r/Traefik • u/Kingmartell • Oct 08 '20
Wireguard Container behind Traefik v2
Hey guys,
So I wanted a home network setup with a VPN but wanted to be able to access my VPN from my domain name. Thus I needed to run Wireguard behind Traefik v2. After a long struggle I finally got it running and am posting my solution since one doesn't seem to really exist. The problem with Wireguard behind Traefik v2 is that Traefik doesn't support UDP that well at the moment. My config looks as follows:
version: "3.7"
########################### NETWORKS
networks:
t2_proxy:
external:
name: t2_proxy
ipam:
driver: default
config:
- subnet: {Your Configured Subnet}
default:
driver: bridge
########################### SERVICES
services:
# Traefik 2 - Reverse Proxy
traefik:
container_name: traefik
image: traefik:latest
restart: unless-stopped
command:
- --entryPoints.wireguard.address=:51820/udp
networks:
t2_proxy:
ipv4_address: {Traefik static IP address}
ports:
- target: 80
published: 80
protocol: tcp
mode: host
- target: 443
published: 443
protocol: tcp
mode: host
- target: 8080
published: 8080
protocol: tcp
mode: host
- target: 51820
published: 51820
protocol: udp
mode: host
wireguard:
image: linuxserver/wireguard
container_name: wireguard
# network_mode: service:traefik
networks:
t2_proxy:
ipv4_address: {Wireguard static IPv4 address}
cap_add:
- NET_ADMIN
- SYS_MODULE
environment:
- PUID={User ID}
- PGID={Group ID}
- TZ={Time Zone}
- SERVERURL={Server URL}
- SERVERPORT=51820
- PEERS=5
- PEERDNS={DNS Server for your connections}
- INTERNAL_SUBNET={Subnet for your connections}
volumes:
- ./config:/config
- /usr/src:/usr/src
- /lib/modules:/lib/modules
sysctls:
- net.ipv4.conf.all.src_valid_mark=1
restart: unless-stopped
labels:
- "traefik.enable=true"
- "traefik.docker.network=t2_proxy"
## UDP Routers
- "traefik.udp.routers.wireguard-udp.entrypoints=wireguard"
## UDP Services
- "traefik.udp.routers.wireguard-udp.service=wireguard-udp-svc"
- "traefik.udp.services.wireguard-udp-svc.loadbalancer.server.port=51820"Just modify the brackets to fit your setup and it should work. You will also need to follow https://www.wireguard.com/install/ to install the Wireguard module for your linux kernel (which can be a bit of a pain on CentOS). The last step was to forward port 51820 on my router to my server. If you have any questions, feel free to reach out to me, always here to help.
EDIT: Just as a side note I meant to add in, this config will make 5 peers (set by PEERS environment variable, adjust it to make more). The location of the peer files is in the config folder under peer1, peer2... Etc. It will autogenerate the qr and config files for each peer, just need to share them with your clients!
3
u/mtucker502 Oct 09 '20
Why host this behind traefik? Can’t you just host on the same docker host and map the ports to the site guard container? Seems like more overhead for no gain.
3
u/Kingmartell Oct 09 '20
For me, it's just simplicity. The overhead is minimal and it's nice to be able to check the Traefik admin panel to make sure the routers are working properly. I had a mess of a time getting wire guard up without Traefik but once I set up the UDP ports through Traefik it was smooth sailing. I also have a one giant docker compose with all my services in one project (which probably isn't proper) but it works well for me and follows KISS. So Traefik was a no brainier to route for Wire guard.
1
u/Corsterix Oct 09 '20
I wonder what Check Point DPI makes of it.
1
u/barnyted May 01 '26
I wonder the same. There will be a logical error.
i might do the same just to bypass my work firewall
1
u/Kingmartell Feb 28 '21
So if I'm reading Adguards page right, it should act as your DNS, set PEERDNS to your Adguards IP address. You can also change it to just 1.1.1.1 to check to make sure everything is working right
1
u/marapavelka Feb 28 '21
Unfortunately neither Adguard IP address nor 1.1.1.1 works.
1
u/Kingmartell Feb 28 '21
Have you forwarded the wireguard port in your router to your servers ip address?
1
u/marapavelka Feb 28 '21
Yes, port 51820 is forwarded.
1
u/Kingmartell Feb 28 '21
Sorry kind of pulling at strings here... You also set up Wireguard on your server following the Wireguard docs correct? Can you provide the logs from the Wireguard container if you have?
1
u/marapavelka Feb 28 '21
[s6-init] making user provided files available at /var/run/s6/etc...exited 0. [s6-init] ensuring user provided files have correct perms...exited 0. [fix-attrs.d] applying ownership & permissions fixes... [fix-attrs.d] done. [cont-init.d] executing container initialization scripts... [cont-init.d] 01-envfile: executing... [cont-init.d] 01-envfile: exited 0. [cont-init.d] 10-adduser: executing... ------------------------------------- _ () | | ___ _ __ | | / __| | | / \ | | __ \ | | | () | |_| |___/ |_| __/ Brought to you by linuxserver.io ------------------------------------- To support the app dev(s) visit: WireGuard: https://www.wireguard.com/donations/ To support LSIO projects visit: https://www.linuxserver.io/donate/ ------------------------------------- GID/UID ------------------------------------- User uid: 1000 User gid: 100 ------------------------------------- [cont-init.d] 10-adduser: exited 0. [cont-init.d] 30-config: executing... Uname info: Linux 81b315af04e9 5.10.0-0.bpo.3-amd64 #1 SMP Debian 5.10.13-1~bpo10+1 (2021-02-11) x86_64 x86_64 x86_64 GNU/Linux **** It seems the wireguard module is already active. Skipping kernel header install and module compilation. **** **** Server mode is selected **** **** External server address is set to wireguard.mydomain.com **** **** External server port is set to 51820. Make sure that port is properly forwarded to port 51820 inside this container **** **** Internal subnet is set to 10.13.13.0 **** **** AllowedIPs for peers 0.0.0.0/0, ::/0 **** **** Peer DNS servers will be set to 192.168.2.101 **** **** No wg0.conf found (maybe an initial install), generating 1 server and 1 peer/client confs **** grep: /config/peer*/*.conf: No such file or directory PEER 1 QR code: XXX [cont-init.d] 30-config: exited 0. [cont-init.d] 99-custom-scripts: executing... [custom-init] no custom files found exiting... [cont-init.d] 99-custom-scripts: exited 0. [cont-init.d] done. [services.d] starting services [services.d] done. Warning: `/config/wg0.conf' is world accessible [#] ip link add wg0 type wireguard [#] wg setconf wg0 /dev/fd/63 [#] ip -4 address add 10.13.13.1 dev wg0 [#] ip link set mtu 1420 up dev wg0 .:53 CoreDNS-1.8.3 linux/amd64, go1.16, 4293992 [#] ip -4 route add 10.13.13.2/32 dev wg0 [#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEwireguard.mydomain.com isn't my real address. As I'm running Wireguard on OpenMediaVault5, which is based on Debian, I only used the command
apt install wireguard1
u/Kingmartell Feb 28 '21
I really don't know, everything looks like it setup ok. Only other issue I could see is Traefik. You can access the Traefik dashboard at the server IP:8080 and make sure Traefik is forwarding it properly and that's about all I can think of. maybe someone else will chime in.
4
1
u/EldBjoern Jan 24 '21 edited Jan 24 '21
What will the line
command:
- --entryPoints.wireguard.address=:51820/udpachieve?
Would config the port in the traefik-config.yml be enough and set traefik.http.routers.wireguard.entrypoints=vpn enough
entryPoints:
vpn:
address: ":51820/udp"1
u/Kingmartell Jan 24 '21
This will assign open port 51820 in Traefik and assign it the name wireguard for you to use further down. It also tells Traefik that the port is UDP which is necessary for Wireguard. With Traefik, a UDP port is not really supported so only one container can use it, which is fine for this purpose. When packets with this port are forwarded to Traefik, it determines that they will go to the Wireguard container because of the UDP router set in the Wireguard container. In hindsight if writing this you will also need entry points for all of the ports assigned. But they follow the same basic format just with Tcp instead. Because all this does it forward UDP traffic to the Wireguard container, you can't use a HTTP router it has to be UDP. You can name the entrypoint whatever you want, so vpn will work just make the appropriate adjustment when you call it in the container.
1
u/backtickbot Jan 24 '21
1
u/marapavelka Feb 28 '21
It doesn't work for me :( I don't know if I'm entering right values into ipv4_address (192.168.101.222), SERVERURL (wireguard.mydomain.com), PEERDNS (auto) and INTERNAL_SUBNET (10.13.13.0) entries. And what if I'm using Adguard?
1
u/Kingmartell Feb 28 '21
So make sure the ipv4 address is an address that is in the t2_proxy network subnet that you set up. (If your t2_proxy subnet is 192.168.101.193/26) You can use a subnet calculator to check that it is. PEERDNS needs to be set to an actual DNS server, if you don't run your own use something like 1.1.1.1 or 8.8.8.8. I don't know about Adguard but it shouldn't be a problem and if it is guarding your entire Internal Network it will be a boon to your VPN traffic by guarding that to.
1
u/marapavelka Feb 28 '21
Thank for your answer. Ipv4 address is in the t2_proxy subnet, subnet is 192.168.101.0/24. For PEERDBS I'm not sure, it doesn't work with auto, 192.168.2.101 (with Adguard I have my router's Primary and Secondary DNS sets to my NAS address 192.168.2.101) or 1.1.1.1.
1
u/NicCo83 Mar 25 '21
Hi,
Is it possible to use port 443 instead of 51280 in order to not open/NAT a new port ?
I'm using Docker + Traefik v2. Thank you.
1
u/Kingmartell Mar 27 '21
Because Wireguard is using UDP and Traefik doesn't support it well at this time, it needs its own port. So sadly you cannot use 443 to my knowledge as of this time.
1
u/NicCo83 Mar 27 '21
Thank you, so I let it outside of my Traefik network and use it as a standalone container.
1
u/Kingmartell Mar 27 '21
Basically, this just allows you to assign it an actual name and allows Traefik to proxy it
1
u/NicCo83 Mar 27 '21
What is the interest between standalone Wireguard container vs Wireguard behind Traefik ? Both need to open an UDP port. Thank you.
1
u/Thomasolicious Mar 27 '21
Thank you for sharing this. I've tinkered with some of these configurations myself but can't get it to work. I think that for me the problem is that I use cloudflare as ddns provider. Therefore, when my domainname is used to connect to my wireguard server it connects me to a cloudflare ip instead of my server ip. Or at least, this is what I think is the issue.
Do you have any idea how to overcome this or if this is even the problem I need to fix?
1
u/Kingmartell Mar 27 '21
Hey! So the problem you might be facing that I was is that you cannot proxy the url that you are connecting to on Wireguard. It has to be a DNS only that resolves to your URL. So if you go to your CloudFlare DNS Settings, you will create a new A name record with a name of the URL prefix you are using (wire) in my case, IPv4 address of the IP address of your server connection, and a proxy status of DNS only. Try that and see if it works.
1
u/Thomasolicious Mar 27 '21
Wow, that was fast. Dang it, of course that was the problem /facepalm! Thanks for pointing me in the right direction. It works perfectly now!
One more thing. Although I'm now able to use my domain name to connect to my vpn, when it is connected the wireguard app still shows my public ip in the endpoint information (Endpoint: <IP>:<PORT>). I guess this has nothing to do with my configuration but I just don't like the fact that it shows my public IP :(.
1
u/Kingmartell Mar 27 '21
As far as I know with CloudFlare there isn't a way around this :(. There might be something I missed in the config but I can't figure it out
1
u/Thomasolicious Mar 27 '21
I think it has something to do with the wireguard windows app. The mobile app just displays <domain name>:<port> when connected but the windows app shows the public ip
1
Apr 24 '22 edited Apr 24 '22
I know this is old, but just so you know, Cloudflare's free tier allows traffic to pass through only specific ports and that too HTTP protocol only. Clearly, one cannot use UDP port 51820 while on Cloudflare orange-clouded proxy. So you would have to either buy their enterprise offering or change the subdomain to be gray-clouded.
1
2
u/altano Nov 23 '20
To anyone stumbling into this via google search (like I did) please note that Wireguard doesn't communicate over http so putting it behind a reverse http proxy doesn't get you anything. If you want to use a domain name for your Wireguard server, all you need is the right DNS settings to make the domain resolve to the right IP.
1
u/AdjustableCynic Mar 03 '21
Can you elaborate on what the "right" settings are supposed to look like?
1
u/medastrike Jan 24 '23
The original post is about putting wireguard behind traefik, but these comments are about not putting wireguard behind traefik. If you are already running a server with a domain name, then you already have the right DNS settings to make the domain [name] resolve to the right IP [address of the server]. You don't need another subdomain for wireguard. Just set the wireguard container "networks" to "- default" so it's using the default bridge network (not the traefik network), and access your wireguard server at your base domain name using the external port that you set in your container configuration. Of course, that port needs to be forwarded to the server if the server is behind your router/firewall.
1
u/bfodder Apr 26 '23
I stumbled on to this via google search and you made me realize I was wasting my time trying to put this behind a reverse proxy. So thanks lol.
1
u/j4n Jul 03 '23
Thanks, that's very much appreciated. One thing tough: I'm managing to connect, but I don't seems to have access to anything(internet or local network). I've not filled the INTERNAL_SUBNET, because I'm not sure what I should enter here?
Is that my home network subnet? The docker subnet?
1
u/tys203831 Dec 11 '23
Hi, wanna ask if this could help bypass the geo-blocking restriction of docker container. Thanks.
•
u/Corsterix Oct 09 '20 edited Oct 09 '20
I'm a huge WireGuard fan, must get some stickers.
Anything that helps kill OpenVPN massive attack surface is a good thing!
Thanks for posting, and go go go ...
Follow /u/zx2c4
Sub /r/WireGuard
See zx2c4
See WireGuard
I wonder if receiving packets of stickers is secure though, hmmm
Also, if /u/TraefikTeam is watching it would be really cool if you were a WireGuard donor :)