ServeHub-2: A Self-Hosted Two-Server VPN Architecture

Short summary

Developer replaced expensive managed services with a self-hosted two-server VPN using WireGuard and AmneziaWG. Remote VPS relays encrypted traffic through Nginx, controlling access to home services and preventing public internet exposure. Architecture evolved through Tuna, Pangolin, and FRP before settling on WireGuard, with detailed debugging of provider-level obfuscation issues and SSL automation via Certbot.

• •Cost-effective alternative to managed tunnels: 500 rubles/month for remote VPS vs. dual subscriptions to separate services
• •WireGuard with AmneziaWG obfuscation ensures all internal services remain invisible to port scanners and ISP-level filtering
• •Security via Nginx proxy protocol preserves real client IPs in logs while restricting access to VPN subnet 10.8.0.0/24

Generated with AI, which can make mistakes.