📖Vds Relay And Home Server

THIS DOCUMENT IS AI GENERATED, NEEDS REDACTION

Home Server Relay Setup via VDS

This document summarizes the complete setup for using a cheap VDS as a secure, DPI-proof relay for a home server, while preserving the real client IP address for HTTP/HTTPS services.

1. AmneziaWG Tunnel (DPI Bypass)

Standard WireGuard is easily blocked by Deep Packet Inspection (DPI). We use AmneziaWG to obfuscate the handshake.

  1. VDS (Debian) Setup

  • Install tools: sudo apt install amneziawg -y
    Generate keys and create /etc/wireguard/wg0.conf.
    Add obfuscation parameters under [Interface]: 

    Jc = 4
Jmin = 50
Jmax = 1000
S1 = 17
S2 = 38
H1 = 1
H2 = 2
H3 = 3
H4 = 4

    Use -I 1 in PostUp rules to force them to the top of the firewall chain, preventing them from being overwritten: 

    PostUp = iptables -I INPUT 1 -i %i -j ACCEPT; iptables -I FORWARD 1 -i %i -j ACCEPT; iptables -I FORWARD 1 -o %i -j ACCEPT; iptables -t nat -I POSTROUTING 1 -o eth0 -j MASQUERADE
PostDown = iptables -D INPUT -i %i -j ACCEPT; iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

    Enable IP forwarding: echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
    Start service: sudo systemctl enable --now awg-quick@wg0

  1. Home Server (Fedora) Setup

  • Install tools via COPR or compile from source: sudo dnf install amneziawg-dkms amneziawg-tools -y
    Create /etc/wireguard/wg0.conf with matching keys and the exact same obfuscation parameters under [Interface].
    Add PersistentKeepalive = 25 under [Peer] to prevent NAT timeouts.
    Start service: sudo systemctl enable --now awg-quick@wg0

2. HAProxy Relay (VDS)

HAProxy acts as a lightweight Layer 4 TCP relay, forwarding traffic to the home server while injecting the PROXY protocol header to preserve the real client IP.

  1. Install: sudo apt install haproxy -y

  2. Configure /etc/haproxy/haproxy.cfg: 

  • global
log /dev/log local0
maxconn 4096
user haproxy
group haproxy
daemon

defaults
log     global
mode    tcp
option  tcplog
option  dontlognull
timeout connect 5s
timeout client  30s
timeout server  30s

frontend http_in
bind *:80
default_backend http_home

backend http_home
server home_server 10.0.0.2:80 send-proxy

frontend https_in
bind *:443
default_backend https_home

backend https_home
server home_server 10.0.0.2:443 send-proxy

    Note: Use send-proxy (v1 text format), not send-proxy-v2.

  1. Restart: sudo systemctl restart haproxy

  2. Open firewall: sudo ufw allow 80/tcp and sudo ufw allow 443/tcp

3. Caddy Web Server (Home Server)

Caddy handles Auto-HTTPS, routing, and reads the PROXY protocol header. The critical fix is explicitly trusting the VDS IP using the allow directive, and separating the :80 and :443 listener wrappers to avoid Auto-HTTPS parsing bugs.

  1. Install: sudo dnf install 'dnf-command(copr)' -y && sudo dnf copr enable @caddy/caddy -y && sudo dnf install caddy -y

  2. Configure /etc/caddy/Caddyfile: 

  • {
servers :80 {
listener_wrappers {
proxy_protocol {
allow 10.0.0.1
}
}
}
servers :443 {
listener_wrappers {
proxy_protocol {
allow 10.0.0.1
}
tls
}
}
}

http://wiki.mojosa.su {
redir https://{host}{uri}
}

wiki.mojosa.su {
log {
output file /var/log/caddy/access.log
format console
}

# Replace with your actual service:
# reverse_proxy localhost:8080
respond "Success! Real IP: {http.request.remote.host}" 200
}

  1. Ensure log directory permissions: sudo mkdir -p /var/log/caddy && sudo chown caddy:caddy /var/log/caddy

  2. Restart: sudo systemctl restart caddy

4. Firewall & Final Checks

  1. Home Server (Fedora): Allow traffic only through the WireGuard tunnel.

  • sudo firewall-cmd --permanent --zone=trusted --add-interface=wg0
    sudo firewall-cmd --reload

  1. Verification: Access the site from a different network (e.g., cellular data). The response and /var/log/caddy/access.log should show your real public IP, not 10.0.0.1.