VPNs in Production
WireGuard, OpenVPN, and Site-to-Site Networks.
Planned
WireGuard and OpenVPN solve the same problem with different designs: one is a small kernel dataplane with static keys, the other a userspace daemon built on TLS. This book will treat both as production systems and work through how each tunnel handles packets, how site-to-site topologies are routed and firewalled, and how keys, MTU, and monitoring decide whether the link stays up.
Status: planned title. Writing has not started. The repository and the cover exist; the scope below is the plan.
The first edition will ship DRM-free as PDF and EPUB, with free updates.
Two tunnel stacks, run as systems.
No chapters are written yet. This is the plan: the areas the book will cover, in the order a reader would meet them. It targets current WireGuard and OpenVPN releases on Linux servers.
- WireGuard The cryptokey routing model, kernel and userspace implementations, and peer configuration for point-to-point and hub topologies.
- OpenVPN TLS-based tunnels, server and client configuration, certificate infrastructure, and where its flexibility justifies the extra moving parts.
- Site-to-site networks Connecting offices, datacenters, and cloud VPCs: routing, NAT traversal, overlapping subnets, and firewall placement.
- Keys and identity Generating, distributing, rotating, and revoking keys and certificates without breaking live tunnels.
- Performance and MTU Throughput, the CPU cost of encryption, MSS clamping, and the fragmentation problems that surface as mystery stalls.
- Operations Monitoring tunnel health, failover, upgrades, and debugging a link that is up while traffic does not flow.
For engineers who connect networks.
This book is for people who build or run VPN links between real networks. It assumes comfort with the command line and basic IP routing, and it explains how the tunnels work rather than listing recipes.
- Platform and network engineers linking offices, datacenters, and cloud VPCs who need the tunnel to survive routing changes on either side.
- Operators already running WireGuard or OpenVPN who want a clear model of what the tunnel does to packets rather than a config they dare not touch.
- Security and infrastructure teams that need key rotation and certificate revocation to work without dropping live connections.
Planned.
Join the shared Sysinit Press book list. You'll get one message when writing on this book starts, plus release news when it ships. The first edition will include DRM-free PDF and EPUB files with free updates.
The signup uses double opt-in. Every message includes an unsubscribe link.