Build the package
Place the installer, public WaddleNet-VPN-Root-CA.cer, and the device-specific <ClientName>-WaddleVPN.pfx in the same folder.
Duckumentation · How the flock fits together
From click to quack.
Documentation for my personal line of Duck Themed software. What? Don't tell me ducks can't read! They know what bread is!
Architecture
The WaddleNet flight path.
Windows clients authenticate with their own machine certificate, connect over IKEv2 to vpn.chrisrea.net, land on DragonFire's RRAS service, and receive access to the private 10.0.0.0/24 network through split tunneling.
🪟 Windows Client
Per-machine PFX
🌐 vpn.chrisrea.net
IKEv2 / IPsec
🛡️ DragonFire
Windows RRAS
🏠 10.0.0.0/24
WaddleNet LAN route
Client quick start
Three files. One install.
The installer creates the VPN profile for you; there is no need to manually rebuild the connection in Windows Settings afterward.
Run elevated
Open PowerShell as Administrator and run the v2.2 installer. It confirms the client identity before importing certificates or changing the VPN profile.
Connect
After setup, WaddleNet VPN appears as a normal Windows VPN connection. The installer also applies the split route for 10.0.0.0/24.
PowerShell · elevated
.\Install-WaddleNet-VPN-Client-v2.2.ps1
PKI pond
Certificates, without the mystery fog.
The current Certificate Manager is a lightweight PowerShell-managed PKI. It can create and handle the WaddleNet Root CA, VPN server certificates, and individual client certificates.
Root CA
The private Root CA key is the trust anchor. Keep it off the Internet-facing RRAS server after initial setup when practical; clients and the server only need the public root certificate in Trusted Roots.
One certificate per device
Each VPN client gets its own certificate and private key. The installer expects the naming convention <ClientName>-WaddleVPN.pfx, matching the certificate issued for that device.
vpn.chrisrea.net
The RRAS server certificate identifies vpn.chrisrea.net and is expected to include both Server Authentication and IP security IKE intermediate usage.
Deletion is not revocation
The current lightweight manager can remove a certificate from a Windows machine, but that is not centralized revocation. True revocation and CRLs are part of the planned move toward a proper AD CS-backed WaddleNet CA.
Server side
Test first. Repair second.
The two server scripts intentionally have different jobs. The diagnostic is read-only; the repair utility changes RRAS and firewall configuration to restore the WaddleNet baseline.
Read-only
Server Diagnostic
Checks WAN IP versus DNS, Remote Access services, Root CA trust, server certificate health, RRAS/IKEv2 policy, UDP 500/4500 firewall rules, and recent RRAS/IKE/IPsec events.
Changes config
Server Repair
Restores WaddleNet root trust, verifies the server certificate, sets certificate-only authentication, reapplies the expected IKEv2 policy, ensures firewall rules, and restarts RemoteAccess.