notes/tiddlywiki/wireguard with Docker.md

Be sure to have system up to date:

	dnf update

Install kernel headers:

	dnf install -y kernel-headers.x86_64 kernel-devel

Check:

	ls -l /usr/src/kernels/$(uname -r)

Install wireguard kernel module:

	dnf install -y epel-release elrepo-release -y
	dnf install -y kmod-wireguard wireguard-tools

Create persistent directory for container:

	mkdir -p /app/persistent_docker/wireguard
    cd /app/persistent_docker/wireguard

Run container:

	docker run -d \
	  --name=wireguard \
	  --cap-add=NET_ADMIN \
	  --cap-add=SYS_MODULE \
	  -e TZ=Europe/London \
	  -e SERVERURL=ssh.databasepro.eu `#optional` \
	  -e SERVERPORT=51820 `#optional` \
	  -e PEERS=1 `#optional` \
	  -e PEERDNS=auto `#optional` \
	  -e INTERNAL_SUBNET=10.10.10.0 `#optional` \
	  -e ALLOWEDIPS=0.0.0.0/0 `#optional` \
	  -p 7006:51820/udp \
	  -v /app/persistent_docker/wireguard:/config \
	  -v /lib/modules:/lib/modules \
	  --sysctl="net.ipv4.conf.all.src_valid_mark=1" \
	  --restart unless-stopped \
	  ghcr.io/linuxserver/wireguard


At the first run that will create configuration under `/app/persistent_docker/wireguard`

In logfiles, we have the QR-code to use clint side.

A client configuration ready to use is generated under `/app/persistent_docker/wireguard/peer1`

Example configuration server side:

	[Interface]
	Address = 10.10.10.1
	ListenPort = 51820
	PrivateKey = *******************************
	PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
	PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

	[Peer]
	# peer1
	PublicKey = *******************************
	AllowedIPs = 10.10.10.2/32


Example configuration client side:

	[Interface]
	PrivateKey = *******************************
	ListenPort = 51820
	Address = 10.10.10.2/32
	DNS = 10.10.10.1

	[Peer]
	PublicKey = *******************************
	AllowedIPs = 0.0.0.0/0
	Endpoint = ssh.databasepro.eu:41820


In the previous example, the NAT rule has been defined in the router: `ssh.databasepro.eu:41820->(by UDP)->[docker host]:7006`.

> I guess it was something special on my system (maybe because the host is also Name Server) but to make it working I modified `coredns/Corefile` as:

	. {
    	forward . 1.1.1.1  192.168.0.8
	}


If you want use `docker-compose` to start the container,  `docker-compose.yaml`:

	version: "2.1"
	services:
	  wireguard:
	    image: ghcr.io/linuxserver/wireguard
	    container_name: wireguard
	    cap_add:
	      - NET_ADMIN
	      - SYS_MODULE
	    environment:
	      - TZ=Europe/London
	      - SERVERURL=ssh.databasepro.eu #optional
	      - SERVERPORT=51820 #optional
	      - PEERS=1 #optional
	      - PEERDNS=auto #optional
	      - INTERNAL_SUBNET=10.10.10.0 #optional
	      - ALLOWEDIPS=0.0.0.0/0 #optional
	    volumes:
	      - /app/persistent_docker/wireguard:/config
	      - /lib/modules:/lib/modules
	    ports:
	      - 7006:51820/udp
	    sysctls:
	      - net.ipv4.conf.all.src_valid_mark=1
	    restart: unless-stopped

Start the container with `docker-compose`:

	docker-compose up -d

Troubleshooting
---------------

One time, after a kernel upgrade, wireguard stopped to work with the error message:

	iptables v1.6.1: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
	Perhaps iptables or your kernel needs to be upgraded.

Issue solved reloading `iptable_nat` module:

	modprobe iptable_nat
    
To load automaticly this module on system reboot, create the file `/etc/modules-load.d/iptable_nat.conf`  with the following contents:

	iptable_nat