This setup uses an EC2 instance as a public bastion that forwards selected public ports to a private Ubuntu server behind a residential NAT.
The EC2 instance acts as the public entry point, while the Ubuntu server receives the real client traffic through a WireGuard tunnel.
Internet Client