Have a look at self hosted netbird on a VPS. Its free and has very little feature restrictions https://netbird.io/

I’ve started working on something very similar ( Client -> Wireguard -> homeserver -> Mullvad -> Internet), but didn’t get too far and saved the project for later. IIRC, I had issues defining more clearly in the post-up / post-down hooks which traffic was supposed to go where. Upon bringing up the tunnel to Mullvad, I’d lose SSH access instantaneously. I’ll watch this thread closely and contribute once I get around to tackle the issue sometime this summer.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

[Thread #14 for this comm, first seen 15th Jun 2026, 11:10] [FAQ] [Full list] [Contact] [Source code]

I have a custom made ansible role that does what you are asking for. I’ve wanted to clean it up a bit before putting it up on Github, and your post just gave me a motivation to stop procrastinating it :) This was initially made for my own use, and I’m not an Ansible expert so it can have some rough edges, but I tried my best to make it adhere to the Ansible way of doing things (applying the same role to a host twice should be idempotent).

Using this role, I’m able to quickly define wireguard networks, define which peer participates in which network, optionally configure a peer as a router (with NAT and port forwarding) for a given network. For Ansible-managed hosts, it installs wireguard, generates and deploys wireguard configurations, and enables IP forwarding on exit nodes. It can also generate ready-to-deploy wireguard configurations for externally managed hosts.

The repo is at https://github.com/pcouy/ansible-wireguard . I tried giving some instructions in the readme but they may not be detailed enough. If you try it, please open an issue for anything that’s not clear enough from the readme so I can improve it. (I tried making a “Quick start” section for people who never used ansible before)

You could use headscale. Its the heart of tailscale but in an open source format.

The end goal is to have no reliance on tailscale as i am preparing for the eventual enshitification.

Tailscale is mostly open-source. If they do anything bad then someone could fork the project. The coordination server isn’t open-source, but you could self-host Headscale as a replacement.

If it still doesn’t suit your use cases, there’s some alternatives.

I personally wouldn’t directly deal with iptables or nftables rules, and instead use some other software to deal with that.

What router do you have?

For example with a Unifi router you can quite easily create a routing for that.

Here is the compose and post up im working on

services:
  gluetun:
    image: qmcgaw/gluetun:v3
    hostname: gluetun
    restart: always
    networks:
      wg:
        ipv4_address: 192.168.1.10    
    ports:
      - 51720:51720/udp # wireguard ui
      - 51821:51821 # wireguard tunnel
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
      - VPN_TYPE=${VPN_TYPE}
      - WIREGUARD_PRIVATE_KEY=${PRIVATE_KEY}
      - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
      - SERVER_CITIES=${SERVER_CITIES}
      - ALLOWED_IPS=0.0.0.0/1
      - FIREWALL_OUTBOUND_SUBNETS=${OUTBOUND_SUBNET}  #change to appropriate subnet
      - DNS_ADDRESS=${DNS}
#      - HEALTH_TARGET_ADDRESS=cloudflare.com:80
#      - HEALTH_VPN_DURATION_INITIAL=120s

  wg-easy:
    environment:
      - INSECURE=true #INITIAL SETUP NOT FOR PRODUCTION
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    restart: unless-stopped
    networks:
      wg:
        ipv4_address: 192.168.1.20 
    
    volumes:
      - ./data:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - 51720:51720/udp #wireguard
      - 51821:51821/tcp #web ui
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1

networks:
  vpn:
    driver: bridge
    enable_ipv6: false
    ipam:
      driver: default
      config:
        - subnet: 192.168.1.0/24 #container ipgateway
#        - subnet: fdcc:ad94:bacf:61a3::/64

Post up

# Detect the VPN bridge interface by wg-easy's container IP
VPN=$(ip -o -4 addr show | awk '$4 ~ /^192.168.1.20\// {print $2; exit}'); test -n "$VPN";
iptables -P FORWARD DROP;
ip6tables -P FORWARD DROP;
iptables -A INPUT -p udp -m udp --dport {{port}} -j ACCEPT;
ip6tables -A INPUT -p udp -m udp --dport {{port}} -j ACCEPT;

# Direct subnets:
ip route -A 10.1.0.0/16 via 192.168.1.0/24 dev $VPN table 200;
ip -6 route -A 10.1.0.0/16 via 192.168.1.0/24 dev $VPN table 200;