Fortifying the Home Lab: Setting Up WireGuard VPN & a Tailscale Exit Node

Good day, mates! In our previous projects, we’ve tackled some solid infrastructure, turning our low-power Raspberry Pi Zero 2 W boards into a robust MQTT broker, a network-wide Pi-hole sentry, and a Tailscale Subnet Router.

Today, we are taking our remote access game a step further by layering a custom WireGuard VPN on top of our existing setup and turning our Pi into a fully-fledged Tailscale Exit Node. If you're managing complex digital platforms or just want bulletproof access to your local network from anywhere in the world, this is the way to do it, so let's crack into the terminal and get this sorted!

Step 1: Install WireGuard

First up, we need to grab the WireGuard packages for the Pi; simply SSH into your device and run the following command to get the installation underway.

Bash

sudo apt install wireguard

Step 2: Configure the VPN Interface

With WireGuard installed, it’s time to define our server interface and set up our first peer by creating a new configuration file called rasp-zero-vpn.conf.

Bash

sudo nano /etc/wireguard/rasp-zero-vpn.conf

Paste the following configuration into the file, noticing that we are setting up NAT via the Wi-Fi interface (wlan0), which is spot on for the Pi Zero 2 W (if you're running this on a hardwired board later, just swap wlan0 for eth0).

[Interface]

PrivateKey = ONKoa5TnJ956d…………..bBEwGY=

Address = 10.58.34.1/24

MTU = 1200

ListenPort = 51820

# NAT via Wi-Fi (change to eth0 if using Ethernet)

PostUp   = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o wlan0 -j MASQUERADE

[Peer]

PublicKey = 37McfSkNB6NfrNXaq………….LCp4gS9dfn8=

PresharedKey = 87iOX5WFbJ……………..DGUcQM6ro=

AllowedIPs = 10.58.34.2/32

Step 3: Enable IP Forwarding

For the Pi to properly route traffic between your VPN clients and the physical local network, you must enable IP forwarding at the OS level; since we already use Tailscale, we can neatly append these rules to our existing Tailscale sysctl configuration file.

Bash

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf

echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf

sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

sudo sysctl -w net.ipv4.ip_forward=1

Step 4: Network Performance Tuning

WireGuard relies heavily on UDP, so to ensure our Pi Zero handles the packet forwarding without breaking a sweat, we can use ethtool to offload some of the processing. This is an absolutely ripper little trick for wireless interfaces to keep things running smoothly.

Bash

sudo apt install ethtool -y

 sudo ethtool -K wlan0 rx-udp-gro-forwarding on rx-gro-list on

Step 5: Fire Up the Tunnel & Advertise the Exit Node

The hard yakka is done, so now we just need to enable the WireGuard service so it boots automatically whenever the Pi restarts, and fire it up.

Bash

sudo systemctl enable wg-quick@rasp-zero-vpn

sudo systemctl start wg-quick@rasp-zero-vpn

Finally, let’s tie this all back into our Tailscale mesh; by advertising the Pi as an exit node, any device on your Tailscale network can route all its internet traffic securely through your home connection.

Bash

sudo tailscale up --advertise-exit-node

And that’s a wrap! You’ve just fortified your network with a lightweight, incredibly fast WireGuard tunnel that plays perfectly with Tailscale.

"If you've got any questions or need a hand wrangling your own setup, don't hesitate to reach out at [email protected] or connect with me via www.yazan.me. I'm always keen to help out!"