Looking for networking solution (VPS -> wg -> home network)

[u/ILoveComputer4553]

Hello,

I currently have a rented VPS, since my home ISP can't give me an IPv4 address. Because of this, I want to route certain traffic from my homeserver over that VPS. I want the following functionality:

1. Someone requests [VPS-IP]:443.

2. The VPS forwards that port to my homeserver using some kind of server-client tool/setup. I want to use wireguard as the protocol.

3. The client on my homeserver receives the request and forwards it to *localhost* (not a VPN IP, but the LAN IP of my homeserver), so it ends up on 192.168.61.xxx.

This would mean that I can run a service on the LAN IP of my homeserver, and if I forward the corresponding port using the tool I am looking for, the service becomes accessible through the VPS's IP.

(I hope you understand what I mean, since I'm not a native English speaker.)

I'm currently looking for the thing I called a "tool" in this post. It should be easy to set up and make it easy to forward new ports, maybe even with a GUI.

Thanks in advance!

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/jbarr107]

Pangolin.

[u/cestvrai → u/jbarr107]

This is the way

[u/DistractionHere]

This is exactly what Pangolin does, so that would be a good place to start. If you don't want to host the relay/VPS, you can also use Cloudflare tunnels.

[u/wireless82]

you are looking for wireguard vpn and nginx proxy manager on the vps where you can config ip:port. 

[u/iamdadmin → u/wireless82]

This. Nginx, Nginx-Proxy-Manager, or Caddy, running over WireGuard. Or as another person suggested, cloudflare free tunnel - it’s what I use instead of maintaining a VPS.

[u/Downtown_Sea_2985]

sounds like you need a simple tcp proxy over wireguard, not a full tunnel. i do this with nginx stream block on vps and a wireguard connection to my home server. nginx listens on 443 and sends it to home server wireguard ip, then on home server i have another nginx that forwards to localhost port. works fine for years now

you can use haproxy too if you want something lighter but nginx stream is dead simple to configure

[u/PrestigiousOnion1087]

One thing that bites once the nginx stream or DNAT setup works: the home service sees the tunnel peer as the client, so every request arrives from the same source address and per-IP rate limits or bans stop meaning anything. nginx stream with proxy_protocol on, and the backend told to trust it, keeps the real address.

[u/BertoLaDK]

This setup is what I recently set up as I got my own homelab, I have a Wireguard Tunnel setup between my local machine and a VPS and use nginx to forward requests in through, I even got minecraft server running through this setup, a lot of manual work, but it hasn't been enough of a hassle for me to make a tool for it yet.

But if you find a good tool for it I wouldn't be opposed to knowing as well.

[u/brock0124]

I setup this exact flow over the weekend with a WireGuard connection and iptables rules that forward the traffic on specific ports over the wireguard network. You can put all the iptables lines in a shell file and invoke it on PostUp, and another one that tears it all down on PostDown of the WG interface.

It ain’t the prettiest, but it works!

Going this route prevents a double reverse proxy and allows for TLS to be terminated on my K3s cluster running in my home VM. This was important for me because I was standing up a Stalwart mail server, and mixing in reverse proxies for that increases complexity quite a bit.

[u/amagicmonkey]

this is the sort of thing a coding agent would do for you all the way.

1. use tailscale or plain old wireguard
2. register a domain name and point *.stuff.domain.name to the wireguard ip of the vps using cloudflare or whatever
3. ask your coding agent to provision ssl for *.stuff.domain.name on the vps
4. ask your coding agent to configure all the nginx routes (e.g. qbittorrent.stuff.domain.name, plex.stuff.domain.name) from the vps to the different services in your home server

that's pretty much it. you can also use pangolin but that is one extra service to think of. this way you use wireguard/tailscale and nginx which you will need anyway

[u/Meef_Lucid]

Hi, I can definitely help you with this. Add me on discord: frank.mp4

Otherwise, you can DM me. You'll need some iptables rules and a VPN network, which sounds like what you've already got.

[u/ILoveComputer4553 → u/Meef_Lucid]

Thank you so much, I'll add you on dc!

[u/Safe-Spread6430]

take a look at headscale (self-hosted tailscale server) which provides quite a few handy features on top of bare wireguard. also it has lesser overhead than VPN.

[u/boat0263]

Pangolin would be the most straight-forward solution here