Accessing the lab over WireGuard

How it works

Ludus creates a WireGuard server on the Proxmox host itself. You connect to it from your PC and only the traffic to the lab (10.2.0.0/16) goes through the tunnel; your Internet traffic still goes through your normal network.

Generating the configuration

On the Proxmox host:

ludus --user <range-user> users wireguard > /root/goad-wireguard.conf

Review the content. The important parts:

[Interface]
PrivateKey = <private-key>
Address = 198.51.100.3/32

[Peer]
PublicKey = <server-public-key>
Endpoint = <YOUR-PROXMOX-IP>:51820
AllowedIPs = 198.51.100.1/32,10.2.0.0/16
PersistentKeepalive = 25

The file contains a private key. Do not upload it anywhere and restrict who can read it.

On Windows: copy it to your PC and install the client

From PowerShell:

scp root@<YOUR-PROXMOX-IP>:/root/goad-wireguard.conf .\goad-light-wireguard.conf
winget install --id WireGuard.WireGuard -e

Open the WireGuard app, import the .conf and click Activate. If all goes well, the tunnel shows as Active and the latest handshake is recent:

Check that you can reach the lab:

ping 10.2.10.10
ping 10.2.20.2

On Windows: connecting and disconnecting from the console

The tunnel becomes a Windows service. If you import it as a service, it starts on its own at every reboot.

Stop-Service 'WireGuardTunnel$goad-light-wireguard' -Force
Start-Service 'WireGuardTunnel$goad-light-wireguard'

To stop it from connecting automatically at boot:

Set-Service 'WireGuardTunnel$goad-light-wireguard' -StartupType Manual

On Linux

If your attack machine is Linux (Kali, for example), the flow is the same with wg-quick.

Install WireGuard

sudo apt updatesudo apt install -y wireguard

Copy the configuration

Copy the .conf from Proxmox to /etc/wireguard/ with whatever interface name you like, and restrict its permissions, because it contains the private key:

$ scp root@<YOUR-PROXMOX-IP>:/root/goad-wireguard.conf .$ sudo mv goad-wireguard.conf /etc/wireguard/goad-light.conf$ sudo chmod 600 /etc/wireguard/goad-light.conf

Connect and check

sudo wg-quick up goad-lightsudo wg show$ ping -c 2 10.2.10.10

wg show should list a recent latest handshake, just like the Windows app. Since AllowedIPs only includes 198.51.100.1/32 and 10.2.0.0/16, only lab traffic goes through the tunnel and your Internet traffic is unchanged.

Disconnecting and starting at boot

sudo wg-quick down goad-light

If you want it to come up on its own at boot, enable it as a service (optional):

sudo systemctl enable --now wg-quick@goad-light

If you use WSL on Windows

You do not need to install anything in WSL: with the tunnel active on Windows, WSL traffic goes through it. In my case, nxc run from WSL reached the lab with no extra setup, and the hosts saw the Windows tunnel IP (198.51.100.3) as the source.

Isolation

The vulnerable machines are only reachable from the tunnel, not from the rest of your network. The VMs do have Internet access (GOAD downloads installers during deployment), so if you want to cut it, Ludus lets you block it per VM with testing: block_internet: true. Do not open port 51820 on your router to the outside.