# WireGuard Backup Pipe for Home Router

Deployed Jul 9, 2026. The home router backup now uses WireGuard instead of L2TP/IPsec.

## Why WireGuard over L2TP/IPsec

- WireGuard is always-on — no tunnel setup/teardown delay (handshake happens in seconds)
- L2TP/IPsec was failing to bring up `ppp0` interface despite IPsec phase succeeding
- WireGuard was already configured on both sides — the backup script just wasn't using it
- Lower latency: 37ms vs longer for multi-protocol negotiation

## How the backup script chooses

The modified `wisp-backup.py` now:

1. Pings the router at `10.77.0.2` (WireGuard tunnel IP) with a 2-second timeout
2. If reachable — skips VPN entirely, uses WireGuard directly
3. If unreachable — falls back to L2TP/IPsec VPN
4. Tracks `vpn_was_connected` flag to avoid unnecessary VPN teardown

## WireGuard peer status

- Local interface: `wg0` on Core (152.53.192.33)
- Peer: home router at `76.195.7.60:13231`
- Allowed IPs: `10.77.0.2/32, 10.10.10.0/24`
- Key commands:
  - `wg show` — see peer status + latest handshake time
  - `ping 10.77.0.2` — test connectivity
  - `ssh -i /root/.ssh/wisp_rsa shonuff@10.77.0.2` — SSH to router

## Pitfalls

- The old `run_vpn_script("down", script_dir)` calls ran unconditionally even when WireGuard was active. All exit paths (error, dry-run, normal) need a `vpn_was_connected` guard.
- WireGuard handshake freshness: if > 5 min since last handshake, the tunnel may be down and the backup will fall back to L2TP.
- The router uses port 13231 for WireGuard, not the default 51820.