$ ./suraj --boot

[ ok ] loading core modules

[ ok ] mounting filesystem

[ ok ] initializing runtime

[ ok ] resolving routes

[ ok ] starting interface

$ ready

~/ / blogs / tag / vpn

~/tag/vpn

// 1 post

↩ all writing

2025.06.30
A private API over WireGuard: why the network boundary is the security control, not the firewall rule

Run an API on one VPS, reach it from another only through an encrypted tunnel, and never open its port to anyone. A short, practical WireGuard setup — with the two firewall layers that trip everyone up, the pitfalls that actually bite, and a debugging method that converges.
- wireguard
- networking
- security
- vpn
- systems-design