diff --git a/ansible-playbook.yml b/ansible-playbook.yml
index 9dd35cd..ebccfc5 100755
--- a/ansible-playbook.yml
+++ b/ansible-playbook.yml
@@ -39,6 +39,34 @@
         gateway: 10.10.0.1
         state: present
 
+    - name: Ensure WireGuard kernel module is loaded
+      ansible.builtin.modprobe:
+        name: wireguard
+        state: present
+
+    - name: Persist WireGuard kernel module across reboots
+      ansible.builtin.copy:
+        dest: /etc/modules-load.d/wg-easy.conf
+        content: |
+          wireguard
+        mode: '0644'
+
+    - name: Enable IP forwarding on host
+      ansible.posix.sysctl:
+        name: net.ipv4.ip_forward
+        value: '1'
+        sysctl_set: true
+        state: present
+        reload: true
+
+    - name: Enable source valid mark on host
+      ansible.posix.sysctl:
+        name: net.ipv4.conf.all.src_valid_mark
+        value: '1'
+        sysctl_set: true
+        state: present
+        reload: true
+
     - name: pull images
       containers.podman.podman_image:
         name: "{{ item }}"
@@ -110,6 +138,54 @@
       #   - 7359:7359/udp #optional
       #   - 1900:1900/udp #optional
 
+    # WireGuard Easy VPN — deployed on npm_internal behind NPM
+    # After first deploy, you MUST add NAT hooks in the wg-easy UI:
+    #   1. Open http://10.10.0.36:51821 in a browser
+    #   2. Log in with the username/password from vars.yml
+    #   3. Go to the "Hooks" tab
+    #   4. PostUp — paste this EXACTLY:
+    #      nft add table inet wg_table; nft add chain inet wg_table prerouting { type nat hook prerouting priority 100 \; }; nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \; }; nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade; nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade; nft add chain inet wg_table input { type filter hook input priority 0 \; policy accept \; }; nft add rule inet wg_table input udp dport {{port}} accept; nft add rule inet wg_table input tcp dport {{uiPort}} accept; nft add chain inet wg_table forward { type filter hook forward priority 0 \; policy accept \; }; nft add rule inet wg_table forward iifname "wg0" accept; nft add rule inet wg_table forward oifname "wg0" accept;
+    #   5. PostDown — paste this EXACTLY:
+    #      nft delete table inet wg_table
+    #   6. Click Save and restart the container
+    # These hooks enable VPN clients to reach your app containers (10.10.0.0/24)
+    - name: Deploy WireGuard Easy (wg-easy)
+      containers.podman.podman_container:
+        name: wg-easy
+        image: "{{ wireguard_image }}"
+        restart_policy: always
+        recreate: true
+        state: started
+        env:
+          INIT_ENABLED: "true"
+          INIT_USERNAME: "{{ wireguard_ui_username }}"
+          INIT_PASSWORD: "{{ wireguard_ui_password }}"
+          INIT_HOST: "{{ wireguard_host }}"
+          INIT_PORT: "{{ wireguard_port }}"
+          INIT_DNS: "{{ wireguard_default_dns }}"
+          INIT_IPV4_CIDR: "{{ wireguard_cidr }}"
+          INIT_IPV6_CIDR: "{{ wireguard_ipv6_cidr }}"
+          INIT_ALLOWED_IPS: "{{ wireguard_allowed_ips }}"
+          PORT: "{{ wireguard_ui_port }}"
+          INSECURE: "true"
+          DISABLE_VERSION_CHECK: "true"
+        ports:
+          - "{{ wireguard_port }}:{{ wireguard_port }}/udp"
+          - "{{ wireguard_ui_port }}:{{ wireguard_ui_port }}/tcp"
+        volumes:
+          - "/opt/apps/wireguard:/etc/wireguard:z"
+          - "/lib/modules:/lib/modules:ro"
+        cap_add:
+          - NET_ADMIN
+          - SYS_MODULE
+          - NET_RAW
+        sysctl:
+          net.ipv4.ip_forward: "1"
+          net.ipv4.conf.all.src_valid_mark: "1"
+        network:
+          - npm_internal
+        ip: '{{ wireguard_ip }}'
+
 
 
 
diff --git a/requirements.yml b/requirements.yml
index afe154b..54b1ffa 100755
--- a/requirements.yml
+++ b/requirements.yml
@@ -1,4 +1,5 @@
 collections:
   - name: containers.podman
+  - name: ansible.posix
 
   
\ No newline at end of file
diff --git a/vars.yml b/vars.yml
index ea8bab6..40fb497 100755
--- a/vars.yml
+++ b/vars.yml
@@ -9,6 +9,7 @@ directories:
   - /opt/apps/prowler/data
   - /opt/apps/prowler/tmp/prowler_api_output
   - /opt/apps/prowler/postgres/data
+  - /opt/apps/wireguard
 #   - /opt/apps/wazuh/config
 #   - /opt/apps/wazuh/filebeat_etc
 #   - /opt/apps/wazuh/filebeat_var
@@ -27,6 +28,7 @@ images:
 #  - docker.n8n.io/n8nio/n8n
   - docker.gitea.com/gitea:nightly
   - docker.io/wazuh/wazuh-certs-generator:0.0.3
+  - ghcr.io/wg-easy/wg-easy:15
   # - docker.io/wazuh/wazuh-dashboard:{{ wazah_version }}
   # - docker.io/wazuh/wazuh-indexer:{{ wazah_version }}
   # - docker.io/wazuh/wazuh-manager:{{ wazah_version }}
@@ -39,3 +41,18 @@ POSTGRES_ADMIN_USER: theuseriwant
 POSTGRES_PASSWORD: theuserthatineedpaswoord
 POSTGRES_DB: thatoneit
 
+## WireGuard Easy VPN
+## IMPORTANT: After first run, change wireguard_ui_password to a strong password
+## Public IP or DDNS hostname clients connect to — CHANGE THIS before deploying
+wireguard_image: ghcr.io/wg-easy/wg-easy:15
+wireguard_host: CHANGE_ME
+wireguard_ui_username: admin
+wireguard_ui_password: CHANGE_ME
+wireguard_port: 51820
+wireguard_ui_port: 51821
+wireguard_cidr: 10.10.1.0/24
+wireguard_ipv6_cidr: fd00:10:10::/64
+wireguard_allowed_ips: 10.10.1.0/24,10.10.0.0/24
+wireguard_default_dns: 1.1.1.1
+wireguard_ip: 10.10.0.36
+