In my configuration I have a server with a public IP that manages incoming connections, and my home network connects to that server via a keepalive connection, so it’s actually operating in the same client-server mode you described going through my NAT. This also solves the dynamic IP issues.

When I’m at home, my phone can route directly over my LAN, and when I leave the house it proxies through my public server back to my house (or out to the web depending on what I’m accessing).

This seems like a decent guide on how to set it up:

https://www.cyberciti.biz/faq/how-to-set-up-wireguard-firewall-rules-in-linux/

It’s very similar to the config I’ve got. The nat iptables stuff in step 1 is what enables wireguard to be used as a VPN exit node. (+ net.ipv4.ip_forward=1)

This feels like it has validated my decision to just use plain wireguard and hardcode my client list. It’s really not too hard to set up, barely different that configuring authorized_keys or ssh.

I think there’s been one or two image decompression exploits over the years, so a site with a malicious file could end up running code on your system. I remember this being an issue with Minecraft clients and player skins at one point, but I can’t remember any specific times this happened in browsers tho.

What confuses me as someone who hasn’t written PHP in ages, is why is it supposedly so easy for a request to hit the memory limit? Does this only work on servers that accept user uploads and other large request payloads? People are saying a static PHP page can be exploited, but I don’t understand how if it’s behind even a basic nginx instance with default request limit of 1MB.

Oh, it’s been litigated alright: https://en.wikipedia.org/wiki/Dominion_Voting_Systems_v._Fox_News_Network

Didn’t Microsoft just pull this same thing and now there’s all these 0-days getting released publicly as vengeance? I swear, all these companies are sharing the same brain cell…