Quick VPN Setup with AWS Lightsail and WireGuard

I have a vps as the wireguard "hub" with my phone, DNS and internal services being the spokes. I don't route traffic through home, but I do use home DNS as adblocker on the go. DNS also does the split horizon to route the phone to internal services over wg.

I would strongly recommend switching from iptables to nftables -- drastically reduces wtfs/minute metric during the configuration.

If you'd like -- I can send you the relevant parts of the firewall settings with some comments. My email is in the profile.

First off...wow. Never expected this to hit front page. Just started writing and trying to get the juices flowing.

You could totally use an Ansible playbook. I've used a lot of them over the years. Ansible, Terraform, Salt, Chef, Puppet, etc... As I said at the end of the article I glossed over a lot of things and the beauty of tech is there are lots of ways to do things. Do what works for you. Tradeoffs all over the place.

I do think that shell scripts provide lower level insight to people that may be trying to understand what is going on rather than the magic of something like Ansible that abstracts things away. Or maybe I'm just old school :D

I've long given up hosting my own VPN on VPC/cloud providers as means of cheap and quick "browser in another country" hack - so many things block access to known VPC/cloud IP address ranges, especially AWS, and I was previously an advocate for just throwing up a cheap self-run VPN container somewhere too.

The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a residential IP in the target country - this can be a vast quality of life improvement for many browsing scenarios.

~5-6 years ago a self-hosted VPN exit node in AWS worked so much better than today in my experience, so many services have since added IP range blocks. This really matters for the common use case of trying to access TV streaming services in other countries, as one example.

I still run a private WireGuard setup at home to take advantage of my personal residential IP, but that's only good for content in my home country naturally - still handy when traveling, or to get more secure access on public wifi.

Since you’re just asking for concepts I can take a probably wrong guess that might lead you to something useful with some googling. (I’ve done stuff like this a lot, but not lately and this is all from memory.)

The problem you’re trying to solve is basically one of routing. You have a packet leaving your phone to the internet, and you want it to route it through the VPS, from VPS to SBC, SBC to your home router, then out to the internet. Start from one end and figure out each step.

From your phone, you basically just need your wireguard config to specify 0.0.0.0/0 in the allowed IPs. That will specify that all traffic should go to the peer. So that’s the easy part down.

Next is you need your VPS to route all traffic out through the tunnel to your SBC. You’ll need to enable IP forwarding, then you’ll need to set up the routes to accomplish this. You can’t just globally route 0.0.0.0/0 otherwise your VPS will no longer be connectable. All the traffic coming in via the wireguard interface from your phone will need to be marked via iptables’ fwmark to use a separate routing table (actually wireguard may do this by default…). So that table is where you’ll need to configure a route for 0.0.0.0/0 to your SBC as the next hop. Otherwise you just need to make sure you have allow rules in place on the forward chain to permit the packets to pass.

Once it hits your SBC, it gets easier. It needs IP forwarding enabled. Depending on whether you want to use double NAT or not you can do this a couple of ways. One is to set up masquerading/NAT and call it a day. The other is to, again, simply allow it to forward the packets along (passing them to your home router) and let your router handle the NAT.

The difference between the approaches will mostly play into how you set up all the reverse routes. As long as you can add routes to your home router, you can add a route for your wireguard range(s) to be routed through the SBC and it _should_ cooperate. If your router doesn’t allow you to set up routing like this, you’ll need to do the NAT on your SBC.

Then reverse route from SBC to VPS for wireguard range. (Can control this through the AllowedIPs in the wireguard config.) Your VPS shouldn’t need any extra work because it’s directly connected to your phone.

And you’re done! Maybe! Good luck!

I'm not sure I fully understand your setup or what you are trying to accomplish so apologies beforehand if I misunderstand.

One option would be to host the wg server on your SBC (guessing a raspi or something like it?) and make the VPS a peer thus routing everything out your home network. You can also use AllowedIPs to only route specific ranges on the wg network which allows other traffic to follow the route tables on that device and exit accordingly.

But if what you are asking is how do you have different peers on a wg network route their traffic out to the internet on various different peers you're going to need to get fancy with routes/iptables/virtual network interfaces/policy based routing using PostUp commands.

Hopefully that gives you something to go on.