MonsterOps logo MonsterOps
Docs / Network / VPN

VPN

Overview

The VPN module creates and operates WireGuard and L2TP/IPsec tunnels from the UI. The host dials out to remote sites so MonsterOps (and RADIUS) can reach NAS devices that aren't directly routable. Keys are generated and kept on the server (mode 0600) and never leave it.

Where things are

  • Tunnel list — each tunnel with live status: handshake time and rx/tx counters for active tunnels.
  • New tunnel — choose WireGuard or L2TP/IPsec and fill the peer details. WireGuard configs are written to MONSTEROPS_VPN_CONFIG_DIR as wg-quick files.
  • Controls — bring a tunnel up/down, view live handshake/transfer counters, and copy the server's public key to hand to the remote peer. Bring-up/down is a superadmin action.

Common tasks

  • Reach a remote NAS site — create a WireGuard tunnel to the site's gateway, bring it up, and confirm the handshake counter advances.
  • Hand your public key to a peer — copy it from the tunnel view; the private key stays on the server.

Problems you may hit

\"Tooling not installed\" banner

Tunnels can be defined without the packages, but bringing them up needs wireguard-tools (WireGuard) or strongswan + xl2tpd + ppp (L2TP/IPsec). The production installer adds these; on a dev host install them or leave tunnels config-only. See Requirements.

  • Tunnel comes up but no traffic — check routing/allowed-IPs on both ends and that the remote peer accepted your public key.
  • No handshake — the remote endpoint/port is unreachable (firewall or NAT in the path), or the keys don't match.
  • Only superadmin can toggle — bringing tunnels up/down is restricted by role; see Roles.