Hello there,
Just want to preface that this is for selfhosted purposes, I may be routing my network in other way later.
I wanted to be able to setup a wireguard docker container with gluetun such that I can connect multiple devices to it at home, in order to minimize my "five device limit" with mullvad. I have the following docker compose:
gluetun:
image: qmcgaw/gluetun
container_name: gluetun-wireguard
restart: unless-stopped
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
volumes:
- ./gluetun:/gluetun
environment:
- VPN_SERVICE_PROVIDER=#
- VPN_TYPE=wireguard
- WIREGUARD_PRIVATE_KEY=#
- WIREGUARD_ADDRESSES=#
- SERVER_CITIES=#setup#setup
# Timezone for accurate log times
- TZ=#
# Server list updater
# See https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
- UPDATER_PERIOD=24h
ports:
- 51820:51820/udp
wireguard-server:
image: linuxserver/wireguard
container_name: wireguard-server
network_mode: service:gluetun # << important
cap_add:
- NET_ADMIN
- SYS_MODULE
environment:
- PUID=1000
- PGID=1000
- SERVERPORT=51820
- PEERS=iphone
- PEERDNS=auto
volumes:
- ./config:/config
- /lib/modules:/lib/modules
restart: unless-stopped
Whenever I try connecting to it by iphone, which is my first attempt for the peer, it doesn't quite work out. The packets are received by the container, and querying cloudflare as such works:
$ sudo docker exec -it wireguard-server ping -c 3 1.1.1.1
Is there any obvious error I've made?
If I'm making the XY Problem, please let me know. If there is a more apt community, please let me know.
19 Comments
LazerDickMcCheese@sh.itjust.works · 15 pts · 360d
Gluetun is a great example of "I changed nothing and it suddenly works". I've had to set up this exact docker container several times, and it usually takes me a week of retries until it chooses to work. I wish I had better advice for you
Tinkerer@lemmy.ca · 10 pts · 360d
I've just setup headscale in docker and it worked right away. It's even faster than when I was using tailscale. It was very easy to setup and I've been using it for about a month with no issues. Doesn't really help but I haven't used gluetun myself.
MysteriousSophon21@lemmy.world · 1 pts · 357d
Headscale has been my go-to for the past 6 months - it's so reliable that I use it to connect to my self-hosted audiobookshelf server from anywhere using the soundleaf app on my iphone and it nver drops connection even on spotty mobile data.
thirdBreakfast@lemmy.world · 7 pts · 360d
Is there a reason not to use Tailscale for this?
chonkyninja@lemmy.world · 7 pts · 360d
Or https://github.com/juanfont/headscale.
NaiP@lemmy.world · 6 pts · 359d
I wanted to do it with pure wireguard. I like the headscale idea though. Might give that a shot.
abimelechbeutelbilch@fulda.social · 2 pts · 359d
0_o7@lemmy.dbzer0.com · 2 pts · 359d
We still haven't heard your solution to OPs problem, if that's so simple?
abimelechbeutelbilch@fulda.social · 2 pts · 359d
chihuamaranian@tech.lgbt · 1 pts · 359d
abimelechbeutelbilch@fulda.social · 1 pts · 358d
chihuamaranian@tech.lgbt · 1 pts · 358d
cinimodev@masto.ctms.me · 1 pts · 358d
@abimelechbeutelbilch @0_o7 @NaiP Oh I've been looking for an easier to setup wireguard! I have been reluctantly using Tailscale since PiVPN dev had to take a step back. Tailscale is just too much other stuff. I just need to be an IP ony LAN, I don't need all the other stuff.
abimelechbeutelbilch@fulda.social · 1 pts · 358d
non_burglar@lemmy.world · 1 pts · 353d
Besides being easy, there is no advantage to tailscale for this case, and I would add that lots of us don't want to depend on an external resource just to road warrior back home.
frongt@lemmy.zip · 4 pts · 360d
I don't think you want two VPN services, I think you want one VPN service and plain network routing. Use the VPN server as the local gateway, and the VPN server routes that traffic up the tunnel.
NaiP@lemmy.world · 1 pts · 359d
How does one do this? Is there an article I could read up on?
chaospatterns@lemmy.world · 2 pts · 359d
I use a variant of this: https://github.com/linuxserver/docker-wireguard
You don't need two different containers for this. They're going to either fight each other for control over the networking tables or run wireguard in wireguard
rearview@lemmy.zip · 2 pts · 359d
If you have the WireGuard config from Mullvad already, just edit your wg.conf files on client devices to route all traffic via the Mullvad servers. Basically replace all the values of the
[Peer]block with Mullvad values.If you can share your Mullvad wg config file and your wireguard-server config file here, we can sort this out together
Edit: actually since your only goal is to increase the Mullvad device limits, why not just use Mullvad-provided confs directly in your client WireGuard apps? Should be straightforward to do
LemmyPlay@lemmings.world · 0 pts · 359d
illusionist@lemmy.zip · 1 pts · 359d
The network_mode: service: gluetun looks off to me but I can't check.
Does each one their own?
NaiP@lemmy.world · 1 pts · 359d
Not sure what you mean here, but I am quite sure I need to set the network mode like that to route the network through the VPN.
illusionist@lemmy.zip · 2 pts · 359d
You're right, sorry! I checked it https://github.com/qdm12/gluetun-wiki/blob/main/setup/connect-a-container-to-gluetun.md#external-container-to-gluetun
undefined@lemmy.hogru.ch · 1 pts · 360d
Is doing this in Docker necessary? I like containerization too but a VPN server seems a little intense — why not install it directly?
NaiP@lemmy.world · 1 pts · 359d
I prefer docker because I can plop it in elsewhere if needed.
ZummiGummi@lemmy.nz · 0 pts · 360d
Have you confirmed that port forwarding to gluetun is working?