hermes-skills/skills/devops/infrastructure-automation/references/wireguard-backup-pipe.md

WireGuard Backup Pipe for Home Router

Deployed Jul 9, 2026. The home router backup now uses WireGuard instead of L2TP/IPsec.

Why WireGuard over L2TP/IPsec

• WireGuard is always-on — no tunnel setup/teardown delay (handshake happens in seconds)
• L2TP/IPsec was failing to bring up ppp0 interface despite IPsec phase succeeding
• WireGuard was already configured on both sides — the backup script just wasn't using it
• Lower latency: 37ms vs longer for multi-protocol negotiation

How the backup script chooses

The modified wisp-backup.py now:

1. Pings the router at 10.77.0.2 (WireGuard tunnel IP) with a 2-second timeout
2. If reachable — skips VPN entirely, uses WireGuard directly
3. If unreachable — falls back to L2TP/IPsec VPN
4. Tracks vpn_was_connected flag to avoid unnecessary VPN teardown

WireGuard peer status

• Local interface: wg0 on Core (152.53.192.33)
• Peer: home router at 76.195.7.60:13231
• Allowed IPs: 10.77.0.2/32, 10.10.10.0/24
• Key commands:
  • wg show — see peer status + latest handshake time
  • ping 10.77.0.2 — test connectivity
  • ssh -i /root/.ssh/wisp_rsa shonuff@10.77.0.2 — SSH to router

Pitfalls

• The old run_vpn_script("down", script_dir) calls ran unconditionally even when WireGuard was active. All exit paths (error, dry-run, normal) need a vpn_was_connected guard.
• WireGuard handshake freshness: if > 5 min since last handshake, the tunnel may be down and the backup will fall back to L2TP.
• The router uses port 13231 for WireGuard, not the default 51820.