Network ingress and egress, in plain terms
Two words come up a lot once you start running your own services: ingress and egress. They simply name the direction traffic is moving relative to your machine.
- Ingress is traffic arriving in to your box — a browser loading your web panel, or a device connecting to reach a service you host.
- Egress is traffic leaving your box for somewhere else — downloading an image, a container fetching from an API, or routing traffic out through a VPN.
The terms describe the direction traffic is flowing relative to your box, not who is in charge of it — and any single connection carries traffic both ways. Getting the direction straight saves a lot of confusion once VPNs enter the picture, because a VPN can serve either direction, and the two set-ups are not interchangeable.
Where this matters on your seedbox
When you want to reach a service running on your seedbox from your laptop, that is an ingress problem: you need a way in. When you want a program on the seedbox to send its traffic out through somewhere else, that is an egress problem: you need a way out. WireGuard is the tool for both — but you set it up differently for each.
WireGuard for ingress: connecting your devices to the seedbox
Your account already includes a ready-made WireGuard profile for the ingress case. It creates a private tunnel so your own devices can connect in to the seedbox securely — for example to reach a service you have bound to localhost without exposing it to the public internet.
Import the provided profile into the WireGuard app on your device and connect. That is the inbound tunnel: it brings you to the box. It does not route your box's outbound traffic anywhere — that is the other direction, and a common point of confusion.
WireGuard for egress: routing a container's traffic out through a VPN
If what you actually want is for a program's traffic to leave the seedbox through your own VPN provider — the egress case — that is a separate set-up. You run your own WireGuard client as a container, pointed at your VPN peer, and let other containers share its network so their outbound traffic exits through it.
Your account ships with a helper for exactly this. Run docker-help in your shell and you will see the WireGuard-container command listed, along with the rest of the container tooling. It runs entirely under your account.
Quick reference
- Reaching your box from outside (ingress) → the built-in WireGuard profile, imported on your device.
- Sending a program's traffic out through a VPN (egress) → your own WireGuard client container, via
docker-help.
They point in opposite directions, so if one is not doing what you expect, it is usually because the other one is the tool you actually wanted. If a fresh container does not come up on the first try, mention it on a ticket.
