[SOLVED] One external IPv4 (Wireguard) and multiple VMs (Virtual NAT)

[eisteed]

Hello everyone,
I'm using proxmox for my self-hosted apps, sites and gaming server

My internet provider stopped IPV4 support, so I cannot do any classic port forwarding (except on IPV6 which is still not always working for everything).
I came across a solution using OVH VPS and additional IPs where I connect every VMs to a single IP using wireguard.

So my traffic is :
internet <-> VPS (wireguard) -> VMs

And this is working great except additional IPV4 IPs will be charged a monthly fee (one time payment at the moment) and I do not have this budget for personal projects. I'm currently running 4 VMs with external IPs.
So I'm trying to rethink my network using one single external IPs and finding a replacement to NAT internally (preferably with some GUI to manage port forwarding).

My plan is:
internet <-> VPS (WireGuard) <-> Proxmox <-> Virtual NAT or Reverse Proxy <-> VMs

But I'm unsure of it and how to do it.
- I read about adding NAT on proxmox modifying /etc/network/interfaces but then it seems everything must be done in CLI and this is kind of hard to manage multiple port forwarding without any UI / Web UI.
- I also read about PFsense or adding another VM to act as a replacement to a physical IPV4 NAT but also unsure on how to setup it.
- Finally thought of simply using a reverse proxy for everything but I don't think everything can be done with nginx (gaming servers, thinkbox deadline server, PBS)

I need to keep my wireguard implementation in order to keep my IPV4 public IP and I'm not experimented enough in networking to find a simple solution.

Any help, advices or docs/tutorial is much appreciated
Thanks !

 

[eisteed]

Solution for anyone that needs it :

1. Buy/Use a single additional IP on your VPS
2. Set additional IP as Alias on your VPS
https://support.us.ovhcloud.com/hc/en-us/articles/7154925809683-How-to-Configure-IP-Aliasing
https://docs.ovh.com/fr/dedicated/network-ipaliasing/

3. Create a network VMs / VPS with wireguard (10.x.x.x)
Wireguard VPS config act as IPv4 NAT / port forwarding with rules like that :

#Client ON
PreUp = iptables -t nat -A PREROUTING -d additonalipexternal -p tcp --match multiport --dports 80,443,whateverportsneeded -j DNAT --to-destination internalIP(wireguard)
PreUp = iptables -t nat -A POSTROUTING -s  internalIP(wireguard)/32 -j SNAT --to-source additonalipexternal


#Client OFF
PreDown = iptables -t nat -D PREROUTING -d additonalipexternal -p tcp --match multiport --dports 80,443,whateverportsneeded -j DNAT --to-destination internalIP(wireguard)
PreDown = iptables -t nat -D POSTROUTING -s  internalIP(wireguard)/32 -j SNAT --to-source additonalipexternal