Setting up Nginx Proxy Manager and WireGuard on Debian 12 Proxmox behind CNAT
In this article, we will discuss the process of setting up Nginx Proxy Manager and WireGuard on a home server running Debian 12 Proxmox, which is behind a Carrier-Grade NAT (CGNAT) and therefore does not have a public IP address. To overcome this limitation, we will use a Virtual Private Server (VPS) to get a public IP.
Prerequisites
Before we begin, make sure you have the following:
- A home server running Debian 12 Proxmox
- A VPS with a public IP address
- Access to both servers via SSH
Installing WireGuard
First, we need to install WireGuard on both the home server and the VPS. On Debian 12, you can do this by running the following commands:
sudo apt update
sudo apt install wireguard
Setting up WireGuard
Next, we need to generate the WireGuard keys and configure the WireGuard interface on both servers. Here's how to do it:
On the home server:
umask 077
wg genkey | tee privatekey > privatekey.conf
wg pubkey < privatekey | tee publickey > publickey.conf
On the VPS:
umask 077
wg genkey | tee /etc/wireguard/privatekey
wg pubkey < /etc/wireguard/privatekey | tee /etc/wireguard/publickey
Now, we need to create the WireGuard configuration file on the home server. Replace [VPS\_PUBLIC\_IP] and [HOME\_SERVER\_PRIVATE\_IP] with the actual IP addresses:
/etc/wireguard/wg0.conf:
[Interface]
Address = [HOME\_SERVER\_PRIVATE\_IP]/24
PrivateKey = [HOME\_SERVER\_PRIVATE\_KEY]
ListenPort = 51820
[Peer]
PublicKey = [VPS\_PUBLIC\_KEY]
Endpoint = [VPS\_PUBLIC\_IP]:51820
AllowedIPs = 0.0.0.0/0, ::/0
On the VPS, create the WireGuard configuration file as follows:
/etc/wireguard/wg0.conf:
[Interface]
Address = [VPS\_PUBLIC\_IP]/24
PrivateKey = [VPS\_PRIVATE\_KEY]
ListenPort = 51820
[Peer]
PublicKey = [HOME\_SERVER\_PUBLIC\_KEY]
Endpoint = [HOME\_SERVER\_PUBLIC\_IP]:51820
AllowedIPs = [HOME\_SERVER\_PRIVATE\_IP]/24
Now, start the WireGuard service on both servers and enable it to start at boot:
sudo systemctl start wg-quick@wg0
sudo systemctl enable wg-quick@wg0
Setting up Nginx Proxy Manager
Next, we need to set up Nginx Proxy Manager on a virtual machine (VM) running on the Proxmox host. You can use the official Docker image to do this:
docker run -d --name nginx-proxy-manager \
-p 80:80 \
-p 81:81 \
-p 443:443 \
-v /path/to/data:/data \
-v /path/to/letsencrypt:/etc/letsencrypt \
-e 'db\_host=<
sql
database_host>' \
-e 'db_port=3306' \
-e 'db_user=' \
-e 'db_pass=' \
-e 'db_name=' \
-e 'VIRTUAL_HOST=' \
-e 'LETSENCRYPT_HOST=' \
-e 'LETSENCRYPT_EMAIL=' \
jc21/nginx-proxy-manager
Replace [database_host], [database_user], [database_password], and [database_name] with the actual values for your database. Also, replace [nginx_proxy_manager_domain] with the domain name you want to use for Nginx Proxy Manager, and [your_email] with your email address.
Configuring Nginx Proxy Manager
Once Nginx Proxy Manager is up and running, you can access it by going to https://[nginx_proxy_manager_domain] in your web browser. Log in using the default credentials (admin:changeme), then change the password and configure the proxy host as follows:
- Go to the "Proxy Hosts" tab and click "Add Proxy Host"
- Enter the domain name of the service you want to proxy (e.g.
example.com)
- Enter the IP address of the server running the service (e.g.
[HOME\_SERVER\_PRIVATE\_IP])
- Enter the port number of the service (e.g.
80 for HTTP or 443 for HTTPS)
- Click "Save"
In this article, we have discussed how to set up Nginx Proxy Manager and WireGuard on a home server running Debian 12 Proxmox, which is behind a Carrier-Grade NAT (CGNAT) and therefore does not have a public IP address. By using a Virtual Private Server (VPS) with a public IP, we were able to create a secure tunnel between the home server and the VPS using WireGuard, and then use Nginx Proxy Manager to proxy traffic to services running on the home server.
References