I want to move away from Cloudflare tunnels, so I rented a cheap VPS from Hetzner and tried to follow this guide. Unfortunately, the WireGuard setup didn’t work. I’m trying to forward all traffic from the VPS to my homeserver and vice versa. Are there any other ways to solve this issue?
VPS Info:
OS: Debian 12
Architecture: ARM64 / aarch64
RAM: 4 GB
Traffic: 20 TB
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
Can you post your WG config (masking the public IPs and private key if necessary)?
With wireguard, the
allowed-ips
setting is basically the routing table for it.Also, you don’t want to set the endpoint address (on the VPS) for your homeserver peer since it’s behind NAT. You’ll only want to set that on the ‘client’ side. Since you’re behind NAT, you’ll also want to set the persistent keepalive in the client peer so the tunnel remains open.
Hi, thank you so much for trying to help me, I really appreciate it!
VPS
wg0.conf
:Homeserver
wg0.conf
:(REDACTED would’ve been the public / private keys, SERVER_IP would’ve been the VPS IP.)
On the surface, that looks like it should work (assuming all the keys are correct and 51820/udp is open to the world on your VPS).
Can you ping the VPS’s WG IP from your homeserver and get a response? If so, try pinging back from the VPS after that.
Until you get the bidirectional traffic going, you might try pulling out the iptables rules from your wireguard script and bringing everything back up clean.
I do not get a response when pinging the VPS’s WG IP from my homeserver. It might have something to do with the firewall that my VPS provider (Hetzner) is using. I’ve now allowed the port
51820
on UDP and TCP and it’s still the same as before… This is weird.I’m not familiar with Hetzner, but I know people use them; haven’t heard any kinds of blocks for WG traffic (though I’ve read they do block outbound SMTP).
Maybe double-check your public and private WG keys on both ends. If the keys aren’t right, it doesn’t give you any kind of error; the traffic is just silently dropped if it doesn’t decrypt.
Hmm, the keys do match on the two different machines. I have no idea why this doesn’t work…
Dumb question: you’re starting wireguard right? lol
In most distros, it’s
systemctl start wg-quick@wg0
wherewg0
is the name of the config file in/etc/wireguard
If so, then maybe double/triple check any firewalls / iptables rules. My VPS providers don’t have any kind of firewall in front of the VM, but I’m not sure about Hetzner.
Maybe try stopping wireguard, starting a netcat listener on 51820 UDP and seeing if you can send to it from your homelab. This will validate that the UDP port is open and your lab can make the connection.
I do know this is possible as I’ve made it work with CG-NAT on both ends (each end was a client and routed through the VPS).
The command you provided for the VPS returns
UDP listen needs -p arg
, so I just added-p
right before the port number and then it worked. Running the homelab command returnsno port[s] to connect to
… Not good.At least that points you to the problem: firewall somewhere.
Try a different port with your netcat test, perhaps? 51820 is the well-known WG port. Can’t imagine they’d intentionally block it, but you never know.
Maybe Hetzner support can offer more guidance? Again, I’m not sure what or how they do network traffic before it gets to the VM. On all of mine, it’s just a raw gateway and up to me to handle all port blocking.
If you figure that part out and are still stuck on the WG part, just shoot me a reply.