Port Forwarding through a VPS with WireGuard reddit / selfhosted ---------------------------------------------------------------------- damaddi · 2023-10-25 15:45 Hey there, I am using a Xiaomi 5G Router with an unlimited data plan of my local carrier as my local network router, because 5G is simply faster and cheaper than a cable connection in my flat. The Problem is: When using the mobile network of my carrier, you don't get an own public IP- Address (wether IPv4, nor IPv4), because the carrier uses CGNAT. That means I cannot open ports to the wide web locally on my router, because it would not be accessible from the outside. Now to my case, which I need help on. I am running a Plex Media Server on my Homeserver (running Ubuntu Server) and I want to open this server to the wide web to make it accessable to my friends and family (which uncomfortably do not live in the same building as me). There is my idea: I also have a VPS, which runs Debian Bookwork, which has a public IPv4. I want to make a WireGuard VPN connection to that VPS from my local machine. The VPS just makes the port forwarding to my local server through the wireguard tunnel. (Similiar to how Mullvad's Port Forwarding worked like). However, I always tried to avoid the topic of networks, so I need help. And I am very thankful for any help :) ​ Addition: Tailscale is not an option. I already tried everything that I can use it for, but it does not work for my case. Addition 2: I am not posting this on r/plex, because I already tried searching for help there, but I have not succeded from the suggestions there. ​ EDIT: My general problem is: I do not want to use a reverse proxy, becase in my testings, Plex does not detect it and when using TV Apps it is reeeally slow. So rather I want to use a VPN connection, so that Plex already knows its own IP-Address (which is the IP of the VPS, in cause of the VPN) and [plex.tv](https://plex.tv) can route the traffic directly through this tunnel over the VPS. ---------------------------------------------------------------------- astutesnoot · 2023-10-25 16:13 Since you mentioned Mullvad, you should know that AirVpn still supports port forwarding and they're running their Halloween sale right now. However, if all you're looking to do is make your selfhosted web services available on the Internet with SSL, then Cloudflare Tunnels can do this for free. ---------------------------------------------------------------------- damaddi · 2023-10-25 16:26 But cloudflare tunnels are somehow restricted, I heard. People got banned, when using something like plex with it. ---------------------------------------------------------------------- [deleted] · 2023-10-25 16:44 [deleted] ---------------------------------------------------------------------- mrpink57 · 2023-10-25 17:24 I would suggest looking at Tailscale and look at their Funnel feature. ---------------------------------------------------------------------- Opicaak · 2023-10-25 17:29 Absolutely avoid cloudflare at all costs. It's a MitM proxy that intercepts and logs all traffic, it can also inject malicious payloads. People should also avoid using CF's VPN and DNS services. If it's free, then you are the product. It is also a known fact that CF shares information with the NSA. You can rent a VPS and setup WireGuard as the server, then connect to it from your home as a client, bind your service to the VPN's tun0 interface. It works, I tried it. Another solution is to just use SSH server and open a tunnel through that, you would also need to add a few parameters to the command for keeping the connection alive. ---------------------------------------------------------------------- Vangoss05 · 2023-10-25 18:03 https://github.com/mochman/Bypass\_CGNAT ---------------------------------------------------------------------- tgp1994 · 2023-10-25 18:23 I had a similar setup; Wireguard connecting a VPS to my home network. I use Jellyfin, but I setup an nginx proxy manager on the VPS to handle external requests and forward them to my private server. All that matters is you open the appropriate ports on your VPS to the NPM instance. ---------------------------------------------------------------------- talent_deprived · 2023-10-25 19:08 I use WG on my VPS, I do not run anything but WG on it, route ports to my home machine and from there to where I want them to go: https://www.reddit.com/r/oraclecloud/comments/174nc2d/comment/k5z08af/ ?utm\_source=share&utm\_medium=web2x&context=3 ---------------------------------------------------------------------- fedroxx · 2023-10-25 19:49 If you rent a vps, you have the same problems as CF. There is not a vendor out there that won't cave to government pressure. If you think otherwise, you're delusional. The only way to avoid this is directly to your network. Avoid any third parties. ---------------------------------------------------------------------- zfa · 2023-10-25 21:50 Best way to do it IMO. WG site-to-site link initiated at home and connecting to vps fixed IP. Run nginx on that vps proxying the Plex backend using it's home subnet IP. Will work just fine so long as vps/wg routing is correct, nginx is made available on the vps public ip, and that the vps IP/hostname is defined as the custom access URL in the Plex server config. ---------------------------------------------------------------------- zfa · 2023-10-25 21:53 Reverse proxy works just fine if you do it correctly, so you could simply fix that. Probably messed it up (didn't define custom access URL most common issue) and then fell back to being relayed through plex's server and got throttled. ---------------------------------------------------------------------- Opicaak · 2023-10-25 22:20 You are the one delusional here. The difference between a VPS and CrimeFlare is that with VPS, feds need a warrant to tap your VPS. With CrimeFlare all the intercepted data is logged and shared (sold) by default. They wouldn't offer it for free otherwise. Another issue with CF is that it inconveniences privacy-oriented visitors. Do you use a VPN or other privacy network? Let's serve you a retarded captcha or block you completely for no reason. This will result in you getting less visitors, potential customers. Have a great rest of the day. ---------------------------------------------------------------------- PaintDrinkingPete · 2023-10-25 22:48 This should be possible…just keep in mind that there may be a performance not using the vps as an extra hop…performance will also depend a lot on the **upload** bandwidth of your 5G connection to the carrier. Just setup wireguard on your vps server, and then setup your home server as a connecting client…be sure to setup a “PersistentKeepalive” in your client conf file to ensure the wireguard tunnel stays up and the server can always access the home server. **IF** you’ve already got Plex setup with TLS and HTTPS on your home server, you *may* be able to just setup forwarding on you VPS with ‘iptables’…but, if you do NOT have https setup, you’re probably best off setting up a web proxy to forward requests back to your home server. Regarding your edit, running a web proxy on the VPS shouldn’t perform any worse than directly forwarding the traffic…I’m not familiar with hosting Plex, but if I had to make a guess about “Plex not detecting it”, there’s probably additional ports or protocols that need to be setup to be proxied/forwarded as well as the main web interface. Honestly, the nginx proxy is probably the easiest way to do it…a quick google shows a few hits for guides on how to set it up, for example: https://www.plexopedia.com/plex-media-server/general/plex-nginx- reverse-proxy/ ---------------------------------------------------------------------- schklom · 2023-10-25 23:38 > If you rent a VPS, you have the same problems as CF Not if you port-forward. CF decrypts all incoming traffic, a port- forward does not. ---------------------------------------------------------------------- fedroxx · 2023-10-25 23:44 You have no idea what you're talking about. They don't need a warrant at all. Unless you control both ends of the connection you're only deluding yourself into believing it's secure. I've work for half a dozen "privacy oriented" companies. When the feds came walking in the door, the keys to your data was handed right over and no one was any wiser. We didn't inform a single client. I personally supervised over a hundred such situations. Mostly under the guise of suspected CP. None was found. ---------------------------------------------------------------------- fedroxx · 2023-10-25 23:55 If there is termination happening, they can snoop. ---------------------------------------------------------------------- damaddi · 2023-10-26 05:53 No, I set the custom access URL and even deactivated relay. The performance was pretty bad. ---------------------------------------------------------------------- zfa · 2023-10-26 06:55 Bad speeds on a direct connection using your topology would have most likely been due to an incorrect (too high) MTU on the WG link. The topology works just fine, but there a number of gotchas where there can be implementation issues like anything else. ---------------------------------------------------------------------- Adam_Meshnet · 2023-10-26 09:06 Unless I don't understand something, reverse proxies only handle the routing and address connections coming in based on used domains, no? Why, in that case, would they be slow? Prior to using Meshnet, I set up a couple of self-hosted services with dynamic DNSes and reverse proxies. General idea is, that: 1. You set up a dynamic DNS (I used duckdns), by setting up a cron job that pings the dynamic DNS every now and then, so that it knows what's your current IP. 2. You set up port forwarding (ports 80 and 443) for your home lab 3. You set up a Nginx in a docker container with ports 80 and 443 4. You set up your dynamic DNS domains to be forwarded to specific ports on your homelab server. I can easily download files from my server at the upload speeds my ISP rates my network at (20 MB/s). ---------------------------------------------------------------------- sv-giampa · 2023-10-26 17:13 Quick aswer: install Nginx Proxy Manager (NPM) and open tcp/udp streams to wherever you want. I had the same problem. Firstly, I gone with iptables configuration, that are useful, but they need much command-line, have not a web UI, need to be statically configured in wireguard with a MASQUERADE option, and need to be persistend with some tool (iptables- persistent). So to open new tunnels/streams you need shutdown wireguard, reconfigure and restart it each time. Someone can say that iptables could be more performant than NPM, but there is no proof of that. I see same performances, but much more usability and manageability with NPM.