Quelltext der Seite Access from Internet with dedicated IP address

=== Description ===
This solution requires renting a VPS server which comes with a static public IP address, costs are starting at 1 Euro per month (in 2024 at ionos.de or strato.de). As this server is used only to forward data from the internet to the local server and back to the internet, the cheapest offer will most likely be sufficient. The local server will be connected to the VPS server using a VPN tunnel. All traffic aiming the public IP address of the VPS server is then being forwarded to the local server through this tunnel. Results from the local server are sent back through the tunnel to the VPS server and from there to the respective sender.
 '''<big>Internet</big> <―――――(Public IP 85.215.213.68)―――――> <big>VPS server</big> <―――――(VPN tunnel 192.168.142.x)―――――> <big>Local server</big>'''

Basically the VPN connection is triggered automatically by the client (local server). Hence the local server is permanently accessable from the internet. Security settings are maintained in the local network like fail2ban and firewall rules to protect the local server against external attacks.

=== Terminology ===
{| class="wikitable"
|+
|! style="text-align:center; font-weight:bold; background-color:Moccasin"| Term
! style="text-align:center; font-weight:bold; background-color:Moccasin"| Description
|-
|VPS Server
|Virtual Private Server with a static public IP address assigned
|-
|Local Server
|Server in local network (192.168.141.1)
|-
|IP subnet for local network
|192.168.141.0/24
|-
|IP subnet for VPN tunnel
|192.168.142.1/32 (VPS server)
192.168.142.100/32 (local server)
|-
|Static public IP address
|85.215.213.68
|}
<br />
'''<big>Configuration</big>'''<br>

For the Wireguard VPN tunnel maintain the firewall rules on the VPS server to open port 51820 for incoming UDP traffic:
{| class="wikitable"
|+
! style="text-align:center; font-weight:bold; background-color:Cornsilk"| Action
! style="text-align:center; font-weight:bold; background-color:Cornsilk"| Allowed IP
! style="text-align:center; font-weight:bold; background-color:Cornsilk"| Protocol
! style="text-align:center; font-weight:bold; background-color:Cornsilk"| Port(s)
! style="text-align:center; font-weight:bold; background-color:Cornsilk"| Description
|-
|Allow
|All
|TCP
|22
|''default''
|-
|Allow
|All
|TCP
|80
|''default''
|-
|Allow
|All
|TCP
|443
|''default''
|-
|Allow
|All
|TCP
|8443
|''default''
|-
|Allow
|All
|TCP
|8447
|''default''
|-
|'''Allow'''
|'''All'''
|'''UDP'''
|'''51820'''
|'''Wireguard'''
|}


Enable packet forwarding for IPv4 in file '''/etc/sysctl.conf''':
<pre style="color: silver; background: black;">
...
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
...
</pre>


Enable the changes made in '''/etc/sysctl.conf''':
<syntaxhighlight lang="bash">
sysctl -p
</syntaxhighlight>


Install Wireguard VPN software on both VPS server and local server:<syntaxhighlight lang="bash">
apt install wireguard
mkdir --mode=700 /etc/wireguard
chown root:root /etc/wireguard
</syntaxhighlight>


Generate server key pair on both VPS server and local server:<syntaxhighlight lang="bash">
cd /etc/wireguard
umask 077; wg genkey | tee privatekey | wg pubkey > publickey
</syntaxhighlight>


Create config file '''/etc/wireguard/wg0.conf''' on VPS server:
<pre style="color: silver; background: black;">
[Interface]
PrivateKey = <Private key from VPS server>
ListenPort = 51820
Address = 192.168.142.1/24
PostUp = iptables -t nat -A PREROUTING -p tcp -d 85.215.213.68 -j DNAT --to 192.168.142.100
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens6 -j MASQUERADE
PostDown = iptables -t nat -D PREROUTING -p tcp -d 85.215.213.68 -j DNAT --to 192.168.142.100
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens6 -j MASQUERADE

[Peer]
PublicKey = <Public key from local server>
AllowedIPs = 192.168.142.100/32
</pre>


Create config file '''/etc/wireguard/wg0.conf''' on local server:
<pre style="color: silver; background: black;">
[Interface]
PrivateKey = <Private key from local server>
Address = 192.168.142.100/24

[Peer]
PublicKey = <Public key from VPS server>
AllowedIPs = 0.0.0.0/0
Endpoint = 85.215.213.68:51820
PersistentKeepalive = 25
</pre>


Edit file '''''/etc/systemd/resolved.conf''''':<syntaxhighlight lang="bash" highlight="15-20">
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See resolved.conf(5) for details

[Resolve]
#>>>2024-10-30 Frank Wulf
#DNS=
DNS=192.168.141.10
#FallbackDNS=
FallbackDNS=1.1.1.1 1.0.0.1
#<<<2024-10-30 Frank Wulf
#Domains=
#LLMNR=no
#MulticastDNS=no
#DNSSEC=no
#DNSOverTLS=no
#Cache=no-negative
#DNSStubListener=yes
#ReadEtcHosts=yes
</syntaxhighlight>


Enable VPN interface to start at boot time on both VPS server and local server, then start the interface:<syntaxhighlight lang="bash">
systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0
</syntaxhighlight>