edgesecurityaccess-wireguard-vpn — Claude Code skill: WireGuard VPN
This skill walks the agent through standing up a WireGuard VPN: build the Go server, add users, and hand out configs over an HTTP API.
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a claude-codeWhat edgesecurityaccess-wireguard-vpn does
EdgeSecurityAccess (ESA) is a toolkit for spinning up VPNs on top of WireGuard. It ships three pieces: a Go server, a C/C++ utility package, and a C# Windows desktop client. The server returns WireGuard configs over HTTP, with username and password authentication.
The skill covers the whole chain: installing WireGuard and Go 1.26+, building esa-server, compiling ESAusr, ESAProc and ESAInit, and writing /etc/esa/esa.conf with the server address, ports and keys. From there it adds users to users.txt, generates usrwg.conf, brings up the wg0 interface, and turns on forwarding with NAT rules in iptables.
You need a Linux server with root access. Skip the sysctl change or the iptables rules and traffic between clients simply will not flow. WireGuard keys come from wg genkey and wg pubkey beforehand, and the external endpoint plus port 50000 have to be in the config before the first start.
What it helps with
- stand up a WireGuard VPN server from scratch
- add users and issue each one a config
- serve client configs through an HTTP API
- bring up the wg0 interface and enable NAT
- build the server and utilities from source
Example prompts for the agent
- Deploy the EdgeSecurityAccess VPN server on this Linux host and run it as a systemd service
- Add user alice with ESAusr and generate her WireGuard config
- Debug why the client cannot reach the ESA VPN and check wg0 status
How to install edgesecurityaccess-wireguard-vpn
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a claude-code2Manually: put the files in place
~/.claude/skills/edgesecurityaccess-wireguard-vpn/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/edgesecurityaccess-wireguard-vpn/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a codex2Manually: put the files in place
.agents/skills/edgesecurityaccess-wireguard-vpn/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a cursor2Manually: put the files in place
.cursor/skills/edgesecurityaccess-wireguard-vpn/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills edgesecurityaccess-wireguard-vpn2Manually: put the files in place
.github/skills/edgesecurityaccess-wireguard-vpn/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/edgesecurityaccess-wireguard-vpnManually: put the files in place
.devin/skills/edgesecurityaccess-wireguard-vpn/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about edgesecurityaccess-wireguard-vpn
How do I install edgesecurityaccess-wireguard-vpn in Claude?
Run npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a claude-code. The skill lands in ~/.claude/skills/edgesecurityaccess-wireguard-vpn/SKILL.md.
What does this skill do?
It guides the agent through a WireGuard VPN deployment: building the Go server, compiling the utilities, configuring the server, adding users and starting the interface.
What do I need before starting the server?
WireGuard, Go 1.26+ to build the server, and generated keys from wg genkey and wg pubkey. The external endpoint and port go into /etc/esa/esa.conf.