Top all-time · #3027
Pro Custodibus
Company blog · procustodibus.com/blogsecuritysystems
Pro Custodibus is the company blog at procustodibus.com, writing about security and systems. Since 2020, 24 different Hacker News readers have linked it 39 times, most often “WireGuard AllowedIPs Calculator”. It is still writing: the last post was on 2026-06-06, and you can follow it by feed.
Too few sampled comments (21) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for practical WireGuard VPN guides: network topologies, hub-and-spoke and high-availability setups, AllowedIPs routing, and a calculator for CIDR exclusions.
Summarised by Claude from a sample of 21 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Enterprise WireGuard GUI for managing users, access, and updates.
Most-linked posts?
- WireGuard AllowedIPs Calculator5 people · 5 mentions · first linked 2021-11-19
- WireGuard multi-factor authentication with pro custodibus2 people · 2 mentions · first linked 2022-07-07
- /blog/2020/11/wireguard-point-to-point-config/2 people · 2 mentions · first linked 2024-08-23
- WireGuard End-to-End Encrypted Hub-and-Spoke2 people · 2 mentions · first linked 2022-06-23
What Hacker News says?
It's not just that they're suspect or unreliable. They're complete bullshit. The actual use of VPN technology is to create virtual networks that are private (hence the name). It's a system level technology. There are several types of network topologies you can set up, when I was learning about this I found this article which is quite nice: https://www.procustodibus.com/blog/2020/10/wireguard-topolog... . You can pro…
Comment linking /blog/2020/10/wireguard-topologies
on “Reasons to ditch Chrome and use Firefox”Submitted WireGuard DNS Configuration for Systemd as a story · 65 points
HN discussionCalculator for the workaround: https://www.procustodibus.com/blog/2021/03/wireguard-allowed...
Comment linking /blog/2021/03/wireguard-allowedips-calculator/
on “WireGuard: Beyond the most basic configuration”Submitted Wayland Apps in WireGuard Docker Containers as a story · 49 points
HN discussionNot to hijack but last time I was setting up wireguard, I found this site to be super useful: https://www.procustodibus.com/blog/2020/10/wireguard-topolog...
Comment linking /blog/2020/10/wireguard-topologies/
on “WireGuard: Beyond the most basic configuration”Submitted WireGuard AllowedIPs Calculator as a story · 10 points
HN discussionTake a look a these (not tested these configurations personally): - High Availability WireGuard on AWS [ https://www.procustodibus.com/blog/2021/02/ha-wireguard-on-a... ] - High Availability WireGuard on Azure [ https://www.procustodibus.com/blog/2021/06/ha-wireguard-on-a... ] - High Availability WireGuard Site to Site [ https://www.procustodibus.com/blog/2021/10/ha-wireguard-site... ]
Comment linking /blog/2021/10/ha-wireguard-site-to-site/
on “Understanding modern Linux routing (and wg-quick)”Submitted Poor Man's BeyondCorp with WireGuard as a story · 5 points
HN discussionWireGuard over WireGuard (WireGuard end-to-end encrypted hub and spoke) example https://www.procustodibus.com/blog/2021/12/wireguard-e2ee-hu...
Comment linking /blog/2021/12/wireguard-e2ee-hub-and-spoke/
on “WireGuard topologies for self-hosting at home”Submitted Preventing Lateral Movement with WireGuard as a story · 4 points
HN discussionWireGuard is honestly very easy to set up. All of the commands feel very straightforward: https://www.procustodibus.com/blog/2020/11/wireguard-point-t... You can definitely run an HTTP server behind WireGuard. WireGuard just adds a network interface that your server can listen on (e.g. your server would listen on a private address like 10.0.0.1).
Comment linking /blog/2020/11/wireguard-point-to-point-config/
on “Show HN: Ruroco – like port knocking, but better”Submitted WireGuard Endpoints and IP Addresses as a story · 3 points
HN discussionHere's a few you might like: https://www.procustodibus.com/blog/tag/cloud/
Comment linking /blog/tag/cloud/
on “Ask HN: Where are all the cool architecture diagrams?”Submitted Using WireGuard Keys for SSH as a story · 3 points
HN discussionYes, it is wrong. You just misunderstand how routing works. Say you’re at work, and the office router (192.168.1.1) gives you access to 10.3.0.0/16. This is where your company’s cloud is or whatever. You want all your traffic to go through your home network for whatever convoluted reason, except for the 10.3 stuff. You just add PreUp = ip route add 10.3.0.0/16 via 192.168.1.1 dev eth0 And AllowedIPs = 0.0.0.0/0 (Edi…
Comment linking /blog/2021/03/wireguard-allowedips-calculator/
on “WireGuard client for macOS doesn't support split tunneling so I made one”Submitted WireGuard multi-factor authentication with pro custodibus as a story · 3 points
HN discussionEdit: Sorry for what an opinionated mini rant this comment has become while typing it ;; > The so called ‘rootless’ Podman seems to be advertised as being on the same level of isolation as Jails – but only if You run that Podman with properly configured and enabled SELinux/AppArmor solutions. That ignores user namespacing, the subsequent namespacing for mounts, networks, etc. So I'm confused as to where the it-only-…
Comment linking /blog/2022/10/wireguard-in-podman/
on “FreeBSD Jails Security (Versus Podman)”Submitted WireGuard End-to-End Encrypted Hub-and-Spoke as a story · 3 points
HN discussionHave you considered using Wireguard for this? It's relatively straightforward, see: https://www.procustodibus.com/blog/2020/11/wireguard-hub-and... This way you don't depend on a VPN provider, and can easily host it on any VPS. I suppose it would work on fly.io as well. I use the hub and spoke setup to access my home network over the internet, and Wireguard works great. This also doesn't require any special gateways…
Comment linking /blog/2020/11/wireguard-hub-and-spoke-config/
on “Make your own VPN with Fly.io, tailscale and GitHub”Submitted Pro Custodibus – WireGuard VPN Management as a story · 3 points
HN discussionI did a similar thing with a cheap VPS and Wireguard. I don't trust Tailscale, and prefer controlling all aspects of my VPN. Right now I'm only using a single node, but it would be trivial to start another in a different region, and automate the whole thing. If someone's interested, this blog was very helpful: https://www.procustodibus.com/tags/wireguard/
Comment linking /tags/wireguard/
on “Make your own VPN with Fly.io, tailscale and GitHub”Submitted Missing Policy Routing Rules on Linux as a story · 2 points
HN discussionIsn't this use case covered in the article that you mentioned? Specifically under the very last heading. https://www.procustodibus.com/blog/2021/03/wireguard-allowed... That is you could specify a single Wireguard peer that you send all the traffic to by setting AllowedIPs to 0.0.0.0/0 and also set more specific routes than 0.0.0.0/0 in the main routing table of your device in order to send traffic to certain networ…
Comment linking /blog/2021/03/wireguard-allowedips-calculator/
on “Preventing Lateral Movement with WireGuard”Submitted An Opinionated Yubikey Set-Up Guide as a story · 1 points
HN discussionGood article. Is there an easy solution to route everything except the local net through WireGuard? I find the resulting long list of AllowedIPs a bit cumbersome (and impossible to verify). https://www.procustodibus.com/blog/2021/03/wireguard-allowed...
Comment linking /blog/2021/03/wireguard-allowedips-calculator/
on “Preventing Lateral Movement with WireGuard”Submitted WireGuard Transparent Tunnel as a story · 1 points
HN discussionI found the blog articles on https://www.procustodibus.com/blog/ super helpful and well written. You don't have to use their service to implement what they describe, in most cases.
Comment linking /blog/
on “Choose Your Own IP”Submitted Zero Trust Architecture with WireGuard as a story · 1 points
HN discussionI don't think you need Tailscale for this. You need tailscale when: 1) You have a lot of road-warriors 2) You need decent ACLs that isn't just IP based. 3a) You don't ability to directly connect to a site (just one needs to be accessible) 3b) You can't add 3rd site to relay traffic or punch holes in NAT. 4) You're afraid of terminals and/or text editors. Here is a good write-up on the subject: https://www.procustodi…
Comment linking /blog/2021/11/wireguard-nftables/
on “Choose Your Own IP”Submitted WireGuard Multi-Factor Authentication with Pro Custodibus as a story · 1 points
HN discussion
