WG-Easy and Cloudflared Tunnel?
reddit / selfhosted

----------------------------------------------------------------------
-C8H10N4O2- · 2023-12-22 02:20

Background: Helping a friend set up WG on their home network so they
can use it as a VPN when travelling. Previously had set up port
forwarding on the router but the ISP support staff had reset it.


Looking for a more long-term solution, and hoping someone might have a
docker-compose.yaml which would fit the needs.


I was wondering if it would be possible to have WG-easy and
Cloudflared in a single compose file. I have a spare domain I can set
the zero-tier tunnel to a subdomain like
[wg.mydomain.net](https://wg.mydomain.net)  I'm hoping that the tunnel
would solve having to open up a port on the router as well as update
if the IP ever changes.


Has anyone implemented something similar? Might I have a look at your
yaml (with the tokens removed, of course)

----------------------------------------------------------------------
Square_Lawfulness_33 · 2023-12-22 03:24

I use Digitalocean’s VPS where I have a Debian VM running
docker(wireguard server, nginx proxy manager). My home server is
connected to the VPS as a wireguard client and my services on my local
server is passed through the tunnel where nginx proxy manager is able
to see them as ip addresses provided by wireguard. This cuts out
having to use Cloudflare and ddns updaters.

----------------------------------------------------------------------
zfa · 2023-12-22 04:07

So your friend wants access to his home network when travelling
without need for you to open a port-forward? The tool you've
mentioned, ZeroTier, can do just that. In fact it's literally designed
for that (see also Tailscale) kind of thing.

No need to add anything else to the mix unless ZT's NAT hole-punching
won't work for him. Then you can look at the hub-and-spoke *friend-
and-home-subnet-both-connect-to-external-VPS-and-it-routes-between-
them* topology.

----------------------------------------------------------------------
-C8H10N4O2- · 2023-12-22 14:25

Friend wants it to appear from his home IP when he is browsing from a
cafe. So putting it on a VPS doesn't address that.

----------------------------------------------------------------------
-C8H10N4O2- · 2023-12-22 14:26

Here's my compose so far. It kind of works wg-easy can be accessed
locally and through the domain but the Wireguard profiles don't seem
to be loading/route.

>version: "3.8"
volumes:
  etc\_wireguard:
services:
  wgeasy:
environment:
\# Required:
\# Change this to your host's public address
\- WG\_HOST=vpn.MYDOMAIN.io
\# Optional:
\- PASSWORD=MYPASSWORD
\- WG\_PORT=51820
\- WG\_DEFAULT\_ADDRESS=10.8.0.x
\- WG\_DEFAULT\_DNS=1.1.1.1
\#- WG\_MTU=1420
\# - WG\_ALLOWED\_IPS=192.168.15.0/24, 10.0.1.0/24
\# - WG\_PERSISTENT\_KEEPALIVE=25
\# - WG\_PRE\_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt
\# - WG\_POST\_UP=echo "Post Up" > /etc/wireguard/post-up.txt
\# - WG\_PRE\_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt
\# - WG\_POST\_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt

image: ghcr.io/wg-easy/wg-easy
container\_name: wg-easy
volumes:
\- etc\_wireguard:/etc/wireguard
ports:
\- "51820:51820/udp"
\- "51821:51821/tcp"
restart: unless-stopped
cap\_add:
\- NET\_ADMIN
\- SYS\_MODULE
sysctls:
\- net.ipv4.ip\_forward=1
\- net.ipv4.conf.all.src\_valid\_mark=1
  cloudflared:
   image: cloudflare/cloudflared:latest
   container\_name: wg\_cloudflared
   restart: always
   command: "tunnel --no-autoupdate run --token MYTOKEN"
   \# the token is created with ZeroTrust > Tunnels and specific to
this subdomain
   volumes:
\- ./cloudflared:/etc/cloudflared
   depends\_on:
\- wgeasy

----------------------------------------------------------------------
Square_Lawfulness_33 · 2023-12-22 14:29

???? if he use Cloudflare then it would be the same in regards to not
being able to see his public IP.

----------------------------------------------------------------------
-C8H10N4O2- · 2023-12-23 02:15

Oh okay. I thought Cloudflare tunnel would just provide access to the
home server without having to bother about port forwarding and then
they could use wg-easy for the VPN access.


Thanks. Will check out Headscale

----------------------------------------------------------------------
Square_Lawfulness_33 · 2023-12-23 02:18

Cloudflare tunnel is similar to a vpn so your not port forwarding
Cloudflare is the server and your local server is the client.