Originally published at https://blog.pathvector.dev/protocol-lab-wg-16/ — part of the free Protocol Lab series.
This post is part of Protocol Lab, a free, hands-on series for learning networking protocols by building and breaking them in a container lab. All the lab material — topologies, configs, and scripts — lives in the repo: github.com/pathvector-studio/protocol-lab.
The encryption labs so far wrapped one thing at a time: TLS wraps a TCP stream (Lab 09), DoT/DoH wrap DNS (Lab 14). A VPN tunnel wraps everything — any IP packet — and sends it across an untrusted network. This lab builds a WireGuard tunnel between two nodes and shows the two views of the same ping:
On the underlay (the real link, eth1) you see only encrypted UDP to port 51820. The inner packet is hidden.
Inside the tunnel interface (wg0) you see the cleartext ICMP — because that is where WireGuard hands you the decrypted packet.
