Problems with Wireguard running in Docker container

Hey guys,

I need your help and I hope this is the right forum for it (if not, please move it :)).

Before I begin, this is my machine:

• CPU: Intel J3355 (ASRock J3355-ITX board)
• 8GB RAM
• 128GB Samsung SSD
• OMV version: 5.6.8-1 (Usul)
• Kernel: Linux 5.10.0-0.bpo.5-amd64

So I'm trying to run a Docker container that has a build-in Wireguard client using Portainer. Unfortunately, this doesn't really work.

The log file of my container in Portainer shows this at the end:

...
2021-06-03 20:10:47.739662 [INFO] Starting WireGuard...
Warning: `/config/wireguard/wg0.conf' is world accessible
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.0.7.83/19 dev wg0
[#] ip -6 address add 2a0e:1c80:4:2000::754/64 dev wg0
RTNETLINK answers: Permission denied
[#] ip link delete dev wg0

The file wg0.conf was generated by my VPN provider.

After doing some Google research regarding the error RTNETLINK answers: Permission denied, I found out that it has something to do with Wireguard not being installed on my host system. So I tried to install Wireguard using these commands:

echo "deb http://deb.debian.org/debian buster-backports main" | sudo tee /etc/apt/sources.list.d/buster-backports.list
sudo apt update
sudo apt -t buster-backports install wireguard wireguard-tools wireguard-dkms linux-headers-$(uname -r)
sudo apt install openresolv

This resulted in an error at the end:

Interestingly, when I execute apt install wireguard I get this:

Reading package lists... Done
Building dependency tree
Reading state information... Done
wireguard is already the newest version (1.0.20210223-1~bpo10+1).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

So, I guess Wireguard has been installed. However, my container still doesn't work, the error is still being thrown. And just executing wg or wg status shows nothing

Do you know what's wrong here and can help me fix this? I'd really appreciate it!

Zitat von gderf

You say you are having trouble with a container but I don't see where you mention what container that is or how you configured it?

Yeah, I forgot to mention that. The container I want to create is this one: dyonr/qbittorrentvpn

I used these variables with --privileged:

Zitat von Soma

And the command is: systemctl status wg-quick@wg0.service

Thank you, that showed that wg is installed, that's good

Zitat

● wg-quick@wg0.service - WireGuard via wg-quick(8) for wg0

Loaded: loaded (/lib/systemd/system/wg-quick@.service; disabled; vendor preset: enabled)

Active: inactive (dead)

Docs: man:wg-quick(8)

man:wg(8)

https://www.wireguard.com/

https://www.wireguard.com/quickstart/

https://git.zx2c4.com/wireguar…/about/src/man/wg-quick.8

https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8

Alles anzeigen

Zitat von gderf

Is using Wireguard a requirement or could you use OpenVPN instead?

I do not see the reason why you installed Wireguard on your system. Containers of this type already have the VPN code built into them.

Using WireGuard is optional in this container, but's that's reason why I want to use it: it's supported and I can get higher speeds.

I just purged WireGuard from my host system again and I found the solution (should have Google'd a little longer :D)

The solution is: adding to sysctls values in Portainer for my container before creating it:

- net.ipv4.conf.all.src_valid_mark=1

- net.ipv6.conf.all.disable_ipv6=0

After setting these, the container booted and I could login. Damn, that was tricky

Thank you anyways for helping me guys