example wg cfg

[proxmoxer]

write ip route show default to get device e.g. eth0 or ens1, etc

/etc/nftables.conf

Code: Select all

#!/usr/sbin/nft -f

flush ruleset

define WAN = eth0
define HOME_WG = 10.50.0.2

table inet filter {
    chain input {
        type filter hook input priority filter;
        policy drop;

        iifname "lo" accept
        iifname "wg0" accept

        ct state established,related accept

        # SSH to VPS itself
        tcp dport 22 accept

        # WireGuard
        udp dport 51820 accept

        # Ping
        ip protocol icmp accept
    }

    chain forward {
        type filter hook forward priority filter;
        policy drop;

        ct state established,related accept

        # Home server -> Internet
        iifname "wg0" oifname $WAN accept

        # VPS:2273 -> Home:2273
        iifname $WAN oifname "wg0" ip daddr $HOME_WG tcp dport 8006 accept

        # HTTP/HTTPS
        iifname $WAN oifname "wg0" ip daddr $HOME_WG tcp dport { 80, 443 } accept

        # TCP/UDP service range
        iifname $WAN oifname "wg0" ip daddr $HOME_WG tcp dport 30111-32575 accept
        iifname $WAN oifname "wg0" ip daddr $HOME_WG udp dport 30111-32575 accept
    }

    chain output {
        type filter hook output priority filter;
        policy accept;
    }
}

table ip nat {
    chain prerouting {
        type nat hook prerouting priority dstnat;
        policy accept;

        # SSH to home server
        iifname $WAN tcp dport 8006 dnat to $HOME_WG:8006

        # HTTP/HTTPS
        iifname $WAN tcp dport 80 dnat to $HOME_WG:80
        iifname $WAN tcp dport 443 dnat to $HOME_WG:443

        # Preserve port numbers
        iifname $WAN tcp dport 30111-32575 dnat to $HOME_WG
        iifname $WAN udp dport 30111-32575 dnat to $HOME_WG
    }

    chain postrouting {
        type nat hook postrouting priority srcnat;
        policy accept;

        # Home outbound appears as VPS public IPv4
        oifname $WAN ip saddr $HOME_WG masquerade
    }
}

/etc/wireguard/wg0.conf
[Interface]
Address = 10.50.0.1/24
ListenPort = 51820
PrivateKey = vps_priv_key
PostUp = tc qdisc replace dev wg0 root cake bandwidth 450mbit besteffort rtt 200ms
PreDown = tc qdisc del dev wg0 root 2>/dev/null || true

[Peer]
PublicKey = home_srv_pub_key
AllowedIPs = 10.50.0.2/32



nano /etc/sysctl.d/99-wireguard-router.conf
add: net.ipv4.ip_forward=1