Wireguard easy and third party von service.

Submitted ⁨⁨4⁩ ⁨days⁩ ago⁩ by ⁨LetchLemon@lemmy.blahaj.zone⁩ to ⁨selfhosted@lemmy.world@lemmy.world⁩

https://lemmy.blahaj.zone/pictrs/image/1130b707-9a1b-4d21-baed-9a5f16daf265.webp

Hi, so been working on this for a week but not really happy with the solutions I find as they seem to be done by induviduals who rely heavily on ai. I got wireguard easy going and can remotly connect which is great but id love to be able to route any internet traffic to and from the wireguard clients to go though another server while filtering my local onsite services. Felt that if i can crack this i dont need to rely on tailscale.

source

Comments

Sort:hotnew top

pcouy@lemmy.pierre-couy.fr ⁨3⁩ ⁨days⁩ ago
I have a custom made ansible role that does what you are asking for. I’ve wanted to clean it up a bit before putting it up on Github, and your post just gave me a motivation to stop procrastinating it :) This was initially made for my own use, and I’m not an Ansible expert so it can have some rough edges, but I tried my best to make it adhere to the Ansible way of doing things (applying the same role to a host twice should be idempotent).

Using this role, I’m able to quickly define wireguard networks, define which peer participates in which network, optionally configure a peer as a router (with NAT and port forwarding) for a given network. For Ansible-managed hosts, it installs wireguard, generates and deploys wireguard configurations, and enables IP forwarding on exit nodes. It can also generate ready-to-deploy wireguard configurations for externally managed hosts.

The repo is at github.com/pcouy/ansible-wireguard . I tried giving some instructions in the readme but they may not be detailed enough. If you try it, please open an issue for anything that’s not clear enough from the readme so I can improve it.

source
- LetchLemon@lemmy.blahaj.zone ⁨3⁩ ⁨days⁩ ago
  Thank you so much! I shall head over and have a look :D
  
  source
- LetchLemon@lemmy.blahaj.zone ⁨3⁩ ⁨days⁩ ago
  Quick question (love your solution btw so eloquent could follow along easily which was such a nice change from the week i have had) does your solution manage multiple clients with different firewall requirements? Why i was heading down the wireguard ui route was the ease of firewall configuration per client. Its a weird thing where i feel headscale is a little bit more than i need and wireguard vanilla is a little too simplistic.
  
  source
  - pcouy@lemmy.pierre-couy.fr ⁨3⁩ ⁨days⁩ ago
    Do you have specific examples of the “different firewall requirements” ?
    
    source
    -> View More Comments
diminou@lemmy.zip ⁨4⁩ ⁨days⁩ ago
You could use headscale. Its the heart of tailscale but in an open source format.

source
- LetchLemon@lemmy.blahaj.zone ⁨4⁩ ⁨days⁩ ago
  I did consider it. But then im still using tailscale ecosystem which as much as i want to they are still an american company.
  
  source
  - opi@lemmy.ca ⁨4⁩ ⁨days⁩ ago
    Just a bit of a nitpik, but tailscale is a Canadian company.
    
    source
    -> View More Comments
- Jason2357@lemmy.ca ⁨3⁩ ⁨days⁩ ago
  Head scale is actually a simpler implementation rather than the heart of what tailscale uses directly. It is perfectly complete for a single persons homelab application IMHO. Would be easy for the community to maintain a fork, but its also good to see other approaches that solve the same problem.
  
  source
skyline2@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
Have a look at self hosted netbird on a VPS. Its free and has very little feature restrictions netbird.io

source
- LetchLemon@lemmy.blahaj.zone ⁨3⁩ ⁨days⁩ ago
  I will tomorrow :) originally i was thinking about it then i got all caught up with wg-easy. Its looked promising when i first looked but it had one or two cavietes that made me decide against it. Will definantly revisit thanks for the suggestion!
  
  source
  - skyline2@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
    Yeah I think the marketing speak for these mesh VPN solutions is confusing. But essentially it seems to me that for most people if they think of a feature they used to use with Tailscale, Netbird has it
    
    source
IratePirate@feddit.org ⁨3⁩ ⁨days⁩ ago
I’ve started working on something very similar ( Client -> Wireguard -> homeserver -> Mullvad -> Internet), but didn’t get too far and saved the project for later. IIRC, I had issues defining more clearly in the post-up / post-down hooks which traffic was supposed to go where. Upon bringing up the tunnel to Mullvad, I’d lose SSH access instantaneously. I’ll watch this thread closely and contribute once I get around to tackle the issue sometime this summer.

source
- LetchLemon@lemmy.blahaj.zone ⁨3⁩ ⁨days⁩ ago
  Yes! Thats the issue im having. I can make wireguard clients connect to mullvad and work butbonce i try to split tunnel through the post up down hooks i get stuck. Glad im not alone there. The conversations here i wonder if there is an issue with (if your using gluetun) iptables and the wireguard easy nftables. But yes so glad im not alone here with the weird fuckery :-)
  
  source
B0rax@feddit.org ⁨4⁩ ⁨days⁩ ago
What router do you have?

For example with a Unifi router you can quite easily create a routing for that.

source
- LetchLemon@lemmy.blahaj.zone ⁨4⁩ ⁨days⁩ ago
  Im picking up what your putting down tho. Be so much easier if i could have a vpn service on a dedicated vlan then just link through with some wg configs but annoyingly my router puts wireguard ontop of the entire topography and messes up everything else.
  
  source
  - BuccaneerScientist@discuss.tchncs.de ⁨4⁩ ⁨days⁩ ago
    I know this don’t the solution you are looking for, but your router sounds like the crappy default one you get from your ISP.
    
    In that case (since you already got this far) consider getting a better one, if not for this, then for the next time it limits your adventures.
    
    I would suggest looking into OpenWrt if you go this route.
    
    source
    -> View More Comments
- LetchLemon@lemmy.blahaj.zone ⁨4⁩ ⁨days⁩ ago
  My router doesnt allow that plus i dont trust routers managing my vpn connections.
  
  source

Decronym@lemmy.decronym.xyz ⁨3⁩ ⁨days⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
DNS	Domain Name Service/System
ISP	Internet Service Provider
NAT	Network Address Translation
SSH	Secure Shell for remote terminal access
Unifi	Ubiquiti WiFi hardware brand
VPN	Virtual Private Network

[Thread #14 for this comm, first seen 15th Jun 2026, 11:10] [FAQ] [Full list] [Contact] [Source code]

source

dan@upvote.au ⁨4⁩ ⁨days⁩ ago

The end goal is to have no reliance on tailscale as i am preparing for the eventual enshitification.

Tailscale is mostly open-source. If they do anything bad then someone could fork the project.

The coordination server isn’t open-source, but you could self-host Headscale as a replacement.

source
nexttech@lemmy.world ⁨3⁩ ⁨days⁩ ago
Is this english that i am reading ? or is it some other language ?

i can’t understand a thing!

source

LetchLemon@lemmy.blahaj.zone ⁨4⁩ ⁨days⁩ ago

Here is the compose and post up im working on

services:
  gluetun:
    image: qmcgaw/gluetun:v3
    hostname: gluetun
    restart: always
    networks:
      wg:
        ipv4_address: 192.168.1.10    
    ports:
      - 51720:51720/udp # wireguard ui
      - 51821:51821 # wireguard tunnel
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
      - VPN_TYPE=${VPN_TYPE}
      - WIREGUARD_PRIVATE_KEY=${PRIVATE_KEY}
      - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
      - SERVER_CITIES=${SERVER_CITIES}
      - ALLOWED_IPS=0.0.0.0/1
      - FIREWALL_OUTBOUND_SUBNETS=${OUTBOUND_SUBNET}$ #change to appropriate subnet
      - DNS_ADDRESS=${DNS}
#      - HEALTH_TARGET_ADDRESS=cloudflare.com:80
#      - HEALTH_VPN_DURATION_INITIAL=120s

  wg-easy:
    environment:
      - INSECURE=true #INITIAL SETUP NOT FOR PRODUCTION
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    restart: unless-stopped
    networks:
      wg:
        ipv4_address: 192.168.1.20 
    
    volumes:
      - ./data:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - 51720:51720/udp #wireguard
      - 51821:51821/tcp #web ui
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1

networks:
  vpn:
    driver: bridge
    enable_ipv6: false
    ipam:
      driver: default
      config:
        - subnet: 192.168.1.0/24 #container ipgateway
#        - subnet: fdcc:ad94:bacf:61a3::/64

Post up

# Detect the VPN bridge interface by wg-easy's container IP
VPN=$(ip -o -4 addr show | awk '$4 ~ /^[[ wg_easy_ip_esc ]]\// {print $2; exit}'); test -n "$VPN";
iptables -P FORWARD DROP;
ip6tables -P FORWARD DROP;
iptables [[ ipt ]] INPUT -p udp -m udp --dport {{port}} -j ACCEPT;
ip6tables [[ ipt ]] INPUT -p udp -m udp --dport {{port}} -j ACCEPT;

# Direct subnets:
ip route -A 10.1.0.0/16 via 192.168.1.0/24 dev $VPN table 200;
ip -6 route -A 10.1.0.0/16 via 192.168.1.0/24 dev $VPN table 200;

source