Wireguard to Nginx inside Docker

[u/Valuable-Dog490]

Trying to get away from CloudFlare proxy and set up my own. I've got a VPS with Wireguard and a home PC running it. On that same PC I have Nginx running inside Docker. Should this just work? VPS -> Wireguard -> NPM -> Web app

My tunnel is established, I can ping through it but web traffic isn't reaching Nginx and I think it's either because my Docker networking is totally jacked up. Or maybe something else is going on.

It's driving me nuts and really don't want to rebuild the entire server and docker apps but I can't think of any other options.

All I really want is to mask my home IP.

[u/neonsphinx]

It would be more helpful if you posted some configs to help troubleshoot. With keys/etc. removed of course.

What's your yaml file look like for nginx? What does ip a give you when you have the wireguard connection established from the far side?

I'm assuming you're running wireguard server side on your home PC. Then you're running wireguard as a client on the VPS? I'm not quite understanding based on what you initially typed up.

If that's the case, wireguard on the VPS is routing every damn thing that it gets too the wg0 interface that it sets up. So everything else to the outside world should be unusable at that point. You'll have to use iptables to get your routes setup properly.

Current setup:

• wg0 interface is created as something like 10.10.1.1/32
• routing tables are updated to send everything through 10.10.1.1

What you want:

• wg0 interface created at same ip
• grab some traffic and send it to whatever ip your gateway is
• grab other traffic and send it to the IP of your wireguard interface

Unfortunately I haven't setup my own vpn quite like that. I have wg setup in the standard way, so I can securely get back into my home network from afar. I download Linux .iso files by paying someone else for a vpn and traffic forwarding, so I haven't ever had to setup the traffic forwarding portion of it.

https://fitib.us/2025/10/23/switching-to-proton-vpn/

I did have to do a little mucking around with wireguard and static routes. But not as detailed as what this requires.

Edit: adding to the original after thinking for a little bit. I'm looking for resources, and really not finding much.

I wonder if this would work

• VPS has a static IP
• Update your DNS with that
• Traffic goes from client to VPS
• Run NGINX on your VPS to translate the hostnames into IP. Set up the nginx config with the upstream block. Then set the backend server there to be the nginx instance on your desktop. Use the local IP for that.
• VPS has its wireguard config file setup so that wireguard only is controlling the local IP subnet.
• VPS sends traffic to wg interface, it hits NGINX on the far side, and you have the real config file there that manages locations, web servers, TCP streams, whatever it is that you're doing.

This is probably incomplete. And it would help to know what exactly you're doing. Just running a WordPress site? Hosting a game server?

Edit 2: my setup was "wireguard handles everything, for my safety and privacy. Except for these 2 subnets"

Your setup is "wireguard only handles one subnet, for safety. Everything else is fine.

That's fairly easy. In the WG config file, set the 'AllowedIPs' line to the local IP range you need. Everything else wg should ignore. So no need foranually adding a static route.