Module wireguard 

WireGuard VPN server implementation with LLM control

This is a FULL WireGuard VPN server that creates real tunnels for clients. It uses defguard_wireguard_rs for cross-platform WireGuard support (kernel WireGuard on Linux/FreeBSD/Windows, userspace wireguard-go on macOS). All cryptography and the tunnel data plane are handled by WireGuard itself, so this is the one VPN protocol in NetGet that is genuinely functional.

What the LLM actually controls

WireGuard performs its handshake in the kernel/userspace backend, so NetGet cannot gate the handshake crypto itself. Control has two levers:

Up front (user-triggered): wireguard_add_peer pre-authorizes a peer’s public key + allowed IPs on the live interface before it connects. A WireGuard responder drops a handshake whose static key is not already configured, so this is what makes a new peer’s handshake succeed and the authorize decision reachable at all. Dispatched via crate::llm::actions::protocol_trait::Server::execute_action_with_state against the WireguardServer handle registered in spawn.

Post-handshake (event-driven): a peer monitoring loop polls the interface every 5 seconds and, when a new peer appears, raises a wireguard_peer_connected event. That event is routed through crate::llm::action_helper::call_llm, which first tries any configured script/static event handler and only falls back to a real LLM call when none is configured. The resulting actions are applied to the live interface:

• authorize_peer -> peer is (re)configured with the given allowed_ips
• disconnect_peer / reject_peer -> peer is removed from the interface

Fail-closed throughout: with no wireguard_add_peer call, an unknown peer’s handshake is dropped by the backend and it never appears.

Limitations

• Peers are observed after their handshake succeeds; the LLM cannot block a handshake before it completes (but it can refuse to pre-add the key, which does prevent the handshake from ever succeeding).
• set_peer_traffic_limit is recorded but NOT enforced (no tc/iptables setup).
• Requires root / CAP_NET_ADMIN to create the interface.

Modules

actions

WireGuard protocol actions implementation

Structs

WireguardServer

WireGuard server state

Functions

build_peer_config

Build a validated WGPeer from action inputs.