v2.2
Route management fix
The installer now safely removes and re-adds the configured VPN routes so rerunning setup remains predictable even though Windows does not provide a matching Get-VpnConnectionRoute cmdlet.
WaddleLab · Build notes from the pond
Where ducks become software.
Release notes, current tooling, experiments, and the next pieces of WaddleNet. This is the less-polished side of the pond where route bugs get fixed and certificates get increasingly serious.
waddlenet://lab/status
> Initialize-WaddleLab
[PASS] VPN client installer v2.2 loaded
[PASS] Server diagnostic available
[PASS] Server repair utility available
[PASS] Certificate manager available
[PLAN] AD CS-backed CA / revocation layer
v2.2
VPN client installer
4
Published utilities
IKEv2
Current tunnel
Next
Centralized PKI
Release stream
Recent ripples.
The current WaddleNet client installer has already gone through a couple of very practical reliability fixes.
v2.1
EKU detection fix
Adjusted certificate Enhanced Key Usage detection for environments where PowerShell already exposes the ObjectId as a string.
v2
Automated client setup
The core deployment flow: stage the per-device package, import the trust chain and client certificate, create the native Windows IKEv2 VPN profile, apply policy, and add split routes.
Current toolkit
Four jobs. Four ducks.
Rather than one enormous script doing everything, the tooling is split by responsibility so diagnostics can stay read-only and repair actions remain deliberate.
Deploy
VPN Client Installer handles per-device Windows deployment and the native VPN profile.
Issue
Certificate Manager handles the lightweight PowerShell PKI and client/server certificate lifecycle.
Observe
Server Diagnostic checks the RRAS/IKEv2 stack without changing it.
Repair
Server Repair restores the intended WaddleNet server configuration when the diagnostic finds drift.
Future pond
What is still hatching.
The biggest architectural step is moving certificate management from a lightweight self-signed workflow toward a proper CA with centralized revocation.
Planned
AD CS-backed WaddleNet CA
A proper Active Directory Certificate Services foundation would add centralized certificate issuance, revocation, and CRLs while preserving the per-machine certificate model WaddleNet already uses.
Idea
Friendlier release packages
Turn individual scripts into cleaner versioned WaddleWare bundles with release notes and checksums, while keeping the actual machine-specific client PFX private and out of the public storefront.