#wireguard #haproxy #homelab

Up until today I had an SSH reverse proxy (autossh) running for routing traffic from the Internet to my applications in the homelab. That was a poor mans solution which worked fine for most of the time. See Slide 6.

After reading Thibaults blog post A cheap VPS is a good front I decided to ditch the SSH reverse proxy in favor of a proper Wireguard connection.

As in the previous implementation, the ingress network traffic flows through a jumphost in the cloud. I still use the Oracle cloud free tier, it works reliably for my purposes.

To accept the network traffic on the jumphost, I installed a second HAProxy instance, which does simple “tcp passthrough” to the actual router (also a HAProxy, on LXC) in the internal network.

• The amd64 node on the internal network is the “Wireguard client peer”
• The jumphost on Oracle Cloud is the “Wireguard server peer”

I have PersistentKeepalive setup with 25 seconds as suggested to keep the tunnel alive. Wireguard connection is established from the internal network to the jumphost, as was the case for the SSH reverse proxy.

Jumphost HAProxy example config:

backend haproxy_lan_http
    server               haproxy $wg0:80 check send-proxy-v2
backend haproxy_lan_https
    server               haproxy $wg0:443 check send-proxy-v2
backend haproxy_lan_ssh
    server               haproxy $wg0:22 check send-proxy-v2

LXC HAProxy example config (internal network):

frontend httpfront
    bind                 :80 accept-proxy
    ...
frontend httpsfront
    bind                 :443 accept-proxy
    ...
frontend sshfront
    bind                 :22 accept-proxy

The proxy protocol allows me to see the real/original IP in the Anubis logs.

Instead of connecting the jumphost with the internal network via SSH reverse proxy (autossh), I now route the ingress through the Wireguard overlay network. I create Wirguard keypairs for each relevant node to establish connections.

I hope these kind of descriptions encourage you on your own self-hosting and homelab journeys 😁