diff --git a/hieradata/nodes/aubne1nxvm2133.main.unkin.net.yaml b/hieradata/nodes/aubne1nxvm2133.main.unkin.net.yaml
new file mode 100644
index 0000000..e790071
--- /dev/null
+++ b/hieradata/nodes/aubne1nxvm2133.main.unkin.net.yaml
@@ -0,0 +1,25 @@
+---
+networking_loopback0_ip: 198.18.2.162
+networking_wg_link: 198.18.2.178/31
+networking_vpc_iface: eth1
+networking_vpc_cidr: 172.18.32.0/24
+
+# wg0 p2p to prodnxsr0020; lab routes stay pinned to wg0 sourced from the /31 until ospf learns them
+wireguard::interfaces:
+  wg0:
+    addresses:
+      - 198.18.2.179/31
+    listen_port: 51820
+    table: 'off'
+    post_up:
+      - ip route replace 198.18.0.0/16 dev wg0 src 198.18.2.179
+      - ip route replace 10.10.12.200/32 dev wg0 src 198.18.2.179
+    private_key: ''
+    peers:
+      - public_key: ''
+        endpoint: 103.216.191.185:51822
+        allowed_ips:
+          - 224.0.0.5/32
+          - 198.18.0.0/16
+          - 10.10.12.200/32
+        persistent_keepalive: 25
diff --git a/hieradata/nodes/ausyd2nxvm2131.main.unkin.net.yaml b/hieradata/nodes/ausyd2nxvm2131.main.unkin.net.yaml
new file mode 100644
index 0000000..3537cf7
--- /dev/null
+++ b/hieradata/nodes/ausyd2nxvm2131.main.unkin.net.yaml
@@ -0,0 +1,25 @@
+---
+networking_loopback0_ip: 198.18.2.161
+networking_wg_link: 198.18.2.176/31
+networking_vpc_iface: eth1
+networking_vpc_cidr: 172.18.30.0/24
+
+# wg0 p2p to prodnxsr0020; lab routes stay pinned to wg0 sourced from the /31 until ospf learns them
+wireguard::interfaces:
+  wg0:
+    addresses:
+      - 198.18.2.177/31
+    listen_port: 51820
+    table: 'off'
+    post_up:
+      - ip route replace 198.18.0.0/16 dev wg0 src 198.18.2.177
+      - ip route replace 10.10.12.200/32 dev wg0 src 198.18.2.177
+    private_key: ''
+    peers:
+      - public_key: ''
+        endpoint: 103.216.191.185:51821
+        allowed_ips:
+          - 224.0.0.5/32
+          - 198.18.0.0/16
+          - 10.10.12.200/32
+        persistent_keepalive: 25
diff --git a/hieradata/roles/infra/network/wgvpn.yaml b/hieradata/roles/infra/network/wgvpn.yaml
new file mode 100644
index 0000000..f09b77e
--- /dev/null
+++ b/hieradata/roles/infra/network/wgvpn.yaml
@@ -0,0 +1,41 @@
+---
+hiera_include:
+  - wireguard
+  - frrouting
+
+# no consul datacentre at the edge, so nothing to register or scrape via consul
+profiles::consul::client::enable: false
+exporters::node_exporter::enable: false
+
+# ssh only from the lab over the vpn
+ssh::server::options:
+  AllowUsers: '*@198.18.0.0/16 *@10.10.12.200/32'
+
+# routing
+sysctl::base::values:
+  net.ipv4.ip_forward:
+    value: '1'
+
+# frrouting: p2p ospf over wg0; loopback /32, wg /31 and vpc /24 only, no default route in or out
+frrouting::daemons:
+  ospfd: true
+frrouting::ospfd_router_id: "%{hiera('networking_loopback0_ip')}"
+frrouting::ospfd_interfaces:
+  wg0:
+    area: 0.0.0.0
+    network: point-to-point
+  dum0:
+    area: 0.0.0.0
+    passive: true
+  "%{hiera('networking_vpc_iface')}":
+    area: 0.0.0.0
+    passive: true
+frrouting::ospfd_redistribute:
+  - connected
+frrouting::ospfd_redistribute_connected_permit:
+  - "%{hiera('networking_loopback0_ip')}/32"
+  - "%{hiera('networking_wg_link')}"
+  - "%{hiera('networking_vpc_cidr')}"
+frrouting::ospfd_deny_default_in: true
+frrouting::ospf_preferred_source_enable: true
+frrouting::ospf_preferred_source: "%{hiera('networking_loopback0_ip')}"
diff --git a/modules/frrouting/manifests/init.pp b/modules/frrouting/manifests/init.pp
index 53d5d85..6af391c 100644
--- a/modules/frrouting/manifests/init.pp
+++ b/modules/frrouting/manifests/init.pp
@@ -10,6 +10,8 @@ class frrouting (
   Array[String] $ospfd_redistribute = [],
   Array[String] $ospfd_networks     = [],
   Boolean $ospfd_default_originate_always = false,
+  Array[Stdlib::IP::Address::V4::CIDR] $ospfd_redistribute_connected_permit = [], # only these exact connected prefixes are redistributed
+  Boolean $ospfd_deny_default_in    = false, # keep a learned default route out of the routing table
   Boolean $mpls_te_enabled                   = false,
   Optional[String] $mpls_ldp_router_id       = undef,
   Optional[String] $mpls_ldp_transport_addr  = undef,
diff --git a/modules/frrouting/templates/frr.conf.erb b/modules/frrouting/templates/frr.conf.erb
index eeee416..582358e 100644
--- a/modules/frrouting/templates/frr.conf.erb
+++ b/modules/frrouting/templates/frr.conf.erb
@@ -8,6 +8,9 @@ interface <%= iface %>
 <% if params['area'] -%>
  ip ospf area <%= params['area'] %>
 <% end -%>
+<% if params['network'] -%>
+ ip ospf network <%= params['network'] %>
+<% end -%>
 <% if params['passive'] == true -%>
  ip ospf passive
 <% end -%>
@@ -28,12 +31,27 @@ route-map CONNECTED-NON-K8S permit 100
 exit
 <% end -%>
 
+<% if @ospfd_redistribute_connected_permit.any? -%>
+<% @ospfd_redistribute_connected_permit.each_with_index do |prefix, i| -%>
+ip prefix-list CONNECTED-PERMIT seq <%= (i + 1) * 5 %> permit <%= prefix %>
+<% end -%>
+route-map CONNECTED-PERMIT permit 10
+ match ip address prefix-list CONNECTED-PERMIT
+exit
+<% end -%>
+<% if @ospfd_deny_default_in -%>
+access-list NO-DEFAULT seq 5 deny 0.0.0.0/0 exact-match
+access-list NO-DEFAULT seq 10 permit any
+<% end -%>
+
 router ospf
  ospf router-id <%= @ospfd_router_id %>
  log-adjacency-changes detail
 <% @ospfd_redistribute.each do |type| -%>
 <% if @ospf_exclude_k8s_enable && type == 'connected' && (@k8s_cluster_cidr || @k8s_service_cidr) -%>
  redistribute connected route-map CONNECTED-NON-K8S
+<% elsif type == 'connected' && @ospfd_redistribute_connected_permit.any? -%>
+ redistribute connected route-map CONNECTED-PERMIT
 <% else -%>
  redistribute <%= type %>
 <% end -%>
@@ -41,6 +59,9 @@ router ospf
 <% @ospfd_networks.each do |network| -%>
  network <%= network %>
 <% end -%>
+<% if @ospfd_deny_default_in -%>
+ distribute-list NO-DEFAULT in
+<% end -%>
 <% if @ospfd_default_originate_always -%>
  default-information originate always
 <% end -%>
diff --git a/modules/wireguard/manifests/interface.pp b/modules/wireguard/manifests/interface.pp
index 7428941..e9ec8c2 100644
--- a/modules/wireguard/manifests/interface.pp
+++ b/modules/wireguard/manifests/interface.pp
@@ -4,6 +4,8 @@ define wireguard::interface (
   Optional[Stdlib::Port]               $listen_port = undef,
   Optional[Integer[1280, 9000]]        $mtu         = undef,
   Optional[Sensitive[String[1]]]       $private_key = undef,
+  Optional[String[1]]                  $table       = undef,
+  Array[String[1]]                     $post_up     = [],
   Array[Struct[{
     public_key           => String[1],
     allowed_ips          => Variant[String[1], Array[String[1], 1]],
diff --git a/modules/wireguard/templates/wg.conf.erb b/modules/wireguard/templates/wg.conf.erb
index 01b45bd..84be86a 100644
--- a/modules/wireguard/templates/wg.conf.erb
+++ b/modules/wireguard/templates/wg.conf.erb
@@ -9,11 +9,17 @@ ListenPort = <%= @listen_port %>
 <% if @mtu -%>
 MTU = <%= @mtu %>
 <% end -%>
+<% if @table -%>
+Table = <%= @table %>
+<% end -%>
 <% if @key -%>
 PrivateKey = <%= @key %>
 <% else -%>
 PostUp = wg set %i private-key /etc/wireguard/%i.key
 <% end -%>
+<% @post_up.each do |cmd| -%>
+PostUp = <%= cmd %>
+<% end -%>
 <% @peers.each do |peer| -%>
 
 [Peer]
diff --git a/site/roles/manifests/infra/network/wgvpn.pp b/site/roles/manifests/infra/network/wgvpn.pp
new file mode 100644
index 0000000..1270659
--- /dev/null
+++ b/site/roles/manifests/infra/network/wgvpn.pp
@@ -0,0 +1,12 @@
+# roles::infra::network::wgvpn
+# a wireguard vpn edge host; routes its vpc to the lab over wg0 with ospf
+#
+class roles::infra::network::wgvpn {
+  if $facts['firstrun'] {
+    include profiles::defaults
+    include profiles::firstrun::init
+  }else{
+    include profiles::defaults
+    include profiles::base
+  }
+}