first commit
This commit is contained in:
mk
175
README.md
Normal file
175
README.md
Normal file
@@ -0,0 +1,175 @@
|
||||
# WireGuard VPN + Traefik Reverse Proxy Setup
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
Internet → VPS → WireGuard tunnel → Home Server → Traefik → Containers
|
||||
```
|
||||
|
||||
## Files Structure
|
||||
|
||||
```
|
||||
wireguard/
|
||||
├── vps/
|
||||
│ ├── wg0.conf # WireGuard config for VPS
|
||||
│ ├── setup.sh # Setup script for VPS
|
||||
│ └── ports.sh # Iptables update script for new ports
|
||||
├── home/
|
||||
│ ├── docker-compose.yml
|
||||
│ ├── wireguard-config/
|
||||
│ │ └── wg0.conf # WireGuard config for home
|
||||
│ ├── traefik/
|
||||
│ │ ├── traefik.yml # Traefik static config
|
||||
│ │ └── dynamic.yml # Traefik dynamic config
|
||||
└── README.md
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 1: Setup VPS (Debian)
|
||||
|
||||
1. Copy the `vps/` folder to your VPS
|
||||
|
||||
2. Run the setup script:
|
||||
|
||||
```bash
|
||||
chmod +x setup.sh
|
||||
sudo ./setup.sh
|
||||
```
|
||||
|
||||
3. The script will output your VPS keys. Save them:
|
||||
- **VPS Private Key** → put in `vps/wg0.conf`
|
||||
- **VPS Public Key** → put in `home/wireguard-config/wg0.conf`
|
||||
|
||||
4. Copy the updated `wg0.conf` to `/etc/wireguard/wg0.conf`
|
||||
|
||||
5. Wait for Step 2 to get the home public key before starting WireGuard
|
||||
|
||||
---
|
||||
|
||||
## Step 2: Setup Home Server (Arch)
|
||||
|
||||
1. Copy the `home/` folder to your home server
|
||||
|
||||
2. Generate WireGuard keys:
|
||||
|
||||
```bash
|
||||
wg genkey | tee privatekey | wg pubkey > publickey
|
||||
cat privatekey # → put in home/wireguard-config/wg0.conf
|
||||
cat publickey # → put in vps/wg0.conf on VPS
|
||||
```
|
||||
|
||||
3. Edit `home/wireguard-config/wg0.conf`:
|
||||
- Replace `HOME_PRIVATE_KEY` with your private key
|
||||
- Replace `VPS_PUBLIC_KEY` with the VPS public key from Step 1
|
||||
|
||||
4. Start the containers:
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 3: Finish VPS Setup
|
||||
|
||||
1. On VPS, edit `/etc/wireguard/wg0.conf`:
|
||||
- Replace `HOME_PUBLIC_KEY` with your home server's public key
|
||||
|
||||
2. Start WireGuard:
|
||||
|
||||
```bash
|
||||
sudo systemctl start wg-quick@wg0
|
||||
```
|
||||
|
||||
3. Test the tunnel:
|
||||
```bash
|
||||
ping 10.0.0.2
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 4: Point Your Domain to VPS
|
||||
|
||||
Create DNS A records pointing to your VPS IP:
|
||||
|
||||
```
|
||||
exampledomain.com → VPS_IP
|
||||
*.exampledomain.com → VPS_IP (wildcard for subdomains)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 5: Configure connections to your Containers
|
||||
|
||||
Add Traefik configurations to dynamic.yml, the file comes with a simple example:
|
||||
|
||||
```yaml
|
||||
routers:
|
||||
example-app: #Define service name
|
||||
# Rules define the domain and/or subdomain you want to use
|
||||
rule: "Host(`exampledomain.com`) || Host(`subdomain.exampledomain.com`)"
|
||||
entryPoints:
|
||||
- web # use HTTP
|
||||
- websecure # use HTTPS
|
||||
example-app: blog
|
||||
|
||||
services:
|
||||
example-app: #Service name
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://example-docker:80" #Docker IP/name and port to have DNS redirect to
|
||||
```
|
||||
|
||||
See `dynamic.yml` for a complete example and use it for configuration.
|
||||
|
||||
---
|
||||
|
||||
## Useful Commands
|
||||
|
||||
### VPS
|
||||
|
||||
```bash
|
||||
# Check WireGuard status
|
||||
sudo wg show
|
||||
|
||||
# View iptables rules
|
||||
sudo iptables -t nat -L -n -v
|
||||
|
||||
# Restart WireGuard
|
||||
sudo systemctl restart wg-quick@wg0
|
||||
```
|
||||
|
||||
### Home Server
|
||||
|
||||
```bash
|
||||
# View logs
|
||||
docker compose logs -f
|
||||
|
||||
# Restart services
|
||||
docker compose restart
|
||||
|
||||
# Check WireGuard status inside container
|
||||
docker exec wireguard wg show
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Tunnel not connecting
|
||||
|
||||
- Check both public keys are correct
|
||||
- Ensure VPS firewall allows UDP 51820
|
||||
- Check `PersistentKeepalive` is set (for NAT traversal)
|
||||
|
||||
### Traefik not getting certificates
|
||||
|
||||
- Ensure port 80 is forwarded through VPS
|
||||
- Check DNS is pointing to VPS IP
|
||||
- View Traefik logs: `docker compose logs traefik`
|
||||
|
||||
### Traffic not reaching home server
|
||||
|
||||
- Test tunnel: `ping 10.0.0.2` from VPS
|
||||
- Check iptables: `sudo iptables -t nat -L PREROUTING -n -v`
|
||||
- Ensure ip_forward is enabled: `cat /proc/sys/net/ipv4/ip_forward`
|
||||
46
home/docker-compose.yml
Normal file
46
home/docker-compose.yml
Normal file
@@ -0,0 +1,46 @@
|
||||
services:
|
||||
wireguard:
|
||||
image: lscr.io/linuxserver/wireguard:latest
|
||||
container_name: wireguard
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
- SYS_MODULE
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- TZ=UTC
|
||||
volumes:
|
||||
- ./wireguard-config:/config
|
||||
- /lib/modules:/lib/modules:ro
|
||||
sysctls:
|
||||
- net.ipv4.ip_forward=1
|
||||
- net.ipv4.conf.all.src_valid_mark=1
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD", "ping", "-c", "1", "10.0.0.1"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 30s
|
||||
networks:
|
||||
vpn_net:
|
||||
ipv4_address: 172.32.0.2
|
||||
|
||||
traefik:
|
||||
image: traefik:v3.0
|
||||
container_name: traefik
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
wireguard:
|
||||
condition: service_healthy
|
||||
network_mode: service:wireguard
|
||||
volumes:
|
||||
- ./traefik:/etc/traefik
|
||||
- ./letsencrypt:/letsencrypt
|
||||
|
||||
networks:
|
||||
vpn_net:
|
||||
driver: bridge
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.32.0.0/24
|
||||
31
home/traefik/dynamic.yml
Normal file
31
home/traefik/dynamic.yml
Normal file
@@ -0,0 +1,31 @@
|
||||
# Traefik Dynamic Configuration
|
||||
# Add services here - Traefik watches this file and reloads automatically
|
||||
|
||||
http:
|
||||
middlewares:
|
||||
https-headers:
|
||||
headers:
|
||||
customRequestHeaders:
|
||||
X-Forwarded-Proto: "https"
|
||||
|
||||
routers:
|
||||
#EXAMPLE
|
||||
example-app:
|
||||
rule: "Host(`exampledomain.com`) || Host(`subdomain.exampledomain.com`)"
|
||||
entryPoints:
|
||||
- web
|
||||
- websecure
|
||||
example-app: blog
|
||||
#/EXAMPLE
|
||||
|
||||
services:
|
||||
#EXAMPLE
|
||||
example-app:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://example-docker:80"
|
||||
#/EXAMPLE
|
||||
|
||||
serversTransports:
|
||||
insecure-transport:
|
||||
insecureSkipVerify: true
|
||||
17
home/traefik/traefik.yml
Normal file
17
home/traefik/traefik.yml
Normal file
@@ -0,0 +1,17 @@
|
||||
# Traefik Static Configuration
|
||||
|
||||
api:
|
||||
dashboard: true
|
||||
insecure: true # Dashboard on port 8080 - only accessible via WireGuard
|
||||
|
||||
entryPoints:
|
||||
web:
|
||||
address: ":80"
|
||||
|
||||
websecure:
|
||||
address: ":443"
|
||||
|
||||
providers:
|
||||
file:
|
||||
filename: /etc/traefik/dynamic.yml
|
||||
watch: true
|
||||
10
home/wireguard-config/wg0.conf
Normal file
10
home/wireguard-config/wg0.conf
Normal file
@@ -0,0 +1,10 @@
|
||||
[Interface]
|
||||
Address = 10.0.0.2/24
|
||||
PrivateKey = HOMELAB_PRIVATE_KEY
|
||||
|
||||
[Peer]
|
||||
# VPS public key (from VPS's wg genkey | wg pubkey)
|
||||
PublicKey = VPS_PUBLIC_KEY
|
||||
Endpoint = VPS_IP:51820
|
||||
AllowedIPs = 10.0.0.1/32
|
||||
PersistentKeepalive = 25
|
||||
208
vps/ports.sh
Normal file
208
vps/ports.sh
Normal file
@@ -0,0 +1,208 @@
|
||||
#!/bin/bash
|
||||
# Manage port forwarding from VPS to home server via WireGuard
|
||||
|
||||
set -e
|
||||
|
||||
INTERFACE=$(ip route | grep default | awk '{print $5}' | head -n1)
|
||||
HOME_SERVER="10.0.0.2"
|
||||
|
||||
show_help() {
|
||||
echo "Port Forwarding Manager"
|
||||
echo "========================"
|
||||
echo "Forward ports from VPS to home server via WireGuard tunnel."
|
||||
echo ""
|
||||
echo "Usage: $0 <command> [options]"
|
||||
echo ""
|
||||
echo "Commands:"
|
||||
echo " list Show all currently forwarded ports"
|
||||
echo " add <port> [protocol] Forward a port to home server"
|
||||
echo " remove <port> [protocol] Stop forwarding a port"
|
||||
echo " help Show this help message"
|
||||
echo ""
|
||||
echo "Protocol options:"
|
||||
echo " tcp - TCP only (default)"
|
||||
echo " udp - UDP only"
|
||||
echo " both - TCP and UDP"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo " $0 list # Show all forwarded ports"
|
||||
echo " $0 add 25565 # Forward Minecraft server (TCP)"
|
||||
echo " $0 add 7777 udp # Forward UDP port 7777"
|
||||
echo " $0 add 27015 both # Forward game server (TCP+UDP)"
|
||||
echo " $0 remove 25565 # Stop forwarding port 25565"
|
||||
echo " $0 remove 7777 udp # Stop forwarding UDP port 7777"
|
||||
echo ""
|
||||
echo "Notes:"
|
||||
echo " - Ports 80 and 443 are reserved for Traefik (HTTP/HTTPS)"
|
||||
echo " - Changes are saved automatically and persist after reboot"
|
||||
echo " - Run as root (sudo)"
|
||||
}
|
||||
|
||||
show_add_usage() {
|
||||
echo "Error: Missing port number"
|
||||
echo ""
|
||||
echo "Usage: $0 add <port> [protocol]"
|
||||
echo ""
|
||||
echo "Arguments:"
|
||||
echo " port Port number to forward (required)"
|
||||
echo " protocol tcp (default), udp, or both"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo " $0 add 25565 # Forward TCP port 25565"
|
||||
echo " $0 add 7777 udp # Forward UDP port 7777"
|
||||
echo " $0 add 27015 both # Forward both TCP and UDP"
|
||||
}
|
||||
|
||||
show_remove_usage() {
|
||||
echo "Error: Missing port number"
|
||||
echo ""
|
||||
echo "Usage: $0 remove <port> [protocol]"
|
||||
echo ""
|
||||
echo "Arguments:"
|
||||
echo " port Port number to stop forwarding (required)"
|
||||
echo " protocol tcp (default), udp, or both"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo " $0 remove 25565 # Stop forwarding TCP port 25565"
|
||||
echo " $0 remove 7777 udp # Stop forwarding UDP port 7777"
|
||||
echo " $0 remove 27015 both # Stop forwarding both TCP and UDP"
|
||||
}
|
||||
|
||||
show_invalid_protocol() {
|
||||
echo "Error: Invalid protocol '$1'"
|
||||
echo ""
|
||||
echo "Valid protocols:"
|
||||
echo " tcp - TCP only (default)"
|
||||
echo " udp - UDP only"
|
||||
echo " both - TCP and UDP"
|
||||
}
|
||||
|
||||
list_ports() {
|
||||
echo "=== Forwarded Ports ==="
|
||||
echo ""
|
||||
local found=0
|
||||
iptables -t nat -L PREROUTING -n 2>/dev/null | grep -E "dpt:" | grep "10.0.0.2" | \
|
||||
awk '{for(i=1;i<=NF;i++) if($i ~ /dpt:/) print $2, $i}' | \
|
||||
sed 's/dpt://' | \
|
||||
while read proto port; do
|
||||
echo " $port ($proto)"
|
||||
found=1
|
||||
done
|
||||
|
||||
if [ $found -eq 0 ]; then
|
||||
# Check again since subshell doesn't preserve variable
|
||||
if ! iptables -t nat -L PREROUTING -n 2>/dev/null | grep -q "10.0.0.2.*dpt:"; then
|
||||
echo " No ports currently forwarded (besides 80/443 for Traefik)"
|
||||
fi
|
||||
fi
|
||||
echo ""
|
||||
}
|
||||
|
||||
add_port() {
|
||||
local port=$1
|
||||
local proto=$2
|
||||
|
||||
echo "Adding $proto port $port -> $HOME_SERVER:$port"
|
||||
iptables -t nat -A PREROUTING -i $INTERFACE -p $proto --dport $port -j DNAT --to-destination $HOME_SERVER:$port
|
||||
iptables -A FORWARD -i $INTERFACE -o wg0 -p $proto --dport $port -j ACCEPT
|
||||
}
|
||||
|
||||
remove_port() {
|
||||
local port=$1
|
||||
local proto=$2
|
||||
|
||||
echo "Removing $proto port $port"
|
||||
iptables -t nat -D PREROUTING -i $INTERFACE -p $proto --dport $port -j DNAT --to-destination $HOME_SERVER:$port 2>/dev/null || echo " NAT rule not found"
|
||||
iptables -D FORWARD -i $INTERFACE -o wg0 -p $proto --dport $port -j ACCEPT 2>/dev/null || echo " FORWARD rule not found"
|
||||
}
|
||||
|
||||
save_rules() {
|
||||
echo ""
|
||||
echo "Saving iptables rules..."
|
||||
netfilter-persistent save >/dev/null 2>&1
|
||||
echo "Done! Changes will persist after reboot."
|
||||
}
|
||||
|
||||
# Main
|
||||
case ${1:-} in
|
||||
help|--help|-h)
|
||||
show_help
|
||||
;;
|
||||
list)
|
||||
list_ports
|
||||
;;
|
||||
add)
|
||||
if [ -z "${2:-}" ]; then
|
||||
show_add_usage
|
||||
exit 1
|
||||
fi
|
||||
PORT=$2
|
||||
PROTOCOL=${3:-tcp}
|
||||
|
||||
case $PROTOCOL in
|
||||
tcp)
|
||||
add_port $PORT tcp
|
||||
;;
|
||||
udp)
|
||||
add_port $PORT udp
|
||||
;;
|
||||
both)
|
||||
add_port $PORT tcp
|
||||
add_port $PORT udp
|
||||
;;
|
||||
*)
|
||||
show_invalid_protocol $PROTOCOL
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
save_rules
|
||||
;;
|
||||
remove)
|
||||
if [ -z "${2:-}" ]; then
|
||||
show_remove_usage
|
||||
exit 1
|
||||
fi
|
||||
PORT=$2
|
||||
PROTOCOL=${3:-tcp}
|
||||
|
||||
case $PROTOCOL in
|
||||
tcp)
|
||||
remove_port $PORT tcp
|
||||
;;
|
||||
udp)
|
||||
remove_port $PORT udp
|
||||
;;
|
||||
both)
|
||||
remove_port $PORT tcp
|
||||
remove_port $PORT udp
|
||||
;;
|
||||
*)
|
||||
show_invalid_protocol $PROTOCOL
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
save_rules
|
||||
;;
|
||||
"")
|
||||
echo "Error: No command specified"
|
||||
echo ""
|
||||
echo "Usage: $0 <command> [options]"
|
||||
echo ""
|
||||
echo "Commands:"
|
||||
echo " list Show all forwarded ports"
|
||||
echo " add <port> [protocol] Forward a port"
|
||||
echo " remove <port> [protocol] Stop forwarding a port"
|
||||
echo " help Show detailed help"
|
||||
echo ""
|
||||
echo "Run '$0 help' for more information."
|
||||
exit 1
|
||||
;;
|
||||
*)
|
||||
echo "Error: Unknown command '$1'"
|
||||
echo ""
|
||||
echo "Valid commands: list, add, remove, help"
|
||||
echo ""
|
||||
echo "Run '$0 help' for more information."
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
57
vps/setup.sh
Normal file
57
vps/setup.sh
Normal file
@@ -0,0 +1,57 @@
|
||||
#!/bin/bash
|
||||
# VPS Setup Script - Run on your Debian VPS as root
|
||||
|
||||
set -e
|
||||
|
||||
echo "=== Installing WireGuard ==="
|
||||
apt update
|
||||
apt install -y wireguard
|
||||
|
||||
echo "=== Generating Keys ==="
|
||||
cd /etc/wireguard
|
||||
umask 077
|
||||
wg genkey | tee privatekey | wg pubkey > publickey
|
||||
|
||||
echo ""
|
||||
echo "========================================"
|
||||
echo "VPS Private Key (put in wg0.conf):"
|
||||
cat privatekey
|
||||
echo ""
|
||||
echo "VPS Public Key (put in home server config):"
|
||||
cat publickey
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
echo "=== Copy your wg0.conf to /etc/wireguard/wg0.conf ==="
|
||||
echo "=== Then replace VPS_PRIVATE_KEY with the private key above ==="
|
||||
echo "=== And replace HOME_PUBLIC_KEY with your home server's public key ==="
|
||||
echo ""
|
||||
|
||||
echo "=== Enabling IP Forwarding ==="
|
||||
echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-wireguard.conf
|
||||
sysctl -p /etc/sysctl.d/99-wireguard.conf
|
||||
|
||||
echo "=== Setting up iptables rules ==="
|
||||
# Get the main network interface (usually eth0 or ens3)
|
||||
INTERFACE=$(ip route | grep default | awk '{print $5}' | head -n1)
|
||||
echo "Detected interface: $INTERFACE"
|
||||
|
||||
# Forward ports 80 and 443 to home server via WireGuard
|
||||
iptables -t nat -A PREROUTING -i $INTERFACE -p tcp --dport 80 -j DNAT --to-destination 10.0.0.2:80
|
||||
iptables -t nat -A PREROUTING -i $INTERFACE -p tcp --dport 443 -j DNAT --to-destination 10.0.0.2:443
|
||||
iptables -A FORWARD -i $INTERFACE -o wg0 -p tcp --dport 80 -j ACCEPT
|
||||
iptables -A FORWARD -i $INTERFACE -o wg0 -p tcp --dport 443 -j ACCEPT
|
||||
iptables -A FORWARD -i wg0 -o $INTERFACE -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
|
||||
|
||||
echo "=== Making iptables persistent ==="
|
||||
apt install -y iptables-persistent
|
||||
netfilter-persistent save
|
||||
|
||||
echo "=== Enabling WireGuard service ==="
|
||||
systemctl enable wg-quick@wg0
|
||||
echo ""
|
||||
echo "=== After you update wg0.conf with keys, run: ==="
|
||||
echo "systemctl start wg-quick@wg0"
|
||||
echo ""
|
||||
echo "=== Done! ==="
|
||||
8
vps/wg0.conf
Normal file
8
vps/wg0.conf
Normal file
@@ -0,0 +1,8 @@
|
||||
[Interface]
|
||||
Address = 10.0.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = VPS_PRIVATE_KEY
|
||||
|
||||
[Peer]
|
||||
PublicKey = HOMELAB_PUBLIC_KEY
|
||||
AllowedIPs = 10.0.0.2/32
|
||||
Reference in New Issue
Block a user