Error when deploying wireguard

General Docker
1

Hello. I am having an issue deploying Wireguard in Portainer using the Docker-Compose script.

Here is the script I am trying to use:

---
version: "2.1"
services:
  wireguard:
    image: linuxserver/wireguard
    container_name: wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=100
      - TZ=America/New York
      - SERVERURL=wireguard.domain.com #optional
      - SERVERPORT=51820 #optional
      - PEERS=1 #optional
      - PEERDNS=1.1.1.1 #optional
      - INTERNAL_SUBNET=10.13.13.0 #optional
    volumes:
      - /srv/dev-disk-by-label-HomeDrive/config files/wiregaurd:/config
      - /lib/modules:/lib/modules
    ports:
      - 51820:51820/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped

And here is the error:

Deployment Error:
Unsupported config option for Wireguard service: sysctl

I can’t seem to find an answer anywhere on what I’m supposed to change that to or if there is some other option I’m supposed to enable to make my sysctl support that config option. Any help would be great.

A couple other question about setting this up

  1. Is there something else better to change this to:
    SERVERURL=wireguard.domain.com
  2. If using dnsmasq should I set this to 127.0.0.1 or leave it auto?

Thank you in advance!
Raspberry Pi 4 (Raspbian Buster Lite)
OMV5
Portainer
dnsmasq
Caddy2
Orbi Router

2

Are you sure you copy pasted exactly?
Your yaml shows sysctls but your error shows sysctl

3

I copy and pasted the yml and hand typed the error message so I could have missed the ‘c’ when typing it in.

4

aptalca and i both tested using compose in omv5 and it works fine. On your docker tab in the gui, above where you install portainer, you can install “docker” use that. Portainer is known to break things especially when advanced options are in use (such as cap_add and sysctls options)

If you can replicate the issue deploying from compose (not portainer) that would be cause for alarm!

5

Ok instead of going into the ‘stack’ menu and using the Docker-Compose script I went to the ‘Container’ menu and pulled the image. When pulling the image that way it didn’t come preloaded with all the ENV data or Volumes.

wiregurad
wiregurad1967×1115 77.6 KB

I also don’t know what the extra ENV DEBIAN_FRONTEND is for. Or where this data goes:

    cap_add:
      - NET_ADMIN
      - SYS_MODULE

Lastly as is it’s not working. I tried scanning the QR with my phone and also adding the wg0 file to my Wireguard app on the phone. Any help on getting this up and running would be great. It did make a directory of files on my external drive though.

I appreciate the help. I’m new to everything Linux and have always been just an end user of Windows products. This is my first time learning/doing any type of networking also.

6

I recommend using compose as I previously suggested, portainer causes problems.

join us in discord if you need some assistance, but you simply paste our compose into a text file, let’s call it docker-compose.yml, edit the things that need changing, then type docker-compose pull docker-compose up -d

it will work, if you use portainer, it will not work. Portainer is for very advanced users who know how to unbreak things and put in cap_add stuff. text-based compose is for new users because you simply copy/paste.

7

Ok I got it installed through Docker -Compose command line. Everything seems to have installed properly. After scanning the QR with my phone it loads all the keys/data. When I activate it I lose internet on my phone. Not sure what setting I have wrong. I have tried changing the DNS to my Raspberry Pi’s IP since dnsmasq is my resolver. I also tried google and cloudflare. When I change the PEERDNS I use
sudo docker-compose run -e PEERDNS=192.168.1.29 wireguard

I also now have several instances running which is probably a problem. I’m searching for the right command to stop them at the moment.

      Container               Repository          Tag       Image Id      Size
-------------------------------------------------------------------------------
docker_wireguard_run_1   linuxserver/wireguard   latest   f1409ee09a44   343 MB
docker_wireguard_run_2   linuxserver/wireguard   latest   f1409ee09a44   343 MB
wireguard                linuxserver/wireguard   latest   f1409ee09a44   343 MB

Any ideas on how I can fix this? I also asked on discord just waiting for some help. Could it be an issue with AllowedIPs?

Thanks again

8

If you’re using a domain name as the address and are trying to connect to it from within the lan, you’re likely hitting an issue related to hairpin nat

9

I’ve tried a few sites with wifi on and off. Nothing loads from my phone while the VPN is on. Do these look correct:

Peer1.conf

Address = 10.13.13.2
PrivateKey = redacted
ListenPort = 51820
DNS = 192.168.1.29

[Peer]
PublicKey = redacted
Endpoint = wireguard.domain.com:51820
AllowedIPs = 0.0.0.0/0, ::/0

wg0.conf

Address = 10.13.13.1
ListenPort = 51820
PrivateKey = redacted
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = redacted
AllowedIPs = 10.13.13.2/32

.donoteditthisfile

ORIG_SERVERPORT=51820
ORIG_PEERDNS=192.168.1.29
ORIG_PEERS=1
ORIG_INTERFACE=10.13.13

I also set port forwarding on my router to my Pis address (192.168.1.29) for port 51820. I’m not sure what else I can try.

10

My guess is, it’s either your domain or your port forwarding.

Check this on the server docker exec -it wireguard wg show and if you see no handshake details for the peer, definitely connection issue due to ip or port forward

11

I got an error response from daemon container is not running…

But then I also get this when I run docker container ls:

CONTAINER ID        IMAGE                   COMMAND                  CREATED             STATUS              PORTS                                            NAMES
8a25017779f1        linuxserver/wireguard   "/init"                  2 hours ago         Up 2 hours          51820/udp                                        docker_wireguard_run_2
ada3fcecc911        linuxserver/wireguard   "/init"                  3 hours ago         Up 3 hours          51820/udp                                        docker_wireguard_run_1
e25303dfb282        linuxserver/duckdns     "/init"                  39 hours ago        Up 19 hours                                                          duckdns
9d0ca5a7db50        linuxserver/jellyfin    "/init"                  4 days ago          Up 19 hours         0.0.0.0:8096->8096/tcp, 8920/tcp                 jellyfin
e422add8e2bf        portainer/portainer     "/portainer --no-ana…"   3 weeks ago         Up 19 hours         0.0.0.0:8000->8000/tcp, 0.0.0.0:9000->9000/tcp   portainer

So I have two instances running or am I reading that wrong?

12

You currently have two wireguard container and neither has any port mapping so you won’t be able to access them.

Stop and delete both and start from scratch with just the compose. Post a full docker log here

13

That’s part of my problem. I don’t know how to. I tried

sudo docker container stop wireguard

That doesn’t stop it and I tried by using

sudo docker container stop docker_wireguard_run1

I would like to stop them and delete the whole thing to start over.

14

figure it out. Going to try installing again.

15

Since I’m really dense and haven’t done an install this way before I’d like to verify what you mean by using compose. I copy and pasted the Docker-Compose script to a file and named it Docker-Compose.yaml.

I put it in /etc/docker/Docker-Compose.yaml

I cd to that directory and then use:

docker-compose pull docker-compose up -d

That should be all I need to do correct?

16

basically, those are two separate commands though, one, hit enter, next, hit enter
I’m not sure on that path for compose.yml though, i keep mine in my home directory. try and see if it works, if not, move the yml to your homedir and try again

maybe you should show us your docker-compose.yml
to be honest, looking at your previous posts, i do not think you are following directions which is causing your issues. You just copy paste from our readme and adjust 3-5 things.

17

Ok here’s my yml:

version: "2.1"
services:
  wireguard:
    image: linuxserver/wireguard
    container_name: wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=998
      - PGID=100
      - TZ=America/New York
      - SERVERURL=wireguard.domain.com #optional
      - SERVERPORT=51820 #optional
      - PEERS=1 #optional
      - PEERDNS=auto #optional
      - INTERNAL_SUBNET=10.13.13.0 #optional
    volumes:
      - /srv/dev-disk-by-label-HomeDrive/config files/wireguard:/config
      - /lib/modules:/lib/modules
    ports:
      - 51820:51820/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped

And here’s the commands I ran:

pi@raspberrypi:~/docker_files/wireguard $ sudo docker-compose pull
Pulling wireguard ... done
pi@raspberrypi:~/docker_files/wireguard $ sudo docker-compose up -d
Creating network "wireguard_default" with the default driver
Creating wireguard ... done
pi@raspberrypi:~/docker_files/wireguard $

The folder populated in the correct directory. I scanned the QR with my phone. Still no connection. How can I ensure I have binded(?) the correct port inside docker?

EDIT: Now i’m getting this from sudo docker exec -it wireguard wg

interface: wg0
  public key: redacted
  private key: (hidden)
  listening port: 51820

peer: redacted
  allowed ips: 10.13.13.2/32
failed to resize tty, using default size
18

what you posted all looks good, when you look at your phone’s connection is it pointing to wireguard.domain.com or some 172 address?

Did you port forward 51820 from your router to your pi? verify with https://canyouseeme.org/

19

I’m going to do my best to be smart about the first question. When I go to setting>VPN>(The connection I named HOME that is set to Wireguard) and I click the info symbol I see the following:

Type Wireguard
Server wireguard.domain.com:51820
Server address 127.0.0.1
Address 10.13.13.2
Connect Time 3:04

Is that what you’re asking?

I just double checked the router an 51820 is forwarded to my Pi.

20

yep, that all looks good to me;

to be clear, you deployed this container with compose, NOT portainer, right?