removes peer from config; reload.

Logging:

• Connect/disconnect events.
• Per-peer bytes transferred.
• Endpoint changes (roaming).
• Privacy-sensitive: many providers explicitly don't log content/IPs.

Monitoring:

• Active sessions count.
• Per-peer last-handshake timestamp.
• Throughput per peer.
• Failed handshakes (potential attack indicator).

HA:

• Multiple servers behind round-robin DNS.
• Active-standby with VRRP for IP failover.
• WireGuard has no built-in HA — handled by the cluster layer.

Security:

• DDoS mitigation: cookie reply throttles.
• Rate limit handshakes per source IP.
• Stable hash = static key. Rotate static keys periodically.

Common deployments:

• Site-to-site VPN: connect office networks.
• Road warrior: laptops connect to corporate.
• Cloud VPN: connect on-prem to AWS VPC (AWS Site-to-Site VPN).
• Mesh VPN: every node connects to every other (Tailscale, Nebula, Netmaker).

Modern alternatives:

• Tailscale: WireGuard + coordination + ACLs. Easy to use.
• Headscale: open-source Tailscale-compatible coordination.
• Nebula (Slack): mesh VPN. Like Tailscale, different design.
• ZeroTier: layer-2 mesh VPN.

Don't:

• Run PPTP (broken).
• Use shared private keys.
• Ignore key rotation.

Do:

• Use WireGuard for new deployments.
• Layer authentication (SSO + WireGuard).
• Monitor + log abuse.