Skip to main content

HELP: Wireguard for home network with remote exit node

I am looking for some advice on how to (if possible) setup a wireguard network for my home network and when I am connected to that network have a remote wireguard server act as an exit node, so that all external traffic appears to be coming from that remote server whilst keeping traffic bound for the home network local (only accessible via wireguard network)

Local server is a Debian box and other devices will run a flavour of linux. Remote server is already running wireguard and I can connect to that if I bring up a route on each device, but ideally I want to connect to my home net and automatically have outbound traffic go via the remote server. The remote server's wireguard config is not under my control, which may make this unfeasible

#selfhosted
This entry was edited (1 week ago)
in reply to PortNull

comrade_twisty
comrade_twisty
• •
VPN cascading is the term you’re looking for. Yes, it’s possible with wireguard. Who controls the exit server is not of any concern, although you might break the ToS of the commercial VPN provider in question - but they can’t really see that.
This entry was edited (1 week ago)
in reply to PortNull

null_dot
null_dot
• •

It's not really clear exactly what you want.

When you're at home, and for services running on your home server, it you want everything to go through the remote wireguard server then that's achievable.

However, if you want to be able to access services running on your home server, while you're not at home, via that remote wireguard server, that generally requires port forwarding which commercial providers generally don't offer.

Can you clarify ?

in reply to null_dot

PortNull
PortNull
• •
Sorry to be unclear
Yes I want to be able to access my home services from outside over wireguard, but connect directly into the home network. However once connected to the home network I want all traffic to be routed outside via the remote wireguard server.
This entry was edited (1 week ago)
in reply to PortNull

jubilationtcornpone
jubilationtcornpone
• •

I want to make sure I understand your goal correctly.
Here's what I'm getting.

  1. You have a wire guard connection that you want to use for outbound traffic from your local LAN.
  2. You have a Debian box that serves at the client in this situation.

Here's the part where I'm a little fuzzy

  1. You want to connect to your local LAN using another wire guard connection and have WAN requests routed from clients connecting to your LAN (via wire guard) out the wire guard connection mentioned in #1.

Did I get any part of that wrong?

Edit: NVM. I saw your response to another comment that sounds like this is exactly what you want.

This should be achievable via routing. I actually do the same thing. The main difference is all the work is done on my router which handles both wire guard connections and routing.

At the minimim you're going to need:

  • A NAT rule on your local router to port forward incoming wire guard requests on the WAN to your Debian box. **Assuming the Debian box is also the wire guard server.
  • An iptables DSTNAT rule on your Debian box to route local traffic to the LAN gateway.
  • An iptables DSTNAT rule on your Debian box to route outbound WAN traffic that does NOT originate from your Debian box to the gateway at the other end of the outbound wire guard connection.
This entry was edited (1 week ago)
in reply to PortNull

magikmw
magikmw
• •

You can set this up with your router connecting to the remote server and routing your client traffic through there instead of the gateway your router is using for WAN.

Specifics are router... Specific.

You can do the same with a vm in your network acting as a router or proxy as well, pick your poison.

in reply to PortNull

spaghettiwestern
spaghettiwestern
• •

If I'm understanding what you want to do, I have this set up on an OpenWRT router with multiple remote endpoints used for different devices. Our phones go to a hosted Wireguard server in one city, PCs to an OpenWRT router in a different location, and IOT devices that aren't blocked and guest devices exit access the Internet locally. With some additional work you should also be able to have remote devices connected via WG exit wherever you like.

Policy Based Routing on OpenWRT makes this possible and it should be doable as long as the devices you want to allow to exit the remote server are included in that server's "Allowed IPs" setting. (Maybe there's a way around that, but I haven't had to deal with it.)

This entry was edited (1 week ago)
in reply to PortNull

sem
sem
• •
You could maybe do this with tailscale: all your devices will be reachable from each other, and you can specify that you want the external one to be the exit node. It uses wireguard under the hood.
This entry was edited (1 week ago)
in reply to sem

PortNull
PortNull
• •
The issue is that the remote server (the one I want to use as the exit node) doesn't have tailscale on it. Otherwise I'd be doing just that :D
in reply to PortNull

abeorch
abeorch
•

The one you want to use as an exit node is a commercial vpn provider right?

whatever you want - its pretty much achievable with openwrt, wireguard and some routing (maybe using policy based routing)

Bonus there is a wireguard client app for android that automatically switches off the tunnel back to your home server if you are on its Lan. Its called WG Wireguard.

Selfhosted reshared this.

in reply to PortNull

PortNull
PortNull
• •
Thank you for everyone's help and input. I have it working now, albeit not in the way I had hoped (not using docker containers for it) but it works. I followed thedevquill.substack.com/p/set… but instead of using the NordVPN image I used the plain Wireguard client image. In the wireguard compose I set network_mode: container:wireguard.
Now when I connect tailscale over the exit node, traffic is going out over the wireguard IP

Setting up a Tailscale Exit Node through NordVPN

Bolting 2 VPNs using Docker and Docker Compose
Jimmy Wei (The Dev Quill)
This entry was edited (1 week ago)
in reply to PortNull

stratself
stratself
• •

Hey, glad you got it working. I'm late to the party, but I got a similar solution here: github.com/stratself/tswg. Basically just mounts your own wg.conf to the container and get Tailscale connected over it

Since Wireguard is peer-to-peer, I suppose the "intended" way is to install Tailscale on every client. But it is possible to use the router as a VPN gateway as per this [OpenWRT guide])openwrt.org/docs/guide-user/se…). Hope you get it working anyhow


GitHub - stratself/tswg

Contribute to stratself/tswg development by creating an account on GitHub.
GitHub
in reply to PortNull

abeorch
abeorch
•
I'm basically doing that with #Openwrt and #Policybaserouting - I've got different wifi ssIds that each have a different default gateway routed via different remote Openwrt routers - I can't say that I have it perfectly configured yet but it works. Internal traffic is routed across the VPNs depending on where the device is located so my server in one location is accessible from computers in the other two locations.
#openwrt #Policybaserouting

Selfhosted reshared this.

⇧