I have two machines running docker. A (powerful) and B (tiny vps).

All my services are hosted at home on machine A. All dns records point to A. I want to point them to B and implement split horizon dns in my local network to still directly access A. Ideally A is no longer reachable from outside without going over B.

How can I forward requests on machine B to A over a tunnel like wireguard without loosing the source ip addresses?

I tried to get this working by creating two wireguard containers. I think I only need iptable rules on the WG container A but I am not sure. I am a bit confused about the iptable rules needed to get wireguard to properly forward the request through the tunnel.

What are your solutions for such a setup? Is there a better way to do this? I would also be glad for some keywords/existing solutions.

Additional info:

  • Ideally I would like to not leave docker.
  • Split horizon dns is no problem.
  • I have a static ipv6 and ipv4 on both machines.
  • I also have spare ipv6 subnets that I can use for intermediate routing.
  • I would like to avoid cloudflare.
    • raldone01@lemmy.worldOPEnglish
      2·
      10 months ago

      Looks nice. I think I will build two docker containers with wireguard and iptables. This blog will be a great help.

    • raldone01@lemmy.worldOPEnglish
      2·
      10 months ago

      Wow this may have been the missing piece to get my setup working. If I manage to do it will send you an URL to a git repo.

      • lone_faerieEnglish
        2·
        10 months ago

        Awesome! I’m glad I could help. Good luck! I’ve been spending quite a bit of time figuring out how to get this to run alongside other services. I think I just need to add an extra iptables rule to ignore port 443 so https requests will go through traefik first.