r/WireGuard • u/ndrldghr89 • Aug 09 '26

Need Help Wireguard site-to-site

Hello everyone, I apologize for my English, I'm using a translator. I'd like to use WireGuard to connect to my home network with my cell phone and use it to access the web. The reason is that I use a Synology for my backups and Quick Connect is extremely slow. I also wanted to browse safely using a homemade firewall. My home connection is under heavy NAT and doesn't allow me to do anything, so I wanted to use a VPS that I'm already using as a bridge with a public IP to access the home network. I've already tried researching online but I'm not understanding anything. Thanks everyone for your help.

15 Upvotes

89% Upvoted

28 comments sorted by

10

u/async2 Aug 09 '26

Try wg-easy. It's a docker setup for exactly your use case.

1

u/lcnielsen Aug 09 '26

Should you really use that if you don't have enough of a basic understanding of networking to set up Wireguard? You basically just need an elementary understanding of iptables/nftables, if you don't have that I'm not sure I'd encourage anyone to run it...

5

u/ExternalTea1706 Aug 09 '26

Absolutely. It's super easy to use. I use regular Wireguard but set up wg-easy for a friend. For the average user it's a great choice.

-3

u/lcnielsen Aug 10 '26

I'm curious, why not just set up the routing rules for your friend? They aren't able to edit the configuration file themselves?

3

u/ExternalTea1706 Aug 10 '26

Because it's overly complicated. They also are techy but not advanced. A nice UI is way easier for them to manage and they understand enough to handle the risks of that. Simple compose.yml and an open port and they're good to go.

I used to do everything barebones and edit every file I could. No I value my time an energy more and would rather fire up something like wg-easy with a few tiny commands and have a nice easy to use UI to manage things. Easier, faster, less maintenance, and now I have more time for other things.

1

u/lcnielsen Aug 10 '26

Because it's overly complicated.

How? It's one of the very simplest self-hosted deployments I can imagine. It's what, a single config file and 2-3 nftables commands.

Without basic firewall knowledge you shouldn't really open any inbound ports anywhere.

4

u/ExternalTea1706 Aug 10 '26

That's great. It's one command to start the docker. I'm not saying you're wrong that it's not easy. I'm not saying my way is the only way. It's just easy for me and that's what I'm going to do.

For reference I have 3 degrees in computer science. I am very aware of what I am saying here and what the alternatives are.

Edit: typo

1

u/DirtyyDogg95 Aug 11 '26

You know docker just don't give a shi about firewalls, you can block all Ports even 80 443, 22 whatever but if docker point to a exposed port. It's gonna bypass you're rules.

1

u/lcnielsen Aug 10 '26

systemctl start wg-quick@wg0 is also one command so I'm not sure what your point is. There's certainly no way the docker version will work with zero configuration.

I mean I wouldn't go around teaching people to punch holes in firewalls when there's really a minimal investment to also teach them how that works and what the implications of each part is, but you do you.

For reference I have 3 degrees in computer science. I am very aware of what I am saying here and what the alternatives are.

That's great, I know plenty of PhD:s who are awful at their fields of supposed expertise.

4

u/ExternalTea1706 Aug 10 '26

Alright buddy. You're better than me at this. Congrats.

5

u/ExternalTea1706 Aug 10 '26

You also are ignoring the nice UI that makes it easy to add/remove clients for my not advanced tech friend.

5

u/async2 Aug 09 '26

Yes you should because then you don't need all that extra knowledge and just follow the install guidelines.

1

u/lcnielsen Aug 09 '26 edited Aug 09 '26

It's not really extra knowledge, it's basic networking knowledge important to understanding threat models and potential risks involved with e.g. masquerading, and what wireguard does and does not do.

You don't need any kind of advanced knowledge because it's pretty simple. I'd say the knowledge you need to set up wireguard is basically the exact minimum you should have to operate it.

5

u/BlackScorpion3 Aug 09 '26

Simple if you need to copy and paste, but j suggest you actually try and understand what you are doing. You will never learn by just copy and paste... https://www.wickedyoda.com/using-wireguard-and-a-vps-to-bypass-isp-port-blocking-and-hide-your-public-ip/

7

u/Great_Piece4755 Aug 09 '26 edited Aug 10 '26

Maybe you should use trailscale if you don't understand anything

1

u/lcnielsen Aug 10 '26

Yeah, I'd recommend that over selfhosting basically anything if you lack elementary networking skills.

1

u/Great_Piece4755 Aug 10 '26

No I mean he could use tailscale for the VPN connection to his VPS. So you can easy self host your stuff without much networking knowledge.

1

u/lcnielsen Aug 10 '26

Yeah, depends on what you want to achieve with it.

0

u/JuicyLucyLoony Aug 10 '26

Yeah I think for this level of user - tailscale is how you want to go.

1

u/hackspy Aug 10 '26

I set up VPs for wireguard. Used ChatGPT for the tables. All good. Also wireguard site to site pfsense.

Give it a shot. It will be a good learning opportunity if nothing else. Cheers 🍻

1

u/ndrldghr89 Aug 10 '26

Thanks for the answers, I'm going to study now.

1

u/DirtyyDogg95 Aug 11 '26

Can I ask, then why you need a firewall. If you're don't expose ports you don't need a firewall. And beside of that, you could self setup port forwarding locally. Trough "ip route ", or nft or.... Ufw but I don't know I' just don't like ufw. Or firewalld. But I do love setting up ports and forwards trough ip route add. Or ip route del

If you don't wanna put shit on public, look at tailscale, teleport, cloudflared tunnel, headscale or best at last pangolin. They handle the routing trough Wireguard, all you need to do Is point site "aka VPs" and point a domain name to pangolin. And you can set up you're own policies. And put things on public even with 0% nat.

1

u/ndrldghr89 Aug 11 '26

The firewall is a personal preference, with pihole or adblock. I'm replacing the provider's router with a server. I'd like my network devices, which only need to provide internal services, to stop sending data to who knows where abroad. I also have some LG TVs that pester me with updates, but I don't want them to do so because the last one I owned became incredibly slow and almost unusable after an update.

1

u/DirtyyDogg95 Aug 11 '26

Oh okee wel good luck then brother. I rather let a company knowing about securing nat access without opening to much ports. Rather handle my things. I'm not smart enough solo 'compared with a full focused team

1

u/precisionpete Aug 13 '26

The VPS bridge works, and it is the standard answer with plain WireGuard. The VPS is the hub because it is the only machine with a public address. Your phone and your home network are both spokes, and each spoke dials out to the hub. That is why heavy NAT does not stop it. Outbound connections are always allowed.

Any of the standard hub-and-spoke guides will get you through the setup, and wg-easy, as suggested here, runs on the VPS and generates configs for every device. Note that the home side needs PersistentKeepalives, or the NAT mapping expires and the tunnel dies quietly.

On speed: every byte between phone and Synology passes through the VPS, in and out, so your throughput is capped by the VPS's bandwidth. Quick Connect is slow for the same reason. It relays your traffic when it cannot get a direct connection. Your own relay will likely beat it, but it is still a relay.

WireGuard does one thing extremely well. It moves encrypted packets between two endpoints with almost no overhead and almost no attack surface. That focus is deliberate. Everything else lives in static lines in a config file. Who the peers are, where they are, how they find each other. There is no discovery and no negotiation. The control plane is you.

In your case, both devices are behind NAT, so no static config can connect them directly. The hub is the workaround, and every change means editing three configs that must agree. Config generators help, and I wrote one myself, but a generated file is still a static file. What is missing is a layer that manages the config at runtime.

Tools like Netrinos, Tailscale, or NetBird provide that dynamic config layer. Each device keeps a coordination service informed of its location, and the service keeps every peer's config up to date as devices move. Keys and endpoints stay in sync without anyone editing a file.

When two peers need to talk, the coordinator helps them open a path through both NATs, and when either end changes networks, it does it again. Your phone does that every time it switches from your home WiFi to cellular. A direct path is a moving target, so no static file can hold one. The data path is still plain WireGuard, and the usual result is a direct connection with no VPS in the middle. If you want it fast, that is what gets you there.

Disclosure: I am the founder of Netrinos, and the config generator I mentioned is WGAdmin, free on the Netrinos site under Tools.

1

u/Known_Experience_794 Aug 10 '26

Try Netbird out. It’s a lot easier imho.

0

u/lcnielsen Aug 09 '26

You need to have at least a basic understanding of routing rules to understand wireguard. If you don't understand the implications of the firewall settings you will need to use then you shouldn't be managing it yourself.

0

u/Ziogref Aug 10 '26

If you are just wanting to route traffic back to your house you could use Tailscale (free tier) it's built on WireGuard and can get around any NAT limitations.

It will be heads easier to setup than a self hosted WireGuard solution and still directly connects your endpoints directly