I have smart home devices in my garage that is not at the same location as my main home network. The garage has a 4G router (Teltonika) and I needed to connect its devices to my Home Assistant running on a Raspberry Pi at home. WireGuard VPN was the solution.

The Architecture

Garage (Teltonika 4G router)
  └── WireGuard client (10.0.0.3)
        ↕ encrypted tunnel
VPS (public IP)
  └── WireGuard server (10.0.0.1)
        ↕
Home RPi (10.0.0.2)
  └── WireGuard client

I use a cheap VPS as the WireGuard hub because the home RPi is behind a regular home router (no static IP), and the garage is behind 4G CGNAT. A VPS with a public IP solves both problems.

Why a VPS as Hub?

Both endpoints (home and garage) are behind NAT that we cannot control. A VPS with a public IP acts as the meeting point. Both sides connect to the VPS, and traffic is routed between them.

Setting Up WireGuard with Docker

On the home RPi, run WireGuard in Docker:

wireguard:
  image: lscr.io/linuxserver/wireguard:latest
  container_name: wireguard
  cap_add:
    - NET_ADMIN
    - SYS_MODULE
  environment:
    - SERVERURL=your-vps-ip-or-domain
    - SERVERPORT=51820
    - PEERS=home,garage
    - INTERNAL_SUBNET=10.0.0.0
  volumes:
    - /opt/wireguard:/config
    - /lib/modules:/lib/modules
  ports:
    - "51820:51820/udp"
  sysctls:
    - net.ipv4.conf.all.src_valid_mark=1
  restart: unless-stopped

The container generates QR codes and config files for each peer automatically.

OTA Updates Over WireGuard

One practical benefit: I can update my ESP32 sensors in the garage over the air through the VPN tunnel. ESPHome OTA updates work through the WireGuard tunnel as if the device were on the local network.

docker exec esphome esphome upload /config/garage-sensors.yaml \
  --device 192.168.10.113

Practical Tips

• Use a lightweight VPS – even the cheapest €3/month VPS handles WireGuard traffic easily
• DuckDNS for dynamic IP – if your VPS IP changes, use DuckDNS for a stable hostname
• Split tunneling – configure the garage peer to only route specific subnets through the VPN, not all traffic

Result

All garage devices (ESP32 sensors, IP camera) are accessible from Home Assistant as if they were on the local network. ESPHome devices show as online, camera streams are available, and OTA updates work seamlessly.