Welcome to docker-wireguard Discussions!

[bubuntux]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[PhatTranceUK]

Hi @bubuntux thank you for this new project!

I have tried to spin a test up but not able to ifconfig from the container, below is my docker-compose.

OS: Synology DSM 7.0
Docker-compose:

`---
version: "3"
services:
nordlynx:
image: ghcr.io/bubuntux/nordlynx:latest
container_name: nordlynx
cap_add:
- NET_ADMIN
environment:
- PRIVATE_KEY=my key
- ALLOWED_IPS=0.0.0.0/1
- NET_LOCAL=192.168.1.0/24
restart: unless-stopped

Finally some output from portioner about the container.

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.,
[s6-init] ensuring user provided files have correct perms...exited 0.,
[fix-attrs.d] applying ownership & permissions fixes...,
[fix-attrs.d] done.,
[cont-init.d] executing container initialization scripts...,
[cont-init.d] 00-firewall: executing... ,
Firewall is up, everything has to go through the vpn,
[cont-init.d] 00-firewall: exited 0.,
[cont-init.d] 10-module: executing... ,
Uname info: Linux ffafeabe14c6 4.4.180+ #42218 SMP Fri Sep 24 02:41:48 CST 2021 x86_64 x86_64 x86_64 GNU/Linux,
Wireguard module is active,
[cont-init.d] 10-module: exited 0.,
[cont-init.d] 20-inet: executing... ,
Enabling connection to secure interface and docker network,
[cont-init.d] 20-inet: exited 0.,
[cont-init.d] 20-inet6: executing... ,
No inet6 network,
[cont-init.d] 20-inet6: exited 0.,
[cont-init.d] 30-route: executing... ,
Enabling connection to network 192.168.1.0/24,
[cont-init.d] 30-route: exited 0.,
[cont-init.d] 30-route6: executing... ,
[cont-init.d] 30-route6: exited 0.,
[cont-init.d] 40-allowlist: executing... ,
[cont-init.d] 40-allowlist: exited 0.,
[cont-init.d] done.,
[services.d] starting services,
[services.d] done.,
[#] ,
[#] ip link add wg0 type wireguard,
[#] wg setconf wg0 /dev/fd/63,
[#] ip -4 address add 10.5.0.2/32 dev wg0,
[#] ip link set mtu 1420 up dev wg0,
[#] resolvconf -a wg0 -m 0 -x,
[#] ip -4 route add 0.0.0.0/1 dev wg0,
[#] ,
interface: wg0,
public key:
private key: (hidden),
listening port: 51820,
,
peer:
endpoint: 185.169.255.27:51820,
allowed ips: 0.0.0.0/1,
transfer: 0 B received, 148 B sent,
persistent keepalive: every 25 seconds

Any help appreciated! thanks!

[bubuntux]

seems like the container is up and running fine, ifconfig is just not installed you can install it or try curl ifconfig.me to check the public ip of the container

[PhatTranceUK]

thanks for the reply: seems curl is installed however, when I try to ifconfig I get curl: (6) Could not resolve host: ifconfig.me

[pwhite1989]

I am running nordlynx on portainer on a raspberry pi, and if I curl ifconfig.io I get the correct response

[pwhite1989]

Hey bubuntux and all. Thank you for this project! I am just getting into learning about all this stuff and it is amazing to see the work that has been put into this.

[PhatTranceUK]

What’s your compose look like? Not sure if it’s something Synology related. Thanks.

…

On 15 Nov 2021, at 11:34 pm, Patrick White ***@***.***> wrote:  I am running nordlynx on portainer on a raspberry pi, and if I curl ifconfig.io I get the correct response — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.

[pwhite1989]

---

version: "3"
services:
nordlynx:
image: ghcr.io/bubuntux/nordlynx
container_name: nordlynx
cap_add:
- NET_ADMIN #required
environment:
- PRIVATE_KEY=blahblahblah= #required
restart: unless-stopped

[pwhite1989]

I haven't got any other variables yet as I just wanted to see if I could get it up and running. Unfortunately I've been trying to run other docker containers through the nordlynx vpn but am not entirely sure what I'm doing, so so far there is a lot of trial and error with not much luck. But the vpn is connecting properly though!

[PhatTranceUK]

Just declare your ports in nord compose then remove the ports from your chosen container then add network _mode: container: name of your nord container. Hope this helps.

…

On 15 Nov 2021, at 11:48 pm, Patrick White ***@***.***> wrote:  I haven't got any other variables yet as I just wanted to see if I could get it up and running. Unfortunately I've been trying to run other docker containers through the nordlynx vpn but am not entirely sure what I'm doing, so so far there is a lot of trial and error with not much luck. But the vpn is connecting properly though! — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.

[bubuntux]

have you tried the recommendation in the other repo

The simplest known workaround is to append ; sleep 5; ip route add 10.0.0.0/16 dev wg0 to the PostUp rule. This assumes that your WireGuard IP subnet is 10.0.x.x

POST_UP is an env variable available in this container , just use the right ip should be 10.5.0.2/32

[onestix]

Thanks mate @bubuntux, just tried with following command:

sudo docker run -ti --rm --name=nordvpn --privileged --cap-add=NET_ADMIN --cap-add=SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 --sysctl net.ipv6.conf.all.disable_ipv6=1 -e "POST_UP=sleep 5 ; ip route add 10.0.0.0/16 dev %i" -e ALLOWED_IPS=0.0.0.0/1,128.0.0.0/1 -e "PRIVATE_KEY=xxx" -e ADDRESS=10.0.0.2/16 -d bubuntux/nordlynx

.. but I am unfortunately getting an error. It seems that using the POST_UP env, it is attempting to add a new entry as opposed to appending it to the existing entry that the container is initiating. This seems to be causing a failure "RTNETLINK answers: File exists":

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 00-firewall: executing... 
Firewall is up, everything has to go through the vpn
[cont-init.d] 00-firewall: exited 0.
[cont-init.d] 10-validate: executing... 
Wireguard module is active
[cont-init.d] 10-validate: exited 0.
[cont-init.d] 20-inet: executing... 
Enabling connection to secure interface and docker network
[cont-init.d] 20-inet: exited 0.
[cont-init.d] 20-inet6: executing... 
No inet6 network
[cont-init.d] 20-inet6: exited 0.
[cont-init.d] 30-route: executing... 
[cont-init.d] 30-route: exited 0.
[cont-init.d] 30-route6: executing... 
[cont-init.d] 30-route6: exited 0.
[cont-init.d] 40-allowlist: executing... 
[cont-init.d] 40-allowlist: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
[#] 
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.0.0.2/16 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[#] ip -4 route add 128.0.0.0/1 dev wg0
[#] ip -4 route add 0.0.0.0/1 dev wg0
[#] sleep 5 ; ip route add 10.0.0.0/16 dev wg0
RTNETLINK answers: File exists
[#] resolvconf -d wg0 -f
[#] ip link delete dev wg0
Unable to access interface: No such device

I wonder if the above is needed at all since I am able to successfully establish the connection (including a successful handshake). The issue seems to be my outward communication post handshake. Would you have any suggestions on how I can troubleshoot this?

Here a few details on my successful "launch" (up until handshake) using docker run:

sudo docker run -ti --rm --name=nordvpn --privileged --cap-add=NET_ADMIN --cap-add=SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 --sysctl net.ipv6.conf.all.disable_ipv6=1 -e ALLOWED_IPS=0.0.0.0/1,128.0.0.0/1 -e "PRIVATE_KEY=xxxxx" -d bubuntux/nordlynx

Log:

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 00-firewall: executing... 
Firewall is up, everything has to go through the vpn
[cont-init.d] 00-firewall: exited 0.
[cont-init.d] 10-validate: executing... 
Wireguard module is active
[cont-init.d] 10-validate: exited 0.
[cont-init.d] 20-inet: executing... 
Enabling connection to secure interface and docker network
[cont-init.d] 20-inet: exited 0.
[cont-init.d] 20-inet6: executing... 
No inet6 network
[cont-init.d] 20-inet6: exited 0.
[cont-init.d] 30-route: executing... 
[cont-init.d] 30-route: exited 0.
[cont-init.d] 30-route6: executing... 
[cont-init.d] 30-route6: exited 0.
[cont-init.d] 40-allowlist: executing... 
[cont-init.d] 40-allowlist: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
[#] 
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.5.0.2/32 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[#] ip -4 route add 128.0.0.0/1 dev wg0
[#] ip -4 route add 0.0.0.0/1 dev wg0
[#] 
interface: wg0
  public key: xxxx
  private key: (hidden)
  listening port: 51820

peer: xxxxx
  endpoint: 185.220.70.215:51820
  allowed ips: 0.0.0.0/1, 128.0.0.0/1
  latest handshake: Now
  transfer: 92 B received, 180 B sent

Ifconfig:

eth0      Link encap:Ethernet  HWaddr 02:41:AC:10:00:05  
          inet addr:172.17.0.3  Bcast:172.17.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:32 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:10493 (10.2 KiB)  TX bytes:2526 (2.4 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wg0       Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.5.0.2  P-t-P:10.5.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP  MTU:1420  Metric:1
          RX packets:1 errors:0 dropped:0 overruns:0 frame:0
          TX packets:156 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:92 (92.0 B)  TX bytes:61060 (59.6 KiB)

cat /etc/resolv.conf:

# Generated by resolvconf
nameserver 103.86.96.100
nameserver 103.86.99.100

curl ifconfig.io:

curl: (6) Could not resolve host: ifconfig.io

Any help would be appreciated!

[bubuntux]

@onestix i think the ip address in the post up should be 10.5.0.2/32

[onestix]

You are right. it got connected with the post up this time. Unfortunately not resolving host :( This is driving me nuts.

sudo docker run -ti --rm --name=nordvpn --privileged --cap-add=NET_ADMIN --cap-add=SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 --sysctl net.ipv6.conf.all.disable_ipv6=1 -e "POST_UP=sleep 5 ; ip route add 10.5.0.2/32 dev %i" -e ALLOWED_IPS=0.0.0.0/1,128.0.0.0/1 -e "PRIVATE_KEY=xxx" -d bubuntux/nordlynx

Log:

[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.5.0.2/32 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[#] ip -4 route add 128.0.0.0/1 dev wg0
[#] ip -4 route add 0.0.0.0/1 dev wg0
[#] sleep 5 ; ip route add 10.5.0.2/32 dev wg0
interface: wg0
  public key: xxxx
  private key: (hidden)
  listening port: 51820

peer: xxxxx
  endpoint: 185.220.70.235:51820
  allowed ips: 0.0.0.0/1, 128.0.0.0/1
  latest handshake: 5 seconds ago
  transfer: 252 B received, 180 B sent
  persistent keepalive: every 25 seconds

[onestix]

Looking at this comment here runfalk/synology-wireguard#10 (comment) - it seems that there are indeed issues with using /32 subnet, that is why I have been attempting this with /16...

[PhatTranceUK]

Hi Guys, Have any of you managed to get this working as yet? I will attempt to have a look later and dig a little deeper.

…

On 16 Nov 2021, at 5:23 pm, onestix ***@***.***> wrote:  Looking at this comment here runfalk/synology-wireguard#10 (comment) - it seems that there are indeed issues with using /32 subnet, that is why I have been attempting this with /16... — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.

[onestix]

Hi @PhatTranceUK, unfortunately not yet. Spent an entire day trying every possible DNS entry on Docker itself (--dns=) as well as the DNS env (-e DNS=) within the container, but without any luck. What I noticed is that you are missing the sysctl entries (ip forwarding)- this may be required. I have also tried playing around with the POST_UP and ADDRESS entries, based on recommendations here, but no luck so far.

I know that the Synology wireguard kernel has problems with DNS. This is outlined on the https://github.com/runfalk/synology-wireguard page. Looking at some of the Issues that were raised on the runfalk repo and the DNS related issues posted, I wonder if we could resolve our problem if removing the DNS line from @bubuntux's rootfs/etc/services.d/wireguard/run file:

cat >/etc/wireguard/wg0.conf <<EOL
[Interface]
PrivateKey = ${PRIVATE_KEY}
ListenPort = ${LISTEN_PORT:-51820}
Address = ${ADDRESS:-10.5.0.2/32}
DNS = ${DNS:-103.86.96.100,103.86.99.100}
Table = ${TABLE:-auto}
PreUp = ${PRE_UP}
PostUp = ${POST_UP}
PreDown = ${PRE_DOWN}
PostDown = ${POST_DOWN}

[Peer]
PublicKey = ${PUBLIC_KEY}
AllowedIPs = ${ALLOWED_IPS:-0.0.0.0/0}
Endpoint = ${END_POINT}
PersistentKeepalive = ${PERSISTENT_KEEP_ALIVE:-25}
EOL

I am unfortunately not that versed when it comes to building docker packages so I will not be able to test the above.

Lastly, wanted to share this comment here: runfalk/synology-wireguard#78 (comment) - My problem sounds quite similar. I can't really reach my Synology through the container, but I am able to ping all other internal IPs. I wonder if his solution could be of help us. I am not sure though how to configure those Postrouting rules..

[b-kamphorst]

Hi all,

Special hi to @bubuntux, thanks for yet another great initiative!

I've been trying to get nordlynx running, but also did not succeed on getting it to run successfully on my Synology NAS. This discussion seems to be dedicated to that issue (although the topic name is a bit confusing / it was not supposed to be here). I am very curious to see how we can successfully configure the container / NAS for success. Where possible, I'd like to contribute (spoiler: I'm not even close to being a networking or docker expert).

I wonder if anyone made progress since the last post?

[bubuntux]

yeah, probably create a thread specific for Synology, unfortunately i don't have a synology nas to reproduce the issuse so is up to the community to figure it out a fix.

[b-kamphorst]

Just did so here: #41.

[PhatTranceUK]

Can you not use the virtual DSM that Synology offers? Just an idea. Actually wireguard module needed I guess…. I’ve played around but got bored and reverted back to the old version. Maybe someone specific to synology could share a better solution/ work around for now. Regards, Chris

…

On 14 Dec 2021, at 3:24 pm, Julio Gutierrez ***@***.***> wrote:  yeah, probably create a thread specific for Synology, unfortunately i don't have a synology nas to reproduce the issuse so is up to the community to figure it out a fix. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.