Secure Reverse Proxying Behind NAT Using WireGuard and Caddy

marktaguiad@marktaguiad.dev (Mark Taguiad) — Sun, 17 May 2026 00:00:00 +0000

I’m migrating my existing reverse proxy and TLS termination setup from Pangolin to a simpler and more flexible architecture using Caddy and WireGuard.

Prerequisite

Server with public IP
Local Server (NAT or CGNAT)
Domain from Cloudflare

VPS (Public IP)

Install Wireguard.

1sudo apt update
2sudo apt install wireguard resolvconf -y

Create private key, public key and remove unnecessary permissions from the keys.

Reverse Tunneled Proxy with Cloudflared

marktaguiad@marktaguiad.dev (Mark Taguiad) — Sat, 03 Jan 2026 00:00:00 +0000

If you bought your domain in Cloudflare and broke just like me, then you can enjoy some of the free privileges like cloudflared which can tunnel your application to the cloud. This also handles TLS certificate and renewal.

Requirements

A domain in Cloudflare and a server who has access in the internet.

Server Setup

Navigate to your dashboard, click on Zero Trust - Networks - Connectors. Now create tunnel, select type as Cloudflared. Depending on the system you’re using, but in my case I will be selecting Docker. For now copy the token, like we did in Pangolin setup, we need to create a externel Docker network.

Cloudflare on marktaguiad.dev