Transparent Proxy Flow
/ Raspberry Pi gateway
Outbound
Return
iptables → redir :7892 (TCP) · TPROXY (UDP)
transparent
WireGuard
HTTPS / TLS
Raspberry Pi
gateway
docker-compose
LAN client
transparent · inside LAN
WireGuard
remote → wg0 · PiVPN
NaïveProxy server
VPS · HTTPS / TLS
Internet
destination
Clash
:7892 · rules + LB
naive-1
socks5 :1081
naive-2
socks5 :1082
Pi-Hole
DNS · wg0 / eth0
LAN devices and remote
WireGuard
clients enter the
Pi
;
Clash
redirects and fans traffic out to
naive-1 / naive-2
, which each tunnel over HTTPS to the
NaïveProxy server
on a VPS.