I'm routing game traffic on my VPS via wireguard to a home server that has games hosted via docker.
Setup is...
VPS/Wireguard -> Internet -> Wireguard/Dockerized Games Server
Now, my current config WORKS... however I'm curious if there is some unnecessary routing going on.
VPS iptable rules (omitted PostDown)
PostUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --match multiport --dports 61000:61100 -j DNAT --to-destination 10.0.0.3
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Game Server (omitted PostDown)
Here are the iptable rules on the game server and the --to-destination part is what I'm curious about...
PostUp = iptables -t nat -A PREROUTING -p tcp --dport 61000:61100 -d 10.0.0.3 -j DNAT --to-destination 192.168.1.14
PostUp = iptables -t nat -A POSTROUTING -j MASQUERADE
10.0.0.3 is the same machine as 192.168.1.14
The reason I'm setting the --to-destination ip to that is because the docker rules that are created in the Chain DOCKER section of the iptable rules are looking for the destination nam-games.localdomain which is my dns entry for the game server. I unfortunately don't think I can change these because I'm using a game server management panel called Pterodactyl that adds these. I also don't want to have to manually add rules to this every time I create a server.
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere
DNAT tcp -- anywhere nam-games.localdomain tcp dpt:61000 to:172.18.0.2:61000
DNAT udp -- anywhere nam-games.localdomain udp dpt:61000 to:172.18.0.2:61000
DNAT tcp -- anywhere nam-games.localdomain tcp dpt:61001 to:172.18.0.3:61001
DNAT udp -- anywhere nam-games.localdomain udp dpt:61001 to:172.18.0.3:61001
Concerns
The setup I described above is the only config I have gotten to work, but I'm curious if it's hitting the server, then going the router, only to be routed back to the same machine again. If it is, is there a better way to set this up?
Never even played it but that is a really cool drawing.