Self-Hosted K8s Anywhere: Rancher + WireGuard Behind ISP NAT

Run distributed Kubernetes clusters across the globe — connecting remote nodes from AWS, home labs, and anywhere else — without needing a single open inbound port on your ISP connection.

This guide walks through connecting distributed Kubernetes nodes to a Rancher server running on a home network — even when your ISP blocks all inbound connections. The solution uses WireGuard VPN tunnels initiated outbound from every node, with a small VPS acting as the public-facing gateway.

How it works

The key insight is that WireGuard tunnels are initiated outbound — every node dials out to the VPS hub on UDP port 51820. Your ISP never needs to allow anything in. From there, three layers handle traffic:

1. WireGuard overlay — gives every node a stable private IP (10.100.x.x) regardless of physical location
2. Rancher agent — connects outbound over HTTPS/WSS to Rancher, also via the tunnel
3. Caddy on the VPS — terminates public TLS and proxies inbound traffic into the tunnel toward your k8s ingress controller

Step 1 — Spin up the VPS gateway

# On the VPS — install Docker
curl -fsSL https://get.docker.com | sh
apt install docker-compose-plugin -y

# Open firewall ports
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 51820/udp
ufw enable

Step 2 — Deploy wg-easy + Caddy on the VPS

# /opt/gateway/docker-compose.yml on the VPS
services:

  wg-easy:
    image: ghcr.io/wg-easy/wg-easy
    restart: unless-stopped
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"  # web UI — keep off public internet
    volumes:
      - wg-data:/etc/wireguard
    environment:
      - WG_HOST=<VPS_PUBLIC_IP>
      - PASSWORD=<STRONG_PASSWORD>
      - WG_DEFAULT_ADDRESS=10.100.0.x
      - WG_MTU=1420
      - WG_PERSISTENT_KEEPALIVE=25
    cap_add: [NET_ADMIN, SYS_MODULE]
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1

  caddy:
    image: caddy:alpine
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy-data:/data

volumes:
  wg-data:
  caddy-data:

# /opt/gateway/Caddyfile
# Wildcard cert via Cloudflare DNS challenge
{
    acme_dns cloudflare {env.CF_API_TOKEN}
}

# All subdomains → k8s ingress controller (WireGuard IP)
*.yourdomain.com {
    reverse_proxy 10.100.1.11:30080
}

# Rancher UI
rancher.yourdomain.com {
    reverse_proxy 10.100.0.2:443 {
        transport http {
            tls_insecure_skip_verify
        }
    }
}

# Start the stack
cd /opt/gateway
CF_API_TOKEN=<your_token> docker compose up -d

Step 3 — Connect your Rancher server as a WireGuard peer

# On your home Rancher server
apt install wireguard -y

# Paste the downloaded config
cp rancher-home.conf /etc/wireguard/wg0.conf

wg-quick up wg0
systemctl enable wg-quick@wg0

# Verify tunnel to VPS
ping 10.100.0.1

Step 4 — Add cluster nodes as WireGuard peers

# On each remote node — install WireGuard and bring up the tunnel
apt install wireguard -y
cp cluster1-node-eu.conf /etc/wireguard/wg0.conf

# Verify MTU is set correctly in the config before starting
grep MTU /etc/wireguard/wg0.conf  # should show MTU = 1420

wg-quick up wg0
systemctl enable wg-quick@wg0

# Verify inter-node connectivity via tunnel
ping 10.100.0.1   # VPS hub
ping 10.100.0.2   # Rancher server

Step 5 — Register nodes with Rancher

# On EACH node — write RKE2 config BEFORE registering
mkdir -p /etc/rancher/rke2

cat > /etc/rancher/rke2/config.yaml << EOF
# Replace with THIS node's WireGuard IP
node-ip: "10.100.1.11"
node-external-ip: "10.100.1.11"
EOF

# Now run the Rancher registration command
# Copy from Rancher UI → Cluster Management → Create → Custom
# but add --node-ip and --node-external-ip flags:

curl -fL https://rancher.yourdomain.com/system-agent-install.sh | \
  sudo sh -s - \
  --server https://rancher.yourdomain.com \
  --token <CLUSTER_TOKEN> \
  --node-ip 10.100.1.11 \
  --node-external-ip 10.100.1.11 \
  --worker

Step 6 — Deploy ingress controller inside the cluster

# Add the ingress-nginx Helm chart
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

# Install — NodePort so Caddy can reach it on a known port
helm install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx \
  --create-namespace \
  --set controller.service.type=NodePort \
  --set controller.service.nodePorts.http=30080 \
  --set controller.service.nodePorts.https=30443

# Example Ingress for your app
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: app.yourdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp-svc
            port:
              number: 80

Traffic flow end to end

Pre-flight checklist

• VPS provisioned with Docker, ports 80/443/51820 open
• wg-easy + Caddy running on VPS via Docker Compose
• Rancher server connected to VPS as a WireGuard peer
• Each node has WireGuard up and can ping 10.100.0.1
• MTU = 1420 set in every node's wg0.conf
• RKE2 config written with node-ip = WireGuard IP before registration
• Rancher registration command includes --node-ip and --node-external-ip
• nginx-ingress installed with NodePort 30080
• Caddyfile pointing *.yourdomain.com to ingress node WireGuard IP
• DNS A record pointing to VPS public IP

What you end up with

The VPS is the only machine that needs a public IP and open inbound ports. Adding a new node to any cluster takes under two minutes: create a peer in wg-easy, drop the config on the machine, and run the Rancher registration command with the WireGuard IP flags. The cluster grows without touching your home router or ISP at all.