How do I set up Wireguard in Docker with lan access

Question

I'm trying to set up a VPN server with wireguard.

I have the following setup in docker compose:

version: "3.1"

services:
  wireguard:
    image: linuxserver/wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Berlin
      - SERVERURL=someoffice.com
      - SERVERPORT=51820
      - PEERS=6
      - PEERDNS=10.0.10.1
      - INTERNAL_SUBNET=10.13.13.0
    volumes:
      - /home/fredrik/Servers/wireguard:/config
      - /lib/modules:/lib/modules
    #ports:
    #  - 51800:51820/udp # our router does this part, since we're using macvlan
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    restart: unless-stopped
    networks:
      wireguard_vlan:
        ipv4_address: 10.0.10.16

networks:
  wireguard_vlan:
    external: true

The wireguard_vlan was created as follows:

docker network create -d macvlan --subnet 10.0.10.0/24 --gateway 10.0.10.1 --ip-range 10.0.10.15/32 -o parent=eth0 wireguard_vlan

I was basically trying to give the wireguard access to the network after being inspired by this video: Docker Networking Tutorial // ALL Network Types explained!

This is the peer config:

$ cat ~/Desktop/peer1.conf
[Interface]
Address = 10.13.13.2
PrivateKey = <key>
ListenPort = 51820
DNS = 10.0.10.1

[Peer]
PublicKey = <key>
PresharedKey = <key>
Endpoint = someoffice.com:51800
AllowedIPs = 0.0.0.0/0, ::/0

It seems to be working, because I can ping the wireguard server at 10.0.10.16 from our local network. I can also ping other machines on the local network from the wireguard container. I can not, however, ping 10.0.10.16 from the docker host (not important though).

When I connect with the wireguard client ui on windows, I can ping servers on the internet, but if I try to ping anything on the 10.0.10.0/24 network, I get the following:

$ ping 10.0.10.1

Pinging 10.0.10.1 with 32 bytes of data:
General failure.
General failure.
General failure.

Ping statistics for 10.0.10.1:
    Packets: Sent = 3, Received = 0, Lost = 3 (100% loss),

Here's the wg0.conf

[Interface]
Address = 10.13.13.1
ListenPort = 51820
PrivateKey = <key>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE

[Peer]
# peer1
PublicKey = <key>
PresharedKey = <key>
AllowedIPs = 10.13.13.2/32

In the container I can see the following interfaces:

root@16328831e502:/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none
    inet 10.13.13.1/32 scope global wg0
       valid_lft forever preferred_lft forever
98: eth0@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:22:01:01:0a:10 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.0.10.16/24 brd 10.0.10.255 scope global eth0
       valid_lft forever preferred_lft forever

The eth+ in PostUp is suspicious to me, since the interface is called eth0@if2, but I tried to spell out eth0@if2 in the wg0.conf, and it didn't seem to matter.

I think it's the PostUp and/or PostDown that is supposed to do something that will allow VPN clients access, but I don't really understand that line.

So, all in all, I can't seem to find a way to give outside access to 10.0.10.0/24. Any help and/or pointers will be highly appreciated :-)

The docker host also has a few containers for some websites etc. For a business environment it's pretty small, but yes. — Steinbitglis, May 24, 2023 at 16:51

Steinbitglis · Accepted Answer · 2023-05-24 17:26:30Z

It seems like I finally stumbled upon what error I have been doing.

These configurations seems to work:

peer1.conf

[Interface]
PrivateKey = <key>
ListenPort = 51820
Address = 10.0.10.17/32
DNS = 10.0.10.1

[Peer]
PublicKey = <key>
PresharedKey = <key>
AllowedIPs = 10.0.10.0/24, 10.13.13.0/24
Endpoint = someoffice.com:51800

wg0.conf

[Interface]
Address = 10.13.13.1
ListenPort = 51820
PrivateKey = <key>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE

[Peer]
# peer1
PublicKey = <key>
PresharedKey = <key>
AllowedIPs = 10.0.10.17/32

The configs that I first used were all set in the 10.13.13.0/24 range. Wireguard doesn't change the ip of received packages once they are received on the server side. Our router and/or wireguard didn't want or allow traffic from the 10.13.13.0/24 range to be sent to the eth0@if2 adapter.

So, both on the server side, and on the peer side, the IP of the peer will be set to an IP that is in the 10.0.10.0/24 range. Traffic in the 10.13.13.0/24 network will also be routed by wireguard, probably won't lead anywhere useful.

Max Mustermann · Accepted Answer · 2024-01-08 16:16:33Z

stumbled over this old questions since it was relevant to me now. an iptables rule should have done the trick in wg0.conf:

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

so my solution might be helpful for someone else as well.

my full confs (using ipvlan instead of macvlan)

docker-compose.yml

version: "2.1"

networks:
    docker_ext:
        external: true

services:
  wireguard:
    image: lscr.io/linuxserver/wireguard:latest
    container_name: wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Vienna
      - SERVERURL=dyn.leidinger.xyz
      - SERVERPORT=51820 #optional
      - PEERS=<peer_1>,<peer_2>,<peer_x>
      - PEERDNS=8.8.8.8 #optional
      - ALLOWEDIPS=192.168.0.0/24,192.168.1.0/24 #optional
    volumes:
      - /opt/wireguard/config:/config
      - /lib/modules:/lib/modules
    ports:
      - 51820:51820/udp
    networks:
      docker_ext:
        ipv4_address: 192.168.1.100
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.proxy_arp=1
    restart: unless-stopped

wg0.conf

[Interface]
Address = 10.13.13.1
ListenPort = 51820
PrivateKey = <key>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# peer_wienIPhoneLukas
PublicKey = <key>
PresharedKey = <key>
AllowedIPs = 10.13.13.5/32

Stack Exchange Network

How do I set up Wireguard in Docker with lan access

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
vpn
docker-compose
wireguard
docker-networking
.

Hot Network Questions

How do I set up Wireguard in Docker with lan access

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged vpndocker-composewireguarddocker-networking.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
vpn
docker-compose
wireguard
docker-networking
.