How to "reverse Proxy" to my self hosted service (like cloudflare tunnel) reddit / selfhosted ---------------------------------------------------------------------- Autchirion · 2023-11-28 11:28 Hey Guys, currently I'm using cloudflare tunnel to hide the IP the services I'm hosting without opening a Port. However I was able to aquire a cheap VPS. Is there a way to create a "cloudflare tunnel" like system? I had an Idea, but was not able to finish implement it. Obviously the easy solution would be, host a swag (reverse proxy) container on the vps and open some ports on my local router (one per service) and use duckdns to come around the non static IP issue. However, I'd prefere not to open ports at home, I quite like the idea of the non port forwarding cloudflare tunnel solution. So I was thinking I could connect the two sites via wireguard, allow the VPS to access my docker network which runs all the services and then forward the traffic which goe through the reverse proxy (like shown in this [picture](https://ibb.co/HNTShQ2)). ​ Any Ideas if this is feasible and I'm open to other suggestions, I'm right now in the phase of solution finding, so everything is welcome, especcially when it comes with a tutorial. ​ Have a great day, Autchi ---------------------------------------------------------------------- Simplixt · 2023-11-28 11:44 Yes, this setup will work. Just put your WireGuard Client on Keep- Alive, so that it stays connected even if you get a new IP. ---------------------------------------------------------------------- bka-informant · 2023-11-28 11:44 I am forced by CGNAT to do everything via a reverse proxy on a VPS and use Rathole in conjunction with Nginx Proxy Manager for this purpose https://github.com/rapiz1/rathole https://github.com/NginxProxyManager/nginx-proxy-manager ---------------------------------------------------------------------- dually · 2023-11-28 11:49 Your reverse proxy, as well as the upstream services, can all live inside your wireguard vpn. Of course this eliminates the need for having a registered domain or ssl encryption or publicly exposing the reverse proxy. ---------------------------------------------------------------------- Autchirion · 2023-11-28 11:56 do you forward all traffic on port 80 and 443 to your NginxProxy manager or do you split up the data streams beforehand and then forward them to the individual containers? ---------------------------------------------------------------------- Autchirion · 2023-11-28 11:59 thank you for the idea, I like the opensense firewall, I'll look into it, but for now I think I might wo with the solution from u/bka- informant. This seems easier and straight forward, also it only requires a container in my homenetwork to run. But I'll definetly keep it as a backup solution if I fail with the rathole solution. ---------------------------------------------------------------------- bka-informant · 2023-11-28 12:07 I have a separate Rathole tunnel for each application and then run Nginx Proxy Manger on the VPS, which simply points to the ports of the different Rathole tunnels Example: Webserver at Home on 10.0.1.15:80 -> Rathole-Tunnel to VPS -> Rathole- Server on the VPS listens for this tunnel on port 8123 but only on localhost (127.0.0.1) -> Nginx Proxy Manger redirects the subdomain "server1.example.com" to 127.0.0.1:8123 ---------------------------------------------------------------------- NekoLuka · 2023-11-28 12:34 Where do you get a €1 vps? ---------------------------------------------------------------------- Simplixt · 2023-11-28 13:16 In Germany Ionos / Netcup / Strato ---------------------------------------------------------------------- Autchirion · 2023-11-28 13:45 ok, I'll check this next. I just tried to forward all traffic from 443 and 80 to my reverse proxy. But this didn't work, I always end up on the error website, just for documentation purposse if anyone asks. ---------------------------------------------------------------------- watchdog_timer · 2023-11-28 13:58 Yes, there are [many different ways](https://github.com/anderspitman/awesome-tunneling) you can accomplish this. ---------------------------------------------------------------------- certuna · 2023-11-28 14:38 >However, I'd prefere not to open ports at home But why? Opening ports is not an issue if you only allow connections from the VPS in the firewall. Keeping a tunnel up is certainly possible, but it adds another layer of complexity/reliability. ---------------------------------------------------------------------- Anejey · 2023-11-28 14:50 I've had great success with this [script](https://github.com/mochman/Bypass_CGNAT/wiki/Oracle- Cloud-(Automatic-Installer-Script)). It's a script that makes a Wireguard tunnel between your local network and the VPS, so no opening of ports at home needed. It's made for Oracle VPS though, but it'd probably work elsewhere too. My current setup is this: Cloudflare DNS -> Caddy (VPS) -> Wireguard tunnel -> NginxPM (Home) -> services You can just have the Wireguard tunnel go straight to docker though. ---------------------------------------------------------------------- PovilasID · 2023-11-28 17:42 You can host Wireguard or any other tunnel that you want inside of a container in the VPS. I use VPNs inside of a container because they do not grant access to my network to host machine. Then on VPS you can also host something like traefik and that would apply to the VPN container. ---------------------------------------------------------------------- NekoLuka · 2023-11-28 18:15 I'll look them up ---------------------------------------------------------------------- Conscious-Calendar37 · 2023-11-29 01:52 Racknerd runs deals sometimes. I have $23 per year vps ---------------------------------------------------------------------- Conscious-Calendar37 · 2023-11-29 02:00 I used to have a CGNAt carrier, ran a VPS with an HAproxy lxc container that had Tailscale connected to my home network. HAproxy backend pointed to an on prem HAproxy with backend nodes in my home network. Was very stable. I’ve also used cloudflare tunnels. Cloudflare tunnels are much easier to setup. ---------------------------------------------------------------------- Autchirion · 2023-11-29 04:39 Unfortunately my router doesn‘t allow filtering based on the origin IP. So I‘d have to set this up within every Docker container itself which I don‘t know how to do and I don’t know the implications of this. ---------------------------------------------------------------------- Autchirion · 2023-11-29 04:42 Lovely! Will read through it if I can find a better solution than what I got suggested earlier. ---------------------------------------------------------------------- Autchirion · 2023-11-29 04:48 This doesn’t seem to use containers, I’m running Unraid in my home network so I’d prefer a solution which uses docker. Unraid doesn’t act well on installed software. ---------------------------------------------------------------------- Autchirion · 2023-11-29 04:50 You just missed Black Friday and cyber Monday deals. I got exactly this VPS (but the higher tier with 2 cores and 60GB storage) for 2€/month. ---------------------------------------------------------------------- Anejey · 2023-11-29 09:03 Could possibly just run an Ubuntu container and install the Wireguard there.