I wanted to be able to connect to my home computer (remote desktop access software) from elsewhere, but I didn’t want to open any ports to the outside world. And even if I did open a port it wouldn’t work for long because my ISP uses dynamic IP addressing. One way to fix this is Dynamic DNS, but a more secure solution is to use an encrypted tunnel between both machines. With a bounce server this doesn’t require opening any ports at either end, making it a useful for reaching systems behind CGNAT (Carrier Grade NAT) where port-forwarding is not possible. This brief page describes using wireguard for this purpose.
I have a client which moves around the world with me, I’ll call this “Laptop”. I have a client which stays at home and doesn’t move, I’ll call this “Desktop”. To bridge these together I need a bounce server, I’ll call this “VPS”. This need to have a static IP address and allow a port to be opened. I used a free cloud VPS, minimal performance is easily enough.
Wireguard needs to be installed on all three machines. I don’t recall if I used the same version on each, probably not, but that would likely be a good idea.
For each machine you need to create a private and public key, wireguard has a utility for this. You don’t need any files, just the string of text produced. You can save time and create all 3 sets on one machine and paste the contents into the config files as required.
You then need to create wireguard configs for the two clients and the
server. The configs define an interface and one or more peers. The
server’s interface has a listen port. All peer sections define
AllowedIPs which dictates which packets can be routed to
that peer based on IP. The clients have an Endpoint key for
supplying the public IP and port of the server. You also need
PersistentKeepalive to keep the connection running,
otherwise NAT might not stay open - blocking packets from the server to
a client.
I ended up with configs like this:
VPS
[Interface]
Address = 10.11.12.1/32
ListenPort = 51820
PrivateKey = ====vps-key-private====
[Peer]
PublicKey = ====laptop-key-public====
AllowedIPs = 10.11.12.13/32
[Peer]
PublicKey = ====desktop-key-public====
AllowedIPs = 10.11.12.14/32Desktop
[Interface]
Address = 10.11.12.14/32
PrivateKey = ====desktop-key-private====
[Peer]
Endpoint = 145.241.238.21:51820
PublicKey = ====vps-key-public====
AllowedIPs = 10.11.12.0/24
PersistentKeepalive = 25Laptop
[Interface]
Address = 10.11.12.14/32
PrivateKey = ====laptop-key-private====
[Peer]
Endpoint = 145.241.238.21:51820
PublicKey = ====vps-key-public====
AllowedIPs = 10.11.12.0/24
PersistentKeepalive = 25The /24 in 10.11.12.0/24 is important as
this enables client to routing via the bounce server, instead of
connecting only to the server.