Wireguard and docker: providing VPN access to arbitrary containers

2022-04-16T12:00:12+00:00

Your container might benefit from VPN access</h2>
Some containers just aren't meant to be connected directly to the internet. After all, you wouldn't want your ISP knowing which Linux distribution you download and share.
If like me you have your BitTorrent client installed as a container on a homeserver to make sure it's always connected but you don't want to route your other containers through a VPN, you'll probably want to use a VPN-in-a-container and route your BitTorrent client through it.
I already had a similar solution using OpenVPN but it was time for an upgrade. Oh yes, it's Wireguard</a> time.
As VPN provider, I use Mullvad</a>.

The solution</h2>
Our situation is this: our homeserver (could be a Linux machine, a Raspberry Pi…) runs two docker containers, one which is fine to be directly connected to the internet and one which would benefit from VPN access.
One could install the Wireguard client straight on the machine and route both containers through the VPN, but for various reasons, that's now what we want here.
Our solution will be to add another container which connects to the VPN and route our sensitive container through the VPN container.
With some experimenting, I got it working 90%. The only issue was that while the BitTorrent client was perfectly shielded by the VPN, I could no longer access the client myself. Not great.
After two days of trying stuff out and searching the internet, I found the working solution on a blog post from 2021 which sadly already no longer exists. But thanks to the Web Archive, its wisdom is lost no more</a>.

The reason I didn't get it working myself is because I knew the problem lay in the PostUp/PreDown</code> commands of the Wireguard configuration. And I don't know how to read or write those :/ Mullvad provides their own but they do not work in this situation.

I must therefore warn you that I sadly do not fully understand the solution. I probably could fiddle with it and get it working on a different system, but I don't understand it. I simply took my 90%-functional implementation, copy-pasted the PostUp/PreDown</code> commands from the linked blog post and voilà, success!

Not proud of it, and I hope I'll gain understanding of these commands in the near future, but that's the situation.

The implementation</h2>
You must have Wireguard installed on your system but it doesn't need to be running any connection.</p>

docker-compose.yml</code></h3>
version</span>: </span>'2.3'
</span>
</span>services</span>:
</span>  </span>wireguard</span>:
</span>    </span>image</span>: </span>linuxserver/wireguard
</span>    </span>hostname</span>: </span>wireguard
</span>    </span>container_name</span>: </span>wireguard
</span>    </span>cap_add</span>:
</span>      - </span>net_admin
</span>      - </span>sys_module
</span>    </span>ports</span>:
</span>      - </span>8112:8112
</span>      - </span>58846:58846
</span>    </span>volumes</span>:
</span>      - </span>/lib/modules:/lib/modules
</span>      - </span>./data/wireguard:/config
</span>    </span>sysctls</span>:
</span>      - </span>net.ipv4.conf.all.src_valid_mark=1
</span>
</span>  </span>deluge</span>:
</span>    </span>image</span>: </span>linuxserver/deluge
</span>    </span>container_name</span>: </span>deluge
</span>    </span>network_mode</span>: </span>service:wireguard
</span>    </span>volumes</span>:
</span>      - </span>./data/deluge:/config
</span>      - </span>./data/downloads:/downloads
</span></code></pre>
In this docker-compose setup, we use the linuxserver/wireguard</a> and linuxserver/deluge</a> container images. Please have a look at their respective documentation for more information on their configuration.</p>
A few interesting notes:</p>
    </span>cap_add</span>:
</span>      - </span>net_admin
</span>      - </span>sys_module
</span>    [</span>…</span>]
</span>    </span>volumes</span>:
</span>      - </span>/lib/modules:/lib/modules
</span></code></pre>
The linuxserver/wireguard</a> image uses the system's Wireguard module and this configuration allows the container to access it.</p>
    </span>sysctls</span>:
</span>      - </span>net.ipv4.conf.all.src_valid_mark=1
</span></code></pre>
This is important but sadly, I do not know what it does.</p>
    </span>ports</span>:
</span>      - </span>8112:8112
</span>      - </span>58846:58846
</span></code></pre>
This is the interesting part. We assign those ports to the wireguard</code> container, but they are the ports exposed by the deluge</code> container</a>! Indeed, since the deluge</code> container's network flows through the wireguard</code> container, we can only access the deluge</code> container through the wireguard</code> container's network.</p>
By the way, port 8112</code> is used for the Deluge WebUI</a> and port 58846</code> is used by Deluge Thin Clients</a>. Your BitTorrent client of choice will most likely use different ports!</p>
    </span>network_mode</span>: </span>service:wireguard
</span></code></pre>
The trick that makes it all work: make sure that the deluge</code> container connects to the internet through the wireguard</code> container.</p>
wg0.conf</code></h3>
This Wireguard configuration file is based on the one provided by Mullvad, but with the PostUp/PreDown</code> commands found in the blog post mentioned earlier</a>.</p>
[Interface]
</span>PrivateKey </span>= <</span>private key</span>>
</span>Address </span>= <</span>ip address</span>>
</span>DNS </span>= <</span>ip address</span>>
</span>
</span>PostUp </span>= </span>DROUTE</span>=</span>$(ip route </span>|</span> grep default </span>|</span> awk </span>'{print $3}'</span>); </span>HOMENET</span>=</span>192.168.0.0/16</span>; </span>HOMENET2</span>=</span>10.0.0.0/8</span>; </span>HOMENET3</span>=</span>172.16.0.0/12</span>; ip route add </span>$HOMENET3</span> via </span>$DROUTE</span>;ip route add </span>$HOMENET2</span> via </span>$DROUTE</span>; ip route add </span>$HOMENET</span> via </span>$DROUTE</span>;iptables </span>-</span>I OUTPUT </span>-</span>d </span>$HOMENET </span>-</span>j </span>ACCEPT</span>;iptables </span>-</span>A OUTPUT </span>-</span>d </span>$HOMENET2 </span>-</span>j </span>ACCEPT</span>; iptables </span>-</span>A OUTPUT </span>-</span>d </span>$HOMENET3 </span>-</span>j </span>ACCEPT</span>;  iptables </span>-</span>A OUTPUT </span>! -</span>o </span>%i </span>-</span>m mark </span>! --</span>mark $(wg show </span>%i</span> fwmark) </span>-</span>m addrtype </span>! --</span>dst</span>-</span>type </span>LOCAL </span>-</span>j </span>REJECT
</span>PreDown </span>= </span>HOMENET</span>=</span>192.168.0.0/16</span>; </span>HOMENET2</span>=</span>10.0.0.0/8</span>; </span>HOMENET3</span>=</span>172.16.0.0/12</span>; ip route del </span>$HOMENET3</span> via </span>$DROUTE</span>;ip route del </span>$HOMENET2</span> via </span>$DROUTE</span>; ip route del </span>$HOMENET</span> via </span>$DROUTE</span>; iptables </span>-</span>D OUTPUT </span>! -</span>o </span>%i </span>-</span>m mark </span>! --</span>mark $(wg show </span>%i</span> fwmark) </span>-</span>m addrtype </span>! --</span>dst</span>-</span>type </span>LOCAL </span>-</span>j </span>REJECT</span>; iptables </span>-</span>D OUTPUT </span>-</span>d </span>$HOMENET </span>-</span>j </span>ACCEPT</span>; iptables </span>-</span>D OUTPUT </span>-</span>d </span>$HOMENET2 </span>-</span>j </span>ACCEPT</span>; iptables </span>-</span>D OUTPUT </span>-</span>d </span>$HOMENET3 </span>-</span>j </span>ACCEPT
</span>
</span>[Peer]
</span>PublicKey </span>= <</span>public key</span>>
</span>AllowedIPs </span>= </span>0.0.0.0/0
</span>Endpoint </span>= <</span>ip address </span>with</span> port</span>>
</span></code></pre>
Verification</h2>
We need to make sure we are in fact connected safely to Mullvad! To do this, let's use Mullvad's https://am.i.mullvad.net/connected</code> API endpoint.</p>
docker</span> exec</span> -t</span> wireguard curl https://am.i.mullvad.net/connected
</span># You are connected to Mullvad (server XXYY-wireguard). Your IP address is XYZ.XYZ.XYZ.XYZ
</span></code></pre>
Success! But wait, that's the wireguard</code> container, this just checks whether our config is working. What about the deluge</code> container?</p>
docker</span> exec</span> -t</span> deluge curl https://am.i.mullvad.net/connected
</span># You are connected to Mullvad (server XXYY-wireguard). Your IP address is XYZ.XYZ.XYZ.XYZ
</span></code></pre>
Victory! Have fun sharing Linux distributions!</p>

Yarmo - docker

Wireguard and docker: providing VPN access to arbitrary containers