Building a Great VPN Server with WireGuard - 1

Devsisters decided to transition from the existing OpenVPN to a WireGuard-based VPN system to overcome its limitations. The existing approach had issues such as difficulty integrating SSO(Single Sign-On), inability to identify users due to NAT application, license management costs, and relatively slow performance.

WireGuard offers fast speed and low latency based on UDP, and provides excellent security by using advanced encryption techniques such as the Noise protocol framework. In addition, thanks to simple public key-based peer deployment and its Stateless nature, it can maintain a stable connection even when network conditions change, and being built into the Linux kernel, it offers superior performance and stability.

The new VPN server is being built using the Go language, with the goal of meeting the following key requirements:

• Access control to private networks by group
• Assignment of unique IPs per user
• Keycloak SSO authentication integration
• Key expiration management and providing an admin UI

During implementation, various libraries such as wgctrl-go, netlink, and cilium/ebpf are used to communicate with the kernel networking stack, implementing access control functionality by group tailored to the AWS VPC environment.