checkpoint: 2026-07-06
project: WG Paid / pve-wg-paid / MGTS VM101 VPN-egress audit

Result:
MGTS VM101 is not clean.

Configured:
- vpn1 exists, proto amneziawg, old HideMyName/AWG config loaded
- vpn1 source_config: /root/hmn/configs/awg1/latest/062-BE-Belgium-Oostkamp-S7-194.71.227.212-awg1.conf
- vpn1 endpoint: 194.71.227.212:32583
- vpn1 ifstatus up=true
- vpn2 exists, proto amneziawg, old HideMyName/AWG config loaded
- vpn2 source_config: /root/hmn/configs/awg1/latest/049-DE-Germany-Berlin-S7-157.173.27.69-awg1.conf
- vpn2 endpoint: 157.173.27.69:41797
- vpn2 ifstatus up=false
- vpn3/vpn4 not configured
- vpn_user base section exists but disabled/not active

Routing:
- table 200 has default dev vpn1
- rules send iif eth1 and 10.200.0.0/24 to table 200
- VM100 VPN path traffic would currently be routed to vpn1

Runtime:
- wg command exists
- awg command absent
- wg show interfaces empty
- wg show vpn1 absent
- no confirmed WireGuard/AWG handshake from wg userspace

Conclusion:
VM101 contains old HideMyName/AWG state and is not production-ready.
Before production, buy/obtain a new HideMyName/AWG config/key for MGTS and reload VPN-egress cleanly.
Do not print private_key/public_key/preshared_key/secrets in future audits.
