> ## Content Index
> Fetch the complete content index at: https://sudoreboot.me/llms.txt
> Use this file to discover other available public pages before exploring further.

# The one-click privacy fix that would have quietly killed my VPN
- URL: https://sudoreboot.me/vpn-vs-cdn-proxy/
- Published: 2026-10-23T12:00:00.000Z
- Updated: 2026-10-30T15:47:13.000Z
- Description: CDN proxies speak HTTP. WireGuard speaks UDP. Guess what happens when you proxy the VPN's hostname.
- Author: Jon
- Tags: Networking, vpn, cdn

My domain's main record pointed straight at my home IP address. Every app was already hiding behind a CDN's proxy, but the bare domain wasn't, so anyone curious could look up exactly where my house lives on the internet. Flipping that record to "proxied" looked like a one-click fix. It nearly was a one-click outage.

## The catch

My WireGuard tunnel used the bare domain as its endpoint. A CDN's proxy terminates HTTP and HTTPS. It does not forward arbitrary UDP, and WireGuard is *entirely* UDP. Proxy that record and DNS starts answering with the CDN's addresses, so every VPN client politely sends its handshake to servers that drop it on the floor. No error, no warning, just a tunnel that never comes up.

## The fix, in an order that never breaks anything

1. Add a new **DNS-only** name (say `vpn.example.com`) to the dynamic DNS updater, so it follows the home IP address the way the main record used to.
2. Point the WireGuard server's endpoint setting at the new name and regenerate the client configs and QR codes.
3. Update each client. Usually that's just editing the endpoint field in the WireGuard app.
4. *Only then* flip the main record to proxied.

The VPN name still points at my home IP. A VPN needs a reachable address, so that part is unavoidable, but now it's one hostname nobody would guess instead of the name printed on everything.

> Before you proxy any DNS record, grep your configs for that exact hostname. VPN endpoints, game servers, mail and SSH are the usual suspects quietly depending on it.