---

name: WireGuard description: "Configure WireGuard VPN tunnels with secure routing and key management."

AllowedIPs Traps (Most Common Mistakes)

• AllowedIPs means different things on each side — server: what peer CAN send; client: what to ROUTE through tunnel
• 0.0.0.0/0 routes ALL traffic including tunnel endpoint — breaks connectivity, must exclude server's public IP first
• Overlapping AllowedIPs between peers = undefined routing — each IP range must belong to exactly one peer
• Wrong mask silently breaks routing — /32 for single host, /24 for subnet, verify carefully

Connection Failures

• No handshake = wrong public key, firewall blocking UDP, or wrong endpoint — check all three, not just one
• One-way traffic = AllowedIPs misconfigured — packets go out but replies don't route back
• Missing PersistentKeepalive = 25 breaks NAT traversal — peer behind NAT unreachable after ~2 minutes
• Config file permissions must be 600 — wg-quick silently refuses to start with loose permissions

DNS Leaks

• Without DNS = in client config, DNS queries bypass tunnel — leaks real IP to DNS provider
• Full tunnel (0.0.0.0/0) without DNS config = false sense of security — traffic tunneled but DNS exposed

Routing Setup

• IP forwarding disabled by default on Linux — tunnel works but packets don't route between interfaces
• NAT required for internet access through tunnel — without masquerade, return packets don't find their way
• Firewall must allow UDP on ListenPort — WireGuard is UDP only, no TCP fallback exists

Key Security

• Private key file permissions matter — world-readable key is compromised, set 600 immediately after generation
• Never transmit private keys — generate on each machine, exchange only public keys
• Config files contain private keys — treat wg0.conf as secret, not just privatekey file

Live Changes

• Adding peers requires interface reload on most setups — or use wg set for live changes without dropping connections
• wg syncconf applies changes without restart — but config file format differs from wg.conf (use wg-quick strip)

Debugging

• wg show displays handshake timestamps — stale handshake (>2 min) means connection dead despite interface up
• Handshake happens on first packet — no traffic = no handshake attempt, ping to test

OpenClaw Skills Marketplace For Claude

This repository is an automatic conversion of openclaw/skills into the Claude Skills marketplace format so the skills can be installed and used directly in Claude.

It takes the OpenClaw skill corpus and rewrites it into a Claude-compatible marketplace with:

• a root marketplace manifest at .claude-plugin/marketplace.json
• one Claude plugin per OpenClaw skill under plugins/
• a generation report at reports/generate-marketplace.json

Use In Claude

Add this marketplace in Claude with:

/plugin marketplace add dvcrn/openclaw-skills-marketplace

Then install any generated plugin from the marketplace:

/plugin install <plugin-name>@openclaw-skills

Example:

/plugin install 0x-professor--agentic-mcp-server-builder@openclaw-skills

What This Repo Does

The generator reads canonical OpenClaw source skills from:

openclaw-skills/skills/<owner>/<slug>/

Each source skill is expected to contain:

• _meta.json
• SKILL.md or lowercase skill.md

The conversion process:

• maps each OpenClaw skill to one Claude plugin
• normalizes lowercase skill.md to SKILL.md
• extracts Claude plugin root assets like agents/, hooks/, .mcp.json, .lsp.json, and settings.json
• preserves nested skills/ trees when a source package already behaves like a multi-skill plugin
• skips malformed inputs and records them in reports/generate-marketplace.json

Regenerate The Entire Marketplace

To rebuild the full marketplace from the openclaw-skills submodule:

mise run generate

That regenerates:

• .claude-plugin/marketplace.json
• plugins/<plugin-id>/...
• reports/generate-marketplace.json

The generator replaces previous generated output under .claude-plugin/, plugins/, and reports/ on each run.

If you want the explicit underlying task name, this still works too:

mise run generate_marketplace

For small development runs:

python3 scripts/generate_marketplace.py --source openclaw-skills/skills --output . --limit 10

Validate And Test

Run the generator tests:

mise run test

Validate the generated marketplace:

claude plugin validate .

Notes

• Plugin ids are generated as <owner>--<slug> after sanitization.
• Nested source skills/ directories are preserved as plugin content rather than treated as separate top-level source skills.
• The upstream OpenClaw source is included as the openclaw-skills submodule.