CME-204

IPsec / WireGuard (Encrypted Transport)

Isolate Network Unquantified evidence Preventive

Description

Encrypts all network traffic between hosts using IPsec or WireGuard, preventing eavesdropping, injection, and man-in-the-middle attacks on the wire.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Network-level MitM requires breaking cryptographic tunnel
Confidentiality (C)	H → L	Encrypted transit prevents passive eavesdropping

CWE Relationships

CWE-319 CWE-300 CWE-311

Verification

Verify IPsec or WireGuard tunnels are established

$ ipsec status 2>/dev/null || wg show 2>/dev/null
# Expected: established|interface

Platform: linux

Remediation

linux WireGuard encrypted tunnel via wg-quick


dnf install -y wireguard-tools
umask 077 && mkdir -p /etc/wireguard && wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
cat > /etc/wireguard/wg0.conf <<'WGEOF'
[Interface]
Address = <tunnel_address>/24
PrivateKey = $(cat /etc/wireguard/privatekey)
ListenPort = 51820

[Peer]
PublicKey = <peer_public_key>
AllowedIPs = <peer_allowed_ips>/32
Endpoint = <peer_endpoint>:51820
PersistentKeepalive = 25
WGEOF
systemctl enable --now wg-quick@wg0