# edgesecurityaccess-wireguard-vpn

This skill walks the agent through standing up a WireGuard VPN: build the Go server, add users, and hand out configs over an HTTP API.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 788 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/edgesecurityaccess-wireguard-vpn/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/edgesecurityaccess-wireguard-vpn

## What it does

EdgeSecurityAccess (ESA) is a toolkit for spinning up VPNs on top of WireGuard. It ships three pieces: a Go server, a C/C++ utility package, and a C# Windows desktop client. The server returns WireGuard configs over HTTP, with username and password authentication.

The skill covers the whole chain: installing WireGuard and Go 1.26+, building `esa-server`, compiling `ESAusr`, `ESAProc` and `ESAInit`, and writing `/etc/esa/esa.conf` with the server address, ports and keys. From there it adds users to `users.txt`, generates `usrwg.conf`, brings up the `wg0` interface, and turns on forwarding with NAT rules in `iptables`.

You need a Linux server with root access. Skip the `sysctl` change or the `iptables` rules and traffic between clients simply will not flow. WireGuard keys come from `wg genkey` and `wg pubkey` beforehand, and the external endpoint plus port 50000 have to be in the config before the first start.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/edgesecurityaccess-wireguard-vpn/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/edgesecurityaccess-wireguard-vpn/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/edgesecurityaccess-wireguard-vpn/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/edgesecurityaccess-wireguard-vpn/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills edgesecurityaccess-wireguard-vpn
```

2. **Manually: put the files in place**
- File: `.github/skills/edgesecurityaccess-wireguard-vpn/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/edgesecurityaccess-wireguard-vpn
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/edgesecurityaccess-wireguard-vpn/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill edgesecurityaccess-wireguard-vpn -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/edgesecurityaccess-wireguard-vpn/SKILL.md

## When to use it
- stand up a WireGuard VPN server from scratch
- add users and issue each one a config
- serve client configs through an HTTP API
- bring up the wg0 interface and enable NAT
- build the server and utilities from source

## Example prompts
- Deploy the EdgeSecurityAccess VPN server on this Linux host and run it as a systemd service
- Add user alice with ESAusr and generate her WireGuard config
- Debug why the client cannot reach the ESA VPN and check wg0 status

## Similar
- [network-engineer](https://affpapa.org/en/nevibecode/agents/network-engineer.md) — subagent · 1871 installs
- [huawei-cloud-network-query](https://affpapa.org/en/nevibecode/skills/huawei-cloud-network-query.md) — skill · 17000 installs
- [sitetositevpn](https://affpapa.org/en/nevibecode/skills/sitetositevpn.md) — skill · 4600 installs
- [transitgateway](https://affpapa.org/en/nevibecode/skills/transitgateway.md) — skill · 4100 installs
- [cloudflare-one-migrations](https://affpapa.org/en/nevibecode/skills/cloudflare-one-migrations.md) — skill · 89500 installs
- [hybrid-cloud-networking](https://affpapa.org/en/nevibecode/skills/hybrid-cloud-networking.md) — skill · 10600 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 17 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md