How can I route VPS traffic through WireGuard to Nginx in Docker?

Make sure Nginx Proxy Manager is listening on an address that is reachable from the VPS, not only on 127.0.0.1 or an isolated Docker interface. Test from the VPS with a verbose curl directly to the home machine’s WireGuard IP and port. If that fails, inspect WireGuard routes and firewall rules; if it succeeds but the public request fails, the issue is likely the VPS listener or its forwarding configuration. Docker does not have to run WireGuard inside the same container—the host’s WireGuard interface can be used by the containers as long as the published ports and bindings are correct.

A working WireGuard handshake and ping only prove that the tunnel itself is alive. You still need to route the inbound web ports through it. One straightforward design is to give the home machine a WireGuard address, then run a TCP stream proxy on the VPS that listens on ports 80 and 443 and forwards those connections to the home machine’s WireGuard IP. Nginx Proxy Manager can remain responsible for certificates and host routing at home, while the VPS acts as a simple public-facing relay.

Check the routing direction and AllowedIPs carefully. If the VPS is configured to send all traffic through wg0, it may be disrupting its normal routes. For a reverse-proxy setup, WireGuard on the VPS usually only needs the home network or the specific WireGuard address in AllowedIPs, rather than 0.0.0.0/0. Also verify that IP forwarding and any required firewall rules allow TCP 80 and 443 through the tunnel.