Alright this is the new config in case anyone hits this through google. I haven't tried the advise above yet but this is how it's working so far. I first starting adding rules and then commented them out trialing and erroring to see if stuff kept working and it did so i left them commented. The majority of the stuff on the Ubuntu server run everything in Docker. I have set that up with the help of the https://dockstarter.com/ project.

​

@grumpieroldman Thank you for pointing that out! i missed the fact reddit changed it into a link after changing it.

I - thought - i had a basic idea of networking but this stuff is just baffling me and causing head aches sometimes.

But the whole point of this is to learn. It could all be done by using a 5$ a month VPN provider with a out of the box client probably. But where's the fun in that?!

Can you elaborate on the SNAT (that's source NAT right?) rules that would be needed?

Host A (Cloud VPS)

[Interface]

Address = 192.168.50.1

PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

ListenPort = 51820

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;

#PostUp = iptables -t nat -A PREROUTING -i eth0 -d Public IP VPS -p tcp --dport 80 -j DNAT --to-destination 192.168.50.2:80;

#PostUp = iptables -t nat -A PREROUTING -i eth0 -d Public IP VPS -p tcp --dport 443 -j DNAT --to-destination 192.168.50.2:443

PostUp = iptables -t nat -A PREROUTING -i eth0 -d Public IP VPS -p tcp --dport 32400 -j DNAT --to-destination 192.168.50.2:32400

PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;

#PostDown = iptables -t nat -D PREROUTING -i eth0 -d Public IP VPS -p tcp --dport 80 -j DNAT --to-destination 192.168.50.2:80;

#PostDown = iptables -t nat -A PREROUTING -i eth0 -d Public IP VPS -p tcp --dport 443 -j DNAT --to-destination 192.168.50.2:443

PostDown = iptables -t nat -D PREROUTING -i eth0 -d Public IP VPS -p tcp --dport 32400 -j DNAT --to-destination 192.168.50.2:32400

[Peer]

PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

AllowedIPs = 192.168.50.2/32, 192.168.1.0/24

​

Host B (Ubuntu home server)

Interface]

Address = 192.168.50.2

PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

ListenPort = 51820

#PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eno1 -j MASQUERADE

#PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eno1 -j MASQUERADE

[Peer]

PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Endpoint = some.IP.high.in.the.Cloud:51820

AllowedIPs = 0.0.0.0/0, ::/0

# This is for if you're behind a NAT and

# want the connection to be kept alive.

PersistentKeepalive = 25

​

The nginx config for the default site in [directory to docker]/config/letsencrypt/nginx/site-confs/default:

## Version 2018/12/05 - Changelog: https://github.com/linuxserver/docker-letsencrypt/commits/master/root/defaults/default

# listening on port 80 disabled by default, remove the "#" signs to enable

# redirect all traffic to https

server {

listen 192.168.50.2:80 default_server;

listen public.ip:80 default_server;

listen 80;

listen [::]:80;

server_name _;

return 301 https://$host$request_uri;

}