2

WireGuard : How do I route VPS PUBLIC IPs traffic through tunnel to home router/firewall for public facing self-hosting services?

What a terribly long and wordy question to ask.

Long Story: After 10+ years with my current ISP I will be moving to an area that was just recently wired for broadband by a new upstart ISP thanks to Build Back Better. This new ISP only rents public IPs to business accounts. Ironically and thankfully the ISP does permit hosting on residential accounts.

Want to avoid dynamic dns services so I am setting up a VPS in the cloud to tunnel and expose selected VMs and services within my home lab to the Internet.

With my current ISP I am using a block of 5 with 1:1 NAT and aliases on my local router/firewall.

When I make the move I would like to use my current router/firewall with minimal changes to its configuration and be able to utilize my existing firewall rules and malicious & blacklisted IP blocking utilities.

Experimenting with configuring a VPS w/ Linux & WireGuard and creating a tunnel FROM my home lab router to the VPS. The VPS is the WireGuard Server and the home router/firewall is the WireGuard Peer.

SCENARIO: Home lab has self-hosted website with local IP of 192.xxx.30.xxx with Public Facing IP address 123.456.789.002 located on cloud based VPS. VPS is connect to home lab router / firewall via a WireGuard Tunnel.

How do I configure the VPS to tunnel the public IPs associated traffic over the tunnel to the home lab router/firewall so that the home lab router/firewall can process the traffic and route to the correct VM and service?

How is that traffic then returned back to the original requester over the the tunnel and out the VPS.

How can traffic from local home lab devices such as laptop and smart phone reach the Internet WITHOUT using the tunnel?

Would be great to locate a step-by-step tutorial.

WireGuard Home Lab Diagram

0

1 Answer 1

Reset to default
0

A lot to read, but to my understanding you can divide your router/fw into two Virtual Router Functions (VRF). One "horizontal" in the figure, for VM-VPS and one "vertical" for local-network-Internet.

It looks to me like a school-book VRF scenario. VRF is supported in Linux and in HW routers (which I have no recent experience with).

Alternatively you may use source based policy routing. You set a default route based on the source-address. For example:

ip rule add from 192.xxx.20.yyy/24 table 10
ip route add default via <your-wps-gw> table 10

While keeping your "normal" default route to the Internet for your lan. The "your-wps-gw" can be an endpoint for the WireGuard tunnel.

1
  • Thanks for the information. Forgot that I had posted here. Went ahead a installed pfSense on the VPS and was able to get things working with a little help from the community. One of the things that I had difficulty wrapping my head around was the ALLOWED IPs. I may circle back around to the linux solution as VPS provider has limited custom ISO support.
    – I Own I Owe Oh My
    Mar 19 at 11:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .