Overview#
A forward operating base goes quiet on the VPN mesh at 02:30. Is it a hardware failure, a WAN outage, or something worse? Without centralised visibility into WireGuard peer status, a network operations team cannot tell the difference without logging into each gateway host individually. By the time they have confirmed the cause, an hour may have passed.
WireGuard is a modern, high-performance VPN protocol built directly into the Linux kernel (mainlined in 5.6). Its design philosophy is radical simplicity: a roughly 4,000-line codebase versus OpenVPN's 100,000+, a single cryptographic suite (Noise protocol framework, Curve25519, ChaCha20-Poly1305, BLAKE2s), and configuration expressed entirely as peer key pairs and allowed-IP routing tables. Argus integrates WireGuard to synchronise peer configuration and connection status into the operational picture, giving security operators visibility over which VPN endpoints are active, when they last connected, and what traffic tunnels are active across distributed deployments.
Key Features#
Peer Inventory Synchronisation#
Sync WireGuard peer records via syncWireguardPeer. Each persisted peer record captures the public key (WireGuard's identity primitive), endpoint address, configured allowed-IP prefixes, latest handshake timestamp, cumulative transfer bytes (sent/received), interface name, and status under organisation and clearance-level scoping.
Handshake Staleness Alerting#
WireGuard peers that have not completed a handshake within the configured staleness window are flagged. The latest handshake timestamp surfaces directly in peer records, so operators can immediately identify remote sites that have dropped off the VPN mesh (equipment failure, WAN outage, or potential security incident) without needing to access gateway hosts directly.
Per-Peer Traffic Metrics#
Cumulative transfer byte counts per peer are captured on each sync cycle. Delta calculations between sync cycles give per-peer throughput estimates, supporting anomaly detection. A peer that historically transfers 50 MB per day suddenly transferring 50 GB is a detectable signal worth investigation.
Peer Configuration Export#
Argus stores WireGuard peer metadata centrally for backup and auditing workflows. The current public GraphQL surface does not expose a dedicated wg-format configuration export mutation.
Interface and Endpoint Metadata#
Each peer record includes its interface name together with endpoint and key metadata. Multiple WireGuard interfaces across multiple gateway hosts can be tracked simultaneously, covering hub-and-spoke and full-mesh topologies.
Use Cases#
- Remote Site Connectivity Monitoring: A deployed tactical network uses WireGuard to connect a dozen forward operating bases back to a central operations centre. Argus WireGuard sync gives the NOC team a live view of which FOB VPN tunnels are up, when each last connected, and which have gone silent.
- Zero-Trust Micro-Segmentation Audit: In a zero-trust architecture, every service-to-service connection runs over a WireGuard tunnel. Argus peer sync provides an audit log showing which service peers were active over each shift, supporting post-incident reconstruction.
- Key Rotation Verification: After a WireGuard key rotation event (scheduled or in response to a suspected compromise), Argus peer sync confirms that all peers have updated public keys matching the rotation manifest. Any peer still presenting a pre-rotation key is immediately visible.
- Hybrid Cloud Gateway Monitoring: WireGuard gateways bridging on-premises security infrastructure to cloud-hosted Argus components are monitored via peer sync. Argus can alert if its own connectivity to a key sensor gateway drops.
Integration#
Available via GraphQL: wireguardPeers, wireguardStats (queries); syncWireguardPeer (mutation). All operations require authentication and organisation scoping.
Works alongside the Identity modules (SCIM, Keycloak, SAML) for user-to-peer mapping, and Network Monitoring for overlay correlation between VPN peer status and underlying network path health.
Open Standards#
- WireGuard Protocol (RFC 9045 / Linux kernel 5.6): The core VPN tunnelling protocol implemented by this capability; Argus synchronises peer public keys, endpoint addresses, handshake timestamps, and transfer counters directly from WireGuard interfaces and management APIs.
- Noise Protocol Framework (revision 34): WireGuard's cryptographic handshake layer is built entirely on the Noise Protocol Framework; Argus surfaces the output of that handshake (last-handshake timestamp, peer active/inactive status) as the primary connectivity signal.
- X25519 Elliptic-Curve Diffie-Hellman (RFC 7748): WireGuard uses Curve25519 key pairs as the sole peer identity primitive; Argus stores and tracks each peer's 32-byte base64-encoded Curve25519 public key as the canonical peer identifier in the inventory store.
- ChaCha20-Poly1305 Authenticated Encryption (RFC 8439): All WireGuard tunnel traffic is encrypted and authenticated with ChaCha20-Poly1305; Argus reports per-peer transfer byte counters (transferRx, transferTx) that reflect traffic protected under this scheme.
- BLAKE2s Hash Function (RFC 7693): WireGuard uses BLAKE2s for key derivation and message-authentication chaining; Argus peer sync indirectly relies on this as part of validating the WireGuard handshake state it consumes.
- Classless Inter-Domain Routing (RFC 4632 / RFC 4291): Peer allowed-IP prefixes are stored and exposed as CIDR notation for both IPv4 and IPv6; these are used to describe which traffic each VPN tunnel carries and to support micro-segmentation audit queries.
- OAuth 2.0 Bearer Token (RFC 6750): The integration client authenticates to WireGuard management APIs using Bearer token authorisation headers, and the GraphQL surface enforces token-based authentication for all wireguardPeers, wireguardStats, and syncWireguardPeer operations.
- GraphQL (GraphQL Foundation open specification): All peer inventory queries and peer synchronisation mutations are exposed through a strongly-typed GraphQL API, providing a consistent query interface for NOC dashboards and automation tooling.
Last Reviewed: 2026-03-18 Last Updated: 2026-04-14