sazeygit

Bypass CGNAT for Plex via your own Wireguard VPN on a VPS

Intro

I just recently switched to an ISP that uses CGNAT. I needed a way to access my Plex server remotely now that I didn't have a public IPv4 address. Thankfully for most of my other web hosted projects, I was able to use Cloudflare tunnels. But it's ambigous if Cloudflare is okay with you using Tunnels for Plex traffic.

Instead people suggested buying a VPS and hosting a VPN (like Wireguard) to route your traffic through. I couldn't find a complete guide to do this. I struggled for a couple days with trial and error until I finally found a configuration that worked. I wanted to document this for anyone else in the same situation (and future me).

Prerequisites

Journalctl Cheat Sheet

Configuration

Permissions

To see messages from other users and the system as well as performing various log operations from a regular user add it to the group:

sudo usermod -aG systemd-journal $USER

99% of the information in this guide is taken from here: https://golb.hplar.ch/2019/01/expose-server-vpn.html I've added some stuff and changed some things to suit my needs.

A much easier method would be to follow: Routing Plex traffic through an SSH Tunnel

Both solutions work, however I've had better success with Wireguard.

Make sure your VPS is KVM. I've used both BuyVM and ServerCheap and have had good results.

Expose a server behind CG:NAT via Wireguard

UFW

I use Ubuntu’s Uncomplicated firewall because it is available on Ubuntu and it's very simple.

Install UFW

if ufw is not installed by default be sure to install it first.

	#To create a classic TCP listening daemon, similar to netcat -l, use a variation of the following command.
	socat TCP-LISTEN:8080 stdout

	#use remotly a command shell
	socat TCP4-LISTEN:1234,reuseaddr,fork 'SYSTEM:/bin/cat /home/infos.txt'

	#sslify a server
	socat OPENSSL-LISTEN:443,reuse‐addr,pf=ip4,fork,cert=server.pem,cafile=client.crt TCP4-CONNECT:localhost:80