Effortless Wireguard Installation with Docker and Portainer | Zimaboard Server Series
HTML-код
- Опубликовано: 13 июл 2024
- Welcome to the Zimaboard Server Series! In this video, I'll guide you through the seamless installation of Wireguard using Docker and Portainer. Wireguard is a high-performance VPN protocol that ensures secure and fast communication between devices. With Docker and Portainer, you'll be able to easily set up Wireguard on your server without complex configurations or dependencies. Join us as I walk you through the step-by-step process, enabling you to establish a secure and private network effortlessly.
Links:
Techdox Docs - docs.techdox.nz/wireguard/
Docker Hub Links -
hub.docker.com/r/ngoduykhanh/...
hub.docker.com/r/linuxserver/...
Timestamps:
0:00 Introduction
1:00 Install Overview
4:54 Stack Deployment via Portainer
6:36 Wireguard Setup
11:31 Closing Thoughts 
Наука
![Sean Rii, Karyon, Sharzkii - Taungule [My Love] (Official Music Video)](http://i.ytimg.com/vi/eJoMuypbSzQ/mqdefault.jpg)
Check out - ruclips.net/video/SogiBS2gRI8/видео.html For an updated guide for deploying Wireguard
For everyone running into the Wireguard Web-ui issue (not being able to open the page). In the stack creation file. Replace the wireguard image :
wireguard:
image: linuxserver/wireguard:latest
with :
wireguard:
image: linuxserver/wireguard:v1.0.20210914-ls7
It's the last version that doesn't have the game breaking change that changes the conf folders location. It was released in Oct 2023.
Cheers
Thanks!
Thank you kind sir!
Thx
Thanks! Worked 15/12/2023
thank you!
Thanks for the great video. I like your references to previous videos rather than covering the information again.
Thanks! It's getting to a point where if I needed to explain each step in detail for every video I am sure everyone would full asleep haha! Glad you don't mind me referencing them instead.
works like a charm , watch his documentation guys
cool, thanks for information to setup wireguard
No problem 👍
If you are following this - Use the image v1.0.20210914-ls7 as latest is broken it seems
ok i was using latest, let me try again, will report back
k didnt' work, same problem... "Handshake did not complete after 5 seconds, retrying"
it just keeps spitting that out over and over.
My issue is that it kicks my computers off the internet and NEVER connects to my home network at all. Any clues on that one? @@mrosebro
Great Video
Appreciate it! I am enjoying the Zimaboard series
How do you handle split traffic? so that the client only goes through the vpn for the ips in my LAN and not for example to youtube? Also, If I'm using a DDNS, is there a way to use that instead of a static IP?
When I tried to import the file on my Windows laptop, and used my phone as a hotspot, it didn't not connect my laptop to my home network. What steps do I need to take to make that possible to access a home server on a different computer using wireguard?
Thank you for this awesome video, I was following another guide and the wireguard install and usage wasn't clear enough. One question though, I did notice my ISP uses CG-NAT, which if I understand correctly means that I don't have a public static IP, in my case I guess I can use wireguard for the moment but probably tomorrow my IP will change and I won't be able to connect again, I've heard of Tailscale, Cloudflare and Twingate as options, any idea how to setup those or any suggestions about the setup under CG-NAT?
you can try No-IP for updating your public ip .... hope it isn't too late :D
Thank you for this video I used it and set it up and it works well. but could you also show how to make a wireguard internet only client? so if my give my brother access he can use it just to use the internet but not access the devices on my network.
Quick question, i am sorry if i missed this but if you dont have a static IP, will docker/wireguard autocorrect for that or do i manually have to refresh in global settings the endpoint IP? love that video. Thank you for the help.
If you don’t have a static then yeah that will need to be updated when your up changes. I think services like noip or freedns can help here
Thank you for your response. A follow up questions I have a unify dream machine pro, I created two wireguard vpns and im having the same issue with both, one i created in through the unify os, the other following your instructions on docker wireguard portainer. I can connect my devices vpns works fine then in about a day they stop working, i have to delete the clients and add them again then it works again for about a day then does not work any more. Since its happening on both, i think its a setting my my router or firewall. The port in the instruction i have portforwared, and it does work for a day , then i have to delete the clients add them again then it works but only temporary and i have to rinse and repeat. I have looked everywhere and i have no idea what to do or in what direction to look for a solution. I went for my unify wireguard, to making a pivpn raspberry pi, to making this portainer docker wireguard, they all work then stop working and i know my ISP public address is the same, any help i would appreciate so much. Thank you.
@@Techdox
@@Techdox exactly
the server is up and running. i can create and delete users, and i forwareded the port on my router... but i can not connect with any clients... including ones ON my network....
any ideas?
Awesome video! I am trying to set this up in a Proxmox VM. The peer shows up between the Connected Peers, but it cannot reach any local service, nor can access the internet. Moreover, the Last Handshake time is 0001-01-01 00:00:00 UTC. Do you have any idea what I might be missing?
Hey! There's a bit to unpack here so let me try answer what I can :_
The '0001-01-01 00:00:00 UTC' Last Handshake time often indicates that there's an issue with the Wireguard connection. It's possible that the handshake is not being completed properly.
So, you have a Proxmox VM which at the moment can already reach the internet etc and you have it connected to a peer, what is the peer?
Once you switch the VPN on you lose internet access? If so this indicates again that the VPN config is wrong or you have not port forwarded correctly?
Hey@@Techdox , Thank for the quick reply. Yes, you are right, I have a Proxmox VM which can ping any ip/domain on the internet. A peer(an iOS device) is connected to the VPN. When I switch on the VPN, for example I can chat using Facebook messenger, but I cannot make a call, nor can I browse the internet using the phone. Could this be a port forward issue?
Hey @@norberttamas2545,
I had the same issue. I removed the POST UP and POST DOWN script and now it works.
Assumed it would be something other than eth0 for my instance, I have this running on truenas scale with a debian VM, then there is a bridge network for that VM to the host OS (truenasSCALE). But doing docker exec -it containerid sh then ip addr revealed that it was eth0 all along.. Thanks :)
This comment saved me tons of hours debugging! Thank you !
This isnt working for me the web interface does not show up unfortunately
Same here
there is a github issue for this problem, I don't understand why it's not working. please if you find a workaround let us know
Could someone break down the issue for me so I can try reproduce it and look for a fix?
@@Techdox think its linked to docker-wireguard config files changing location to /config/wg_confs/. I got it working by using an older version of docker-wireguard before that update that occurred around 3 weeks ago. Appears wireguard-ui hasnt been updated to include the new path or something
@@jamiei543 Thanks! Will look into this tonight!
It seems that I can connect to my WG server as it transfers a few Bytes of data, but then internet access does not work. Any ideas?
Key things to check, you’re using the recommended WG image, you have port forwarded the correct port and when adding the post up and down scripts you saved it but also clicked apply in the top right corner
I got to the bit of Port Forwarding but what's the IP address? is it the static IP address setup against the computer its installed on?
The Public IP used is you home public IP but if you setup a QR code etc to link to your VPN it should have all the config already defined for you
Are there any prerequisits other than a working instance of portainer and docker? I ran the docker compose file and I can see the containers running, but the connection times out trying to connect to the web UI page (I tried {IP address}:5000 and :5000/login).
As long as you are connecting to the IP address of the server running the containers, that's all you should need. Wireguard also does not require the GUI frontend, so if it causes more issues then not maybe looking at going without the GUI
Same issue here. Was looking through changes with a friend on this and it seems Wireguard may have made some change to the config file location, but haven't investigated further yet.
Same thing happened to me. Have you figured out how to log in?
@@PauloRobertoFh I ran the Nyr/wireguard-install script from Github (commenting out some of the error checking for Distro & Version) and that seemed to solve the issue. I have not been able to test it because I rent my gateway/modem from Comcast & and am waiting for them to let me port forward :/
The commented out section was line 23 through 41, not commenting out the os="debian" line (because that is my distro). I also comment out 54 through 58; you may have to comment out different lines depending on your distro.
At the end of the script I got an error, but I am hoping it was not significant.
Sorry, it probably was not obvious, but I had to connect to the console for the Wireguard docker instance, run vi (vi wireguard-install) to paste the script into a file (i for insert, right-click to paste, (esc), :wq to write & quit), then make said file executable (chmod +x wireguard-install), and run the script file (./wireguard-install). Follow the prompts.
For commenting out, place a # at the beginning of the line...or simply delete that line.
Is it possible to use the installation and your method to connect the Raspberry pi to an already existing external VPN server? I have a Fritzbox at another location i would like to connect to. As far as i can see, your method is acting like a server not a client.
This is just setting up the server, on your exisiting vpn server just add your pi as a client :)
Is linuxserver/wireguard necessary? What if I just use wireguard-ui container in the docker compose file?
linuxserver/wireguard is the actual wireguard service, without it you would just have a frontend UI that could do nothing.
Did you have to purchase a domain for DNS, or did you use a public DNS?
For all my domains, I use paid domains, such as techdox.nz elzim.xyz etc
@@Techdox Nice, I set this up with your video and its been working like a charm bro. Thanks for this. Always wanted to setup a VPN so I can access my Navidrome instance, and its been so sick to access a Spotify clone wherever.
If I wanted to use my own paid domain instead of the default public one, what setting would be changed to handle this to point it to a site's DNS? Rather, how do you handle DNS for your private sites?
Don't need any personal configs etc, just curious for the workflow.
Will this update the ip on when my isp changes it or do I have to do it manually every time?
Manually, this is why static IPs or using a server such as noip are the way to go
@@Techdox do you by chance have a video on that?
It has been requested a bit, so I will add it to my video list on how to use NoIP
hello, I have seen that the new version of ui have more options, and I can not connect, are they some new features that we have to configure?
Confirming you read the posted note and the documentation?
@@TechdoxI have the same problem with wireguard-UI (unrelated to wireguard image v1.0.20210914-ls7 thing), it has more options than what we see in your video, for example there is also a "Pre Down Script" field now, as well as new fields in client settings. UI Status page doesn't see my phone when I connect, no errors showing in containers logs.
Also does this method not need a domain ? I thought I read somewhere we needed one to use wireguard. I would actually like to use one to try and hide my ip since I already have a home server with some stuff hosted with my domain going through nginx reverse proxy
@@Arc.M Seems this video is getting more and more outdated by the day. might need to look at re-doing this
@@Techdox I try the wireguard-ui version ngoduykhanh/wireguard-ui:0.5.2 and is the same of the video, and using the wireguard version v1.0.20210914-ls7 , I can enter but I still can not make the connection.
I am installing it in a vps
I'm using portainer in Porxmox the containers are up and running but the 5000 is blocked?
Hey you most likely found out why but are you running an internal docker registry? These run on port 5000
For some reason doesn't work. Not able to access the web-ui.
Yeah, this is a common issue with a new change it seems, there’s a comment thread below where someone has used an older version and it’s worked
@@Techdox aaaaah the Amazing world of open-source communities! Thanks a lot for the answer anyway.
Good Job, how about if you have NGINX and duckdns?
NGINX Reverse Proxy Manager? The DuckDNS I would need to look into, I have a static IP as managing a dynamic IP became a pain for me. But good question, I'll look into it
Thanks
When I try to connect to the VPN I don't get any error message and I have no internet.
Also my device does not show up in status tab as connected.
What could be wrong?
Sorry for the late response, did you sort it?
How can I use internal/local area network DNS while connected?
You will need to setup so WireGuard knows to use that DNS in the config. So in the DNS options point it to for example your Pihole or what ever is running your local dns
Great video. If anyone had difficulties logging in to the Web UI as I did please try the empty password (yes, even if you set one in the WGUI_PASSWORD). And a side question from someone that would like to have the persistent VPN tunnel 24/7. Does anyone have recommendations for another dynamic DNS container (+free dyndns service) that would be reliable and easy to setup on portainer?
You raise a good point around DNS and having a static IP. I forget about this since I have a static IP address setup at home.
I think I will cover how to use the freeDNS etc to get a 'static' ip address so our community can follow these guides without issues.
WireGuard with reverse Ngix proxy ? wil it work
Did you end up testing this?
I dont see installation via Docker?
Hey, so the compose file can be deployed directly via the command line using docker like I have shown in many of my videos, in this example we deployed it using Portainer which is still using docker.
If you have the compose file you can run docker-compose up -d to deploy it
Thanks for this. I wanted to run wireguard on my pi to provide vpn access when I'm out of the house / country. This works fine.
I'm finding however that when I connect with this setup I can only access my home server and not external stuff like google/reddit/you name it until I turn off the vpn. I'm still learning docker & while I'm no network engineer I have some basic knowledge - but the fact that it's now wrapped in another layer of complexity due to docker is making it hard to pin point the issue.
My companies vpn allows both simultaneously on my work laptop which is what I want. I don't know if I messed something up.
This is something I have heard twice now, I’m running this VPN in the exact same setup. I’m going to have a look into this and see if there is any difference between this setup and what I have
So, I ran through this from start to finish and got my connection working fine with Google and internal addresses.
In my documentation - bookstack.elzim.xyz/books/self-hosting/page/wireguard-docker-setup, did you do the IP tables section? The post up and post down, and also apply the config which requires a Wireguard restart, it does it for you though.
@@Techdox - yeah, I copied and pasted so it should have been fine. I can only think now that I may have done somethings as root by accident which is stopping things getting updated. Will tear it all down and start again - I've been trying someother things too. If I just run wireguard container by itself I could get everything working... but then didn't have the nice gui.
@@Greeata yeah, can always install it via CLI rather than a container or use PiVPN maybe. Few options but yeah, my guide should be start to finish without any extra steps
@@Techdox - It may have been the iptables thing that did me in. I'm doing this on a raspberry pi4 and when I did it from the command line with a docker-compose.yml file it didn't have any of the post up/down stuff (firewall stuff I'm guessing). I just took my old working yml and then stitched on the ui part onto it and it seems to be working. Thanks for the tips! appreciate it.
I really wanted this to work but it didn't. Same results as all the other guides. I get a handshake but no data.
Hey, check out my latest video, it’s the pinned comment. I remade the video as this is getting outdated
I don't understand how people are getting past the issue of not being able to connect to the network you are vpn ing from
Hey what issue are you hitting exactly?
@@Techdox I finally figured out that for some reason the gui didn't apply the post up post down commands correctly. So I ended up being able to connect to the vpn, but I had no network. When using the version you specified in your docs, it finally applied the commands to the config and now seem to work. I forgo to update my comment. Spent a good few hours trying to figure that out, then I decided to follow your written guide step by step and that seemed to work, so I thank you for the tips about potential issues in the latest build.
first off, thanks for the great vid. I love the web UI as it makes things so easy. I have run into a problem, though. I'm hoping you can help me. See below:
Uname info: Linux 15656a999d26 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 x86_64 GNU/Linux
**** It seems the wireguard module is already active. Skipping kernel header install and module compilation. ****
**** Client mode selected. ****
[custom-init] No custom files found, skipping...
**** Disabling CoreDNS ****
Warning: `/config/wg0.conf' is world accessible
wg-quick: `wg0' already exists
s6-rc: warning: unable to start service svc-wireguard: command exited 1
The webUI works just fine and I was able to add the up and down commands and apply the config, but everytime I start the stack, I get the above error in the wireguard container. I'm pretty sure this is why it does not work on my phone when I connect to the VPN via the app.
That's interesting, feel free to join the Discord if you have it and we can help you there - Discord Channel - discord.com/invite/8mX2KRxDw8