OpenVPN and WireGuard: Self-Hosted VPN Replacing ExpressVPN and NordLayer Training Course
OpenVPN and WireGuard stand as the two leading open-source VPN protocols. By operating your own VPN server, you guarantee that no third-party provider can record traffic metadata, inject advertisements, or adhere to foreign data requests. This training programme encompasses both protocols, addressing various threat models and performance needs.
This instructor-led live training (available online or onsite) is designed for intermediate network administrators looking to substitute commercial VPN services with self-hosted, sovereign remote access infrastructure using OpenVPN and WireGuard.
Upon completing this training, participants will be able to:
- Deploy OpenVPN and WireGuard on Linux servers.
- Design PKI infrastructure for effective certificate lifecycle management.
- Configure split-tunnel and full-tunnel policies for remote users.
- Integrate VPN authentication with LDAP/Active Directory.
- Monitor VPN health, bandwidth usage, and audit connection logs.
Course Format
- Interactive lectures and discussions.
- Extensive exercises and practical sessions.
- Hands-on implementation within a live-lab environment.
Customization Options for the Course
- To request customized training for this course, please contact us to make arrangements.
Course Outline
VPN Sovereignty Fundamentals
- Why commercial VPNs log metadata and comply with legal requests.
- OpenVPN: mature, feature-rich, TAP/TUN flexibility.
- WireGuard: modern, minimal, high-performance cryptography.
- Choosing the right protocol for your threat model.
OpenVPN Deployment
- Installing OpenVPN with Easy-RSA PKI.
- Server configuration: cipher, HMAC, TLS-auth, and topology.
- Client configuration generation and distribution.
- Revocation and CRL management.
WireGuard Deployment
- Kernel module installation and WireGuard-tools.
- Key generation and peer configuration.
- wg-quick and systemd unit management.
- Road warrior and site-to-site mesh topologies.
Authentication and Authorization
- Certificate-based auth with OpenVPN.
- LDAP and RADIUS backend integration.
- Two-factor authentication with TOTP plugins.
- Access control lists and per-user IP allocation.
Routing and Network Design
- Full tunnel vs split tunnel routing.
- Push routes, DNS, and WINS configuration.
- NAT and masquerading for egress traffic.
- Multi-WAN and policy-based routing.
Performance and Scaling
- WireGuard vs OpenVPN throughput benchmarks.
- Multi-core optimization and kernel bypass.
- Load balancing across multiple VPN servers.
- DDoS protection and connection rate limiting.
Monitoring and Maintenance
- Connection logging and bandwidth accounting.
- Syslog and Prometheus exporter integration.
- Automated certificate renewal and expiration alerts.
- Disaster recovery and config backup.
Requirements
- Intermediate knowledge of Linux networking and firewall administration.
- Understanding of PKI, certificates, and encryption protocols.
- Familiarity with routing, NAT, and IP forwarding.
Audience
- Network administrators replacing commercial VPN services.
- Remote work teams requiring sovereign secure access.
- Organizations operating in regions with VPN blocking or surveillance.
Need help picking the right course?
southafrica@nobleprog.co.za or +27 (0)10 005 5793
OpenVPN and WireGuard: Self-Hosted VPN Replacing ExpressVPN and NordLayer Training Course - Enquiry
Related Courses
Gitea: Self-Hosted Git Forge Replacing GitHub and GitLab
14 HoursGitea is a lightweight, open-source, self-hosted Git service that offers repository management, code review, issue tracking, and CI/CD integration. It has become an increasingly popular alternative to GitHub and GitLab.com for teams seeking full control over their source code without the constraints of third-party terms of service or export restrictions.
GitLab Self-Managed: Complete DevSecOps Platform Without SaaS
21 HoursGitLab Self-Managed is the on-premises deployment of GitLab's complete DevSecOps platform, including source code management, CI/CD, container registry, security scanning, and monitoring. It is the gold standard for organizations that want the full GitLab feature set without SaaS dependency or data leaving their network.
Container Sovereignty: Kubernetes Without Cloud Dependencies
21 HoursThis instructor-led, live training in Kenya (online or onsite) is aimed at intermediate to advanced DevOps engineers and system administrators who wish to deploy and manage self-hosted Kubernetes clusters without cloud dependencies.
By the end of this training, participants will be able to: deploy production-ready Kubernetes clusters using kubeadm on bare-metal or virtual machines; configure high-availability control planes and etcd clusters; implement container networking and storage for self-managed environments; set up monitoring and observability using self-hosted solutions.
Multi-Cloud Sovereignty: Avoiding Single-Vendor Lock-in
14 HoursThis instructor-led, live training (online or onsite) targets cloud professionals who aim to design and implement multi-cloud architectures that prevent vendor lock-in and ensure data sovereignty.
By the conclusion of this training, participants will be able to identify risks related to vendor lock-in, design portable architectures, implement data sovereignty controls, and leverage cloud-agnostic tools effectively.
ONAP for Network Orchestration and Automation
28 HoursIn this instructor-led, live training in Kenya (online or onsite), participants will learn how to use ONAP to automate networking services.
By the end of this training, participants will be able to:
- Understand, install and configure the various components in the ONAP ecosystem.
- Carry out real-time, policy-driven orchestration and automation of physical and virtual network functions.
- Design, create, orchestrate, and monitor VNFs, SDNs and other network services.
- Efficiently manage the entire networking lifecycle using a software-driven approach.
- Develop, deploy, and scale a network using the latest open source technologies and practices.
Open Network Operating Systems: SONiC and ONL
14 HoursThis instructor-led live training in Kenya (online or onsite) is tailored for network engineers and infrastructure professionals looking to deploy and manage open network infrastructure on white-box switches using SONiC and ONL.
By the end of this training, participants will be able to understand SONiC and ONL architecture, deploy open-source NOS on white-box hardware, configure networking features, and implement monitoring and automation.
Private Cloud Infrastructure: OpenStack for Enterprises
21 HoursThis instructor-led live training (online or onsite) is targeted at system administrators and infrastructure engineers who aim to design, deploy, and manage private OpenStack cloud infrastructure for enterprise settings.
By the conclusion of this training, participants will gain an understanding of OpenStack architecture, learn to deploy private cloud infrastructure, manage compute and storage resources, implement security via Keystone, and apply enterprise best practices.
Software-Defined Networking with Open Source Tools
35 HoursThis instructor-led, live training in Kenya (online or onsite) targets intermediate-level network engineers and infrastructure administrators who wish to implement software-defined networks using open-source tools and technologies.
By the end of this training, participants will be able to design SDN architectures, implement Open vSwitch, configure FRRouting, deploy SDN controllers, and automate network management.
Building a Self-Managed Enterprise Network with Open-Source Routers, Switching, and Wi-Fi
21 HoursThis instructor-led, live training in Kenya (online or onsite) is designed for intermediate-level network and infrastructure professionals who wish to utilise open-source routing, switching, Wi-Fi, and management tools to design, deploy, and operate a self-managed enterprise network.
By the end of this training, participants will be able to design an open-source enterprise network architecture, configure routing, switching, and wireless services, enhance security and observability, and establish an operational plan for ongoing support.
Terraform: Self-Hosted Infrastructure as Code Without Cloud Lock-in
14 HoursTerraform is an open-source infrastructure-as-code tool that empowers teams to define and provision data center infrastructure using a declarative configuration language. When paired with self-hosted backends and on-premise providers, Terraform becomes a potent instrument for sovereign infrastructure management, effectively eliminating cloud vendor lock-in.
This instructor-led, live training (available online or onsite) is designed for intermediate infrastructure engineers seeking to leverage Terraform to manage self-hosted environments, including Proxmox, VMware, libvirt, and bare-metal provisioning.
By the end of this training, participants will be able to:
- Write robust Terraform configurations for on-premise and hybrid resources.
- Securely manage state using self-hosted backends such as PostgreSQL, S3-compatible storage, and Gitea.
- Utilize provisioners and custom providers to manage the entire bare-metal lifecycle.
- Implement efficient workspaces, modular architectures, and variable hierarchies.
- Integrate Terraform into CI/CD pipelines for automated infrastructure delivery.
Format of the Course
- Interactive lectures and guided discussions.
- Extensive exercises and practical labs.
- Hands-on implementation in a live-lab environment.
Course Customization Options
- To request a customized training track for this course, please contact us to arrange specific requirements.
Uptime Kuma: Self-Hosted Monitoring Replacing Datadog and Pingdom
7 HoursUptime Kuma is an easy-to-use, self-hosted monitoring tool that tracks the availability of websites, services, and infrastructure. It replaces Pingdom, Datadog Synthetics, and UptimeRobot for teams that want monitoring data under their own control. This instructor-led, live training (online or onsite) is aimed at beginner-to-intermediate SREs and DevOps engineers who wish to use Uptime Kuma to replace cloud uptime monitoring with a self-hosted, sovereign status tracking platform.
Enterprise VPN: Self-Hosted WireGuard and OpenVPN
21 HoursThis instructor-led, live training in Kenya (online or onsite) is aimed at security engineers and system administrators who wish to deploy and manage enterprise-grade self-hosted VPN solutions using WireGuard and OpenVPN.
By the end of this training, participants will be able to deploy WireGuard and OpenVPN, design scalable architectures, integrate with identity systems, and monitor/secure VPN infrastructure.
Wazuh: Open-Source Security Monitoring Replacing Splunk and Sentinel
21 HoursWazuh is an open-source security platform offering unified XDR and SIEM capabilities for threat detection, integrity monitoring, incident response, and compliance. It aggregates endpoint telemetry into a self-managed analysis engine, providing a viable alternative to Splunk Enterprise Security, Microsoft Sentinel, and other cloud-native SIEMs.
Woodpecker CI: Lightweight Self-Hosted Pipelines for Gitea and Forgejo
14 HoursWoodpecker CI is a straightforward yet robust continuous integration engine tailored specifically for self-hosted Git repositories such as Gitea and Forgejo. It offers a lean, Docker-native CI/CD solution that eliminates the complexity and licensing costs associated with enterprise-grade CI platforms.
Zero Trust Architecture with Open Source Components
35 HoursThis instructor-led, live training in Kenya (online or onsite) targets intermediate to advanced-level security professionals wishing to implement Zero Trust Architecture using open-source tools and sovereign infrastructure.
By the end of this training, participants will be able to design Zero Trust architectures, deploy identity-aware proxies, implement dynamic authentication, secure microservices with service mesh, and monitor zero trust policies.