https://tsvinc.dev/tags/vpn/ Recent content in Vpn on tsvinc Hugo en-us Tue, 07 Jul 2026 00:00:00 +0000 https://tsvinc.dev/posts/allowedips-is-not-access-control/ Tue, 07 Jul 2026 00:00:00 +0000 https://tsvinc.dev/posts/allowedips-is-not-access-control/ <div class="tldr"> <span class="tldr-label">TL;DR</span> In a WireGuard <em>client</em> config, <code>AllowedIPs</code> is a routing statement, not a permission. It tells the client which destinations to send into the tunnel — a route table on a machine your friend owns and can edit at will. Scoping a peer with it restricts nothing. Enforcement has to live where the friend has no vote: a forward-chain rule on the router. Writing the provisioning kit is the easy afternoon; deciding where enforcement lives is the part that matters. </div> <p>The onboarding kit started as a convenience. Give a friend VPN access with one command: <code>provision.sh alice lan</code>, out comes a <code>.conf</code> and a QR code, done. Then <code>provision.sh bob transmission</code> — Bob only needs the media box, so scope him to that one host. The kit allocates the next tunnel address, generates a keypair, adds the peer, writes the scope, emits the config. Clean. <code>list.sh</code> shows who's on, <code>remove.sh</code> revokes by name. As a piece of tooling it's satisfying.</p> https://tsvinc.dev/posts/wireguard-qr-ios-camera-footgun/ Tue, 07 Jul 2026 00:00:00 +0000 https://tsvinc.dev/posts/wireguard-qr-ios-camera-footgun/ <p>Every WireGuard walkthrough ends the same way: &quot;generate the config, render it as a QR code, scan it with your phone.&quot; None of them tell you <em>which app</em> does the scanning, because the author scanned it inside the WireGuard app and it never occurred to them you might not. I pointed an iPhone's Camera app at a freshly generated tunnel QR, and iOS did something helpful and catastrophic: it read the code as plain text and offered me a Google search — of the entire config, private key included.</p>