Proxying between Homelab and VPS

H im currently hosting a Minecraft server for my university club by using my own Homelab but with a VPS at the front and wireguard tunnelling to protect home IP and safe if CGNAT.

Just wanted to know if anyone did any proxying/tips different methods to accomplish this

Im using wireguard + Nftables and chainrouting. Accepting all TCP/UDP connections but I control security with the VPS firewalls and open specific ports like 25565 (for minecraft TCP). Any alternatives? Thanks!

devops security

Answers 3

@MoonWIRajaJan 6

You can keep your current setup but make it more secure by using the VPS as a full proxy for your Homelab, so all traffic goes through the WireGuard tunnel and your home IP stays hidden. Instead of opening all TCP/UDP ports, only open the Minecraft port on the VPS and use a TCP proxy like HAProxy or Nginx to forward connections. To make the server easier to access, you can use your own domain and set up a SRV record in Cloudflare so players connect via the domain instead of the VPS IP, hiding the real server IP. Add firewall rules, rate limiting, and optionally Cloudflare Spectrum to protect the VPS from DDoS, or use a service like Playit.gg to handle tunneling and IP hiding automatically.