Skip to main content

WireGuard (legacy)

The original access path to ISC³, kept for configs already in circulation and as the permanent emergency/admin access (a handful of static peers for the team, managed with provisioning/wireguard/wg-gen.sh). New users go through NetBird instead.

How it works​

The staff provides you with a personal WireGuard configuration file named wgXXX.conf. Importing it into the WireGuard client of your choice (all platforms below) creates a tunnel from your machine to the datacenter router; while the tunnel is up you are inside the ISC³ network and can reach the machines directly.

A few things worth knowing about this tunnel:

  • It connects to calypso.hevs.ch on UDP port 51820 — this works from home, from eduroam, or from any network that doesn't block outbound UDP (rare).
  • It is a split tunnel (configs issued from August 2026): only traffic to the datacenter networks goes through it — your Internet traffic keeps using your normal connection. Name lookups do transit the tunnel while it's up (DNS = 192.168.88.1, calypso in your config), so the machine names resolve and one more reason to disconnect when you're done.
  • Your config is personal and tied to one key: keep the file private, and if you lose it ask the staff for a new one rather than sharing someone else's.
One config = one machine at a time

Don't use the same wgXXX.conf on two devices simultaneously — they share one key and one VPN address, so each connection silently kicks the other. If you need the VPN on several devices, ask the staff for one config per device (or use NetBird, which does this natively).

Installing WireGuard​

Windows​

  1. Download and run the official installer: wireguard-installer.exe.
  2. Open the WireGuard app → Import tunnel(s) from file → select your wgXXX.conf.
  3. Click Activate to connect, Deactivate to disconnect.

macOS​

  1. Install WireGuard from the Mac App Store.
  2. Open the app → Import tunnel(s) from file (⌘O) → select your wgXXX.conf.
  3. Activate / Deactivate from the app or from the menu-bar icon.

Command-line alternative: brew install wireguard-tools, then proceed as on Linux.

Linux​

  1. Install the tools from your distribution (all platforms):

    sudo apt install wireguard        # Debian / Ubuntu
    sudo dnf install wireguard-tools  # Fedora
    sudo pacman -S wireguard-tools    # Arch

  2. Put your config in place, then bring the tunnel up or down with wg-quick:

    sudo cp wgXXX.conf /etc/wireguard/

    sudo wg-quick up wgXXX     # connect
    sudo wg-quick down wgXXX   # disconnect

If you prefer a GUI, NetworkManager imports the file directly: nmcli connection import type wireguard file wgXXX.conf.

iOS / Android​

Install the app — iOS / Android — then Create from file or archive and import your wgXXX.conf.

Checking that it works​

With the tunnel active, the datacenter router must answer pings (~10 ms from the school network):

ping 192.168.88.1

If it does, you're in — connect to your target machine over SSH, by name or by address:

ssh firstname.lastname@calypso0

Troubleshooting​

  • ping 192.168.88.1 gets no answer — the same config is probably active on another of your devices (see the caution above), or your local network blocks outbound UDP 51820. Try a phone hotspot to tell the two apart.
  • Lost your config / need another device — contact the staff; configs are cheap to issue and personal by design.