Documentation is available in English.

VPN

VPN overview

The VPN overview lists gateways and site-to-site connections for the account. Use it to check tunnel status, identify the gateway attached to a connection and start a new connection flow.

VPN gateway detail

The gateway detail screen shows the Wonder endpoint, attached network and all connections that use the gateway. Share its public endpoint with the remote network administrator when configuring the peer.

VPN connection detail

The connection detail screen contains the local and remote CIDRs, peer address, negotiation profile and current tunnel status. Use these values to compare both sides when a tunnel does not connect.

Create VPN connection

Select a gateway and provide the remote peer IP and CIDR. Choose a compatible IKE profile and store the pre-shared key in Wonder Config when possible. Local and remote ranges must not overlap.

VPN connects a remote network (office, datacenter or partner) to your Wonder Cloud network over a site-to-site IPsec tunnel.

There are two resources:

| Resource | Role | |---|---| | VPN gateway | Managed endpoint in your account — public LB (UDP 500/4500) + private Multus IP on your VPC | | VPN connection | One IPsec peer (peer IP, remote CIDR, IKE, PSK) |

Create the gateway first, then one or more connections.

How it works

  1. Wonder places a StrongSwan pod dual-homed: eth0 (GKE / LB) and net1 (your VPC via Multus).
  2. The gateway private IP is allocated inside a subnet CIDR of your default VPC (stable Multus ips annotation).
  3. Each connection re-renders the peer into the gateway and:
    • installs SNAT (MASQUERADE) so traffic from the peer CIDR toward the VPC appears from the gateway IP;
    • upserts an OVN static route remote_cidr → gateway private IP (policyDst) for return / VPC-initiated flows.
  4. Workloads (servers, databases) stay private; reach them through the tunnel and their firewalls.

Full operator lab (CLI + strongSwan peer checklist): see repository doc cloud_backend/docs/vpn-e2e.md.

What you get

  • Gateway public endpoint (share with the peer admin)
  • Gateway private IP on your VPC (inside a subnet — verify after create)
  • Connection status (provisioning → configuring → connected)
  • Connection detail: Phase 1 / Phase 2, SA status, gateway logs, ping/TCP tests when connected

Create in the console

1. Gateway

  1. Open Cloud → VPN.
  2. If no gateway exists, click Create gateway.
  3. Wait until the gateway is ready and a public endpoint appears. Copy that IP for the peer.
  4. Note the private IP — peers ping this address over the tunnel (not an outdated diagram IP).

2. Connection

  1. On VPN, click Add connection.
  2. Fill in:

| Field | Description | |---|---| | Name | Display name | | Peer IP | Remote gateway public address (what Wonder will see; for a NAT’d peer use the public egress IP) | | Remote CIDR | Address range on the peer side (must not overlap your VPC) | | Local CIDR | Optional Phase 2 traffic selector on your side | | IKE version | Typically IKEv2 | | IKE profile | Preset A (AES256-SHA256-DH14), Preset B, or custom Phase 1 / Phase 2 | | PSK | Type inline, or pick a Wonder Config secret |

  1. Submit. Open the connection detail page for SA status, logs and connectivity tests.

If you entered a PSK inline, the console may show it once at create — save it; the peer must use the same value.

3. Reach a database

  1. Ensure the database firewall allows TCP 5432 (attach a named firewall on the database Firewall tab).
  2. From the peer, route/send traffic with source inside remote CIDR.
  3. Connect to the database private IP (database detail → General).

Create with CLI

wcc vpn gateway create
wcc vpn gateway list
wcc vpn gateway get --id <gateway-uuid>

wcc vpn connection create \
  --name office \
  --peer-ip 203.0.113.10 \
  --remote-cidr 192.168.50.0/24 \
  --psk 'replace-with-strong-secret' \
  --ike-version ikev2
# optional: --gateway-id <uuid>

wcc vpn connection list
wcc vpn connection get --name office

wcc vpn connection delete --name office
wcc vpn gateway delete --id <gateway-uuid>

Peer checklist

Configure the remote firewall / VPN appliance before or right after creating the Wonder connection:

  • Allow UDP 500 and UDP 4500 toward the Wonder gateway public endpoint (peer as initiator is enough if NAT-T is used)
  • Same PSK on both sides
  • Peer IDi should be its public IP when Wonder is configured for NAT-friendly PSK (id = %any on the gateway)
  • Matching IKE proposals (default lab: aes256-sha256-modp2048)
  • Matching traffic selectors: peer local_ts = remote CIDR; peer remote_ts = Wonder VPC CIDR
  • No overlapping CIDRs between the office network and the Wonder VPC
  • On Linux lab peers: use a dummy interface address inside remote_cidr (see cloud_workers/scripts/vpn/peer-lab.sh)

After create

  1. Open the connection detail (General tab): confirm peer, CIDRs, phases and gateway public IP.
  2. Watch status until connected; use Refresh on tunnel / logs if needed.
  3. When connected, run a ping or TCP test from the detail page (or from the peer toward a private VPC IP).
  4. Monitoring is listed as coming soon in the console.

Tips

  • Store the PSK in Wonder Config and select it at create time when you can.
  • Prefer VPN + private database/server IPs over public exposure.
  • Delete connections before deleting the gateway; remove dependents before deleting the VPC.
  • After pulling worker changes, restart cloud_workers so claim/apply code is reloaded.

Next