I'm trying to stop using a reverse-proxy service and expose my home-hosted web apps through a VPS instead. The VPS and my home PC are connected with WireGuard, and the home PC runs Nginx Proxy Manager inside Docker. The intended path is VPS → WireGuard → Nginx Proxy Manager → web app.
The tunnel is established and both machines can ping each other, but HTTP/HTTPS traffic never reaches Nginx. I'm not sure whether the problem is WireGuard routing, firewall rules, Docker networking, or how Nginx is bound to its interfaces. I'd prefer not to rebuild the server or all of my containers. The main goal is to publish the services through the VPS so my home IP stays hidden.
4 Answers
Be careful with AllowedIPs and routing. If the VPS configuration sends 0.0.0.0/0 through WireGuard, it can turn the tunnel into a full-tunnel route and cause unrelated traffic to break. For this reverse-proxy setup, the VPS generally only needs the home WireGuard subnet or the specific home peer address in AllowedIPs. Then explicitly forward the public web ports to that address, either with firewall/NAT rules or a TCP proxy.
You can also put the WireGuard endpoint on the home router, but that is not required. WireGuard on the home PC works as long as forwarding, firewall rules, Docker port publishing, and Nginx bindings are correct. A common architecture is a VPS with a public IP forwarding 80/443 over WireGuard to the home server, while the home-side Nginx Proxy Manager handles the actual virtual hosts and applications.
A working WireGuard tunnel does not automatically forward inbound web traffic. You need to make the VPS listen on ports 80 and 443 and route or proxy those connections through the tunnel to the home machine’s WireGuard address. The simplest setup is often to run Nginx on the VPS as a TCP stream proxy, forwarding 80 and 443 to the home server. Nginx Proxy Manager can then keep handling certificates and host routing at home.
Check the basics before changing the Docker setup: verify that Nginx is bound to 0.0.0.0 rather than only 127.0.0.1, confirm the container publishes ports 80 and 443, and test connectivity to the home host’s WireGuard IP with verbose curl from the VPS. You should also inspect the listening sockets, WireGuard interface addresses, firewall rules, and Docker port mappings. Ping only proves that ICMP works; it does not prove that TCP traffic can reach the container.
Both WireGuard peers can ping each other, but I haven’t yet confirmed that TCP 80 and 443 are reachable. I’m also still trying to determine whether Nginx is listening on the WireGuard interface or only on the Docker host’s local addresses.