this post was submitted on 24 Feb 2025
15 points (100.0% liked)

Selfhosted

42858 readers
2177 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud
Loki
CannaVet
devve
HybridSarcasm
[email protected]
15
How do I point a reverse proxy to a VPN client on my VPS? (sh.itjust.works)
submitted 15 hours ago by [email protected] to c/selfhosted
20 comments fedilink hide all child comments
 

I have a few things that I host from my house. I have read that it's better practice to route stuff through a VPS to not expose your home IP.

Here's what I've done so far: VPN setup on VPS with successful routing of containers. Confirmed by using a CLI IP check within the container which returned the VPS IP. I used PiVPN because I know it and it's easy to set up.

Where I got stuck: I pointed Nginx to the supposed IP:port of the connection, but couldn't get it to load.

What should I do next?

all 21 comments
sorted by: hot top controversial new old
[–] [email protected] 3 points 11 hours ago* (last edited 11 hours ago) (1 children)

This part always confuses me, so I won't be able to give specifics; just a general direction. Most guides explain how to route traffic from a vpn client to the lan of the vpn host. You need to route traffic from the vpn host/lan to a client of the vpn.

You need to change the routing table on the VPS, adding a static route to route traffic heading for your VPNs subnet to the VPN host instead of out the default gateway.

How exactly to do that I'll have to leave to someone else unfortunately. Network config confuses the hell out of me.

[–] [email protected] 3 points 10 hours ago

Network config confuses the hell out of me.

haha same 🥲

[–] [email protected] 1 points 11 hours ago

Are the ports on your home firewall open? You need to use the public IP of your home router, open the required ports on the router (you can limit them to accept the incoming request from your VPS IP), and map them to a specific local device IP address and port on your router

[–] [email protected] 1 points 11 hours ago* (last edited 11 hours ago)

I am not sure what the problem here is but just want to make sure you realize that if you were to do that, all the requests won’t be directly going to your home server, but they will be routed via your VPS. So the performance will be hit by quite a bit, depending on the ping to the VPS and the VPS upload and download speeds. It’s a very privacy focused approach and you probably don’t need that.

The only benefits you get are that if you browse the web and someone gets your IP, you won’t be able to be matched with your domain’s IP, and that the feds won’t be able to match your public services with your home network (and you in the result).

Otherwise you shall be good just making sure that the ports you expose on your router are the Nginx ones, and won’t experience increased latency on all your requests this way.

[–] Windex007 2 points 14 hours ago

May or may not be applicable to your case, but often applications need additional configuration to work with a reverse proxy. Usually setting from what IPs it will accept forward headers from (your reverse proxy) and what the original requested host was (externally requested domain, eg: yourservice.yourdomain.com)

If your new setup has resulted in changes to either of those things, the issue might be a now-incorrect config of your apps behind the reverse proxy.

[–] [email protected] 2 points 14 hours ago (1 children)

VPN setup on VPS with successful routing of containers. Confirmed by using a CLI IP check within the container which returned the VPS IP

If you want to route traffic from the VPS over the VPN, and the check returned the IP address of the VPS, this confirms it is not working. You need to configure your VPS to route traffic over the VPN. Personally, I've done this in the reverse direction (routing local qbittorrent to a public VPN) with gluetun.

[–] [email protected] 3 points 14 hours ago (1 children)

I think you got it reversed. I want the container traffic to go through the VPN to the VPS and I want the reverse proxy on the VPS to point to that container.

I want the website (hosted at my house) to be accessible through the VPS so my IP isn't directly exposed.

[–] [email protected] 2 points 14 hours ago (2 children)

You've confirmed I've understood it correctly. Someone on the Internet requests your site. They reach your VPS with nginx. So far so good. Now, how does nginx know how to reach the upstream service?

[–] [email protected] 1 points 12 hours ago (1 children)

The goal is to route the services through the VPN and point Nginx to them... but it doesn't work.

[–] [email protected] 2 points 11 hours ago (1 children)

Right. How are you routing traffic from nginx?

[–] [email protected] 1 points 10 hours ago (1 children)

For the services already hosted by the VPS, I just point service.web.site to the appropriate localhost:port.

My hiccup is that the VPN software (pivpn) gives me an internal IP for the clients but pointing Nginx to that IP doesn't work.

[–] [email protected] 1 points 9 hours ago

The nginx host is the VPN client in this case, so it'd be connecting to itself. You need to point it to the host on the VPN server side network.

[–] 69420 2 points 15 hours ago (1 children)

I'm assuming that you are trying to proxy an http web server. If not, you're going to have a hard time with nginx. Can you post your nginx config? Are you getting any response from nginx at all?

[–] [email protected] 1 points 15 hours ago* (last edited 15 hours ago) (2 children)

Nginx was already set up and working before. I have some sites hosted directly on the VPS as well.

I'm just not sure how to make a http request go to a VPN client

[–] [email protected] 1 points 8 hours ago

By using its ip:port

If you have homeserver1 running stuff and that’s connected to the vps through vpn you make sure your homeserver1 service that you want to proxy runs on the homeserver1’s vpn ip.

For docker this is done by specifying that ip when you expose ports or use 0.0.0.0

I assume you can already ping homeserver1 from the vps by using the vpn address of homeserver1

[–] 69420 5 points 14 hours ago

Assuming your local service is accessible from the nginx server, you can proxy the request to it:

server {
  listen 80;
  location / {
    proxy_pass http://10.100.100.2:3000/;
  }
}

...where 10.100.100.2 is your local IP on the VPN and 3000 is the local port your service is listening on, and 80 is the public port your nginx server listens on. Everything that hits your nginx server at http://yourserver.com:80/ will proxy back to your local service at http://10.100.100.2:3000/. Depending on what you're hosting, you may need to add some things to the config.

[–] just_another_person -2 points 14 hours ago (1 children)

Unless your VPN provider supports static port mapping, this is not going to work.

[–] [email protected] 2 points 12 hours ago (1 children)

The VPN is hosted on the VPS, which I rent and have full control of. It's my own VPN between my devices.

The intent is to put my VPS between my services and the outside world so that it doesn't expose my home IP.

[–] just_another_person -3 points 11 hours ago* (last edited 11 hours ago) (1 children)

Okay...back up a bit.

You have a VPS server hosted somewhere...so which IP are you trying to obfuscate with a VPN?

Why don't you just host your public services on the VPS, and whatever else private on your home equipment.

[–] [email protected] 2 points 10 hours ago

which IP are you trying to obfuscate with a VPN?

My goal was to hide my home IP by routing everything through the VPS. The VPN is hosted on the VPS.

Why don't you just host your public services on the VPS, and whatever else private on your home equipment.

The VPS is 1 core and 35 GB of storage. I host several websites and some game serves on my home server.