this post was submitted on 13 Aug 2023
23 points (84.8% liked)

Selfhosted

39893 readers
354 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
 

My question is fairly straightforward: I've got wireguard set up on my home network, and I'm really happy with it, but I also got a paid VPN service as well for privacy reasons.

The paid VPN i got is Mozilla VPN (which in theory uses wireguard as well).

My goal would be that I have my own VPN through which I can access my home network, and the paid VPN on top of it, which "forwards" the outbound traffic.

Is there a way to do this? Anyone has any experience with this?

all 6 comments
sorted by: hot top controversial new old
[–] [email protected] 8 points 1 year ago (1 children)

It's extremely easy to do if both the server and client are using wireguard. Just add FwMark = 42 to both interfaces (the exact numeric value doesn't matter). This way, internet requests will go through the paid VPN provider and local requests will be working too.

If not, good luck with iptables.

[–] [email protected] 4 points 1 year ago* (last edited 1 year ago)

Not too hard to do with wireguard. You have to split traffic, because if you tunnel all traffic to the paid VPN, you can only access it by pointing at the IP address of that paid VPN so it doesn't really help. If youre using firefox VPN, it's just a private labelled Mullvad VPN, so no port forwarding so this wouldn't work at all.

So what you have to do is allow your home machine running the wireguard server you use to connect to your home network accept direct connections from your devices. Then all outbound connections tunnel to your paid VPN. It's a bit convoluted but there are plenty of walkthroughs online as to how to set up your firewall and network rules and wireguard configs to do it. You'll be working with iptables and then traffic splitting with wireguard.

[–] [email protected] 3 points 1 year ago* (last edited 1 year ago)

If you have a router like OPNsense/PFsense (but I think that OpenWRT can do that too, I've never used it) you can forward all your home traffic to Mozilla VPN so that when you connect home with your home VPN you can reach your LAN services and at the same time Internet through Mozilla VPN.

But if you have a routed Android smartphone (or a PC), you should enable both VPN allowing LAN only traffic through your home VPN and all the rest (you can use this to calculate the subnets) through Mozilla VPN.

[–] [email protected] -5 points 1 year ago

What is this, a low stakes Inception remake?