I have a Debian server that has a Wireguard connection to a box sitting behind a NAT. The box has Wireguard IP whereas the server has Wireguard IP On the server, a few Docker containers are running. I would like to be able to assign some containers an IP on the subnet so that I can tell the containers apart by IP on the box as requests from the contains come in.

When I launch containers without special network config, i.e. using the standard bridge driver, I can reach the box via its IP, however, the originating IP is the server's (

I tried using Docker's IPVLAN network driver, but that requires an actual Ethernet interface as opposed to a tunnel.

How can I achieve this?

edit: After creating a Docker network with docker network create --driver=bridge --subnet= my-net and starting a dummy container with docker run -it --rm --network=my-net --ip= alpine, I still cannot get this to work.

The Wireguard settings on the server are like so:

PrivateKey = *** REDACTED ***
ListenPort = 51821
Address =
PublicKey = *** REDACTED ***
AllowedIPs = # I also tried setting this to /24

In the box's Wireguard settings the Address is set to and AllowedIPs is set to

I checked the firewall counters and I don't think this is what's stopping the packets. However, when looking at the routing table, this seems suspicious: dev wg1 proto kernel scope link src dev br-df2fc584e6b0 proto kernel scope link src

wg1 is the Wireguard interface and br-df2fc584e6b0 corresponds to the Docker bridge my-net. More details:

$ ip a show dev br-df2fc584e6b0
184: br-df2fc584e6b0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:98:27:08:23 brd ff:ff:ff:ff:ff:ff
    inet brd scope global br-df2fc584e6b0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:98ff:fe27:823/64 scope link
       valid_lft forever preferred_lft forever

$ ip a show dev wg1
177: wg1: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet scope global wg1
       valid_lft forever preferred_lft forever

edit2: I was able to resolve this by making the IP subnets non-overlapping, i.e. the Wireguard interface has the address and the bridge network is assigned the subnet Additionally, I created the bridge network with com.docker.network.bridge.enable_ip_masquerade=false to keep the original IP.

1 Answer 1


you can create a custom bridge network in Docker and then connect your containers to this network.


docker network create --driver=bridge --subnet= mynetwork
docker run --network=mynetwork --ip=192.168.60.x -d your_container_image

Ensure that your WireGuard setup allows traffic from the Docker bridge network. Update your WireGuard configuration to allow traffic from the Docker bridge subnet ( Update the AllowedIPs both on WireGuard client and server side and make sure to restart WireGuard after that.

  • Thanks for the suggestion. I tried it, but I'm not having success yet, see my edit above.
    – sven
    Nov 29, 2023 at 19:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .