[Faw]

My ISP has a Carrier Grade NAT so accesing my server/NAS from outside is not possible unless I get a static IP. Asked them for a public dynamic IP but still waiting. Meanwhile I found this (https://github.com/mochman/Bypass_CGNAT) which uses Wireguard to bypass the CGNAT.

This is the server config (which redirects ports to client):

[Per Yngve Berg]

You don't need any port forwarding with VPN, but should be able to access the local servers with their private IP addresses directly.

For a site-to-site VPN, you need 3 sub-nets (LAN A, LAN B and the VPN tunnel)


Put a Wiregard client on your laptop.

Laptop (WG client)->VPS(WG Server)->dd-wrt (WG Client)

[Faw]

[Per Yngve Berg]

AllowedIPs = 10.1.0.2/32

You have to add the LAN network of the dd-wrt router here.

[egc]

When posting it is always helpful to state router model and build number.

To get the best out of DDWRT and the forum read the forum guidelines with helpful pointers:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

If you have not already read the forum guidelines, please do !!

As Per Ingve said if you want to connect to your network from outside you can make a site-to-site setup.

Your DDWRT router connects via WG to your VPS.
A client on the internet e.g. your phone also connects via WG to your VPS and your VPS connects those two.

For that you do not need any port forwarding as the networks are connected via routing.

Of course you can open a port on your VPS and redirect that to your router but for that too you do not need port forwarding on the router as it is already connected in site-to-site setup to the VPS.

To give an example, your VPS is 192.168.1.1 and your router is 192.168.2.1 the site-to-site setup sets up routing between those and you can port forward a port on your VPS to 192.168.1.1 i.e. to your router or to an other client on your routers network.

WG documentation see the links in my signature.

[Faw]

[Per Yngve Berg]

Run a reverse proxy on the VPS that fronts the web sites on your home server.

nginx can be used as a reverse proxy.

[egc]

[Faw]

[egc]

Hmm, I see your problem.

But if you can open a port then the packets arrive at your vps and then what?

I hope there is a terminal and you can use iptables to forward the packets.

A port forward is nothing more then opening a port and a DNAT rule.

If that is not possible then follow @Per Yngve Berg's advice

[SunSkyPi]

I am also trying to get a WG server setup behind CGNAT (Starlink and TM Home Internet), goal is a ddwrt client B could tunnel to WG Server C behind CGNAT via a VPS then out to Internet via Server C, basically client B VPN to Server C so have IP address of Server C:

ddwrt (WG client B) -> VPS (WG Server A )-> CGNAT -> dd-wrt (WG Server C )-> CGNAT internet Server C IP address

Following github guide at start of post: https://github.com/mochman/Bypass_CGNAT

This looks like the case in WG Advanced Network guide of Site-to-Site between multiple sites Hub and Spoke, and the router behind CGNAT needs to become a client, and now need to facilitate traffic from Client B to Client C through VPS:

ddwrt Client B -> ddwrt Server A -> CGNAT ddwrt Client C

But in my case for Sever A using Oracle Cloud VPS WG instead of ddwrt:

ddwrt Client B -> VPS WG Server A -> CGNAT ddwrt Client C

My question is to get client B traffic to exit at Client C (so client C is like a Server) how do I set that up? Following the ddwrt guide would It be similar to this:

Allowed IPs
Client B: [WG IP address of C]/32
Client C: [WG IP address of A]/32 or should it be just [WG IP address of B]/32?

On Server A have two peer (default same as guide?):

Peer B Allowed IP's:
Only allow the IP address of the tunnel of site B and site's B subnet
[WG IP address of B]/32, [subnet of B]

Peer C Allowed IP's:
[WG IP address of C]/32, [subnet of C]

Thank you,
SP