Port Forward?

[JohnGalt1717]

Expected Behavior

I should be able to give a list of ports and destination IPs/docker containers to forward ports to for incoming traffic on the wireguard client.

Current Behavior

Doesn't appear to be possible to handle port forwarding.

[aptalca]

you can use an nginx reverse proxy for that

[JohnGalt1717]

Care to elaborate? I have a wire guard client connected to a vpn service. They forward a port, which should go to the wire guard client docker container itself. Even if I use nginx, it's not clear how I'd get the wireguard docker container to forward the port to nginx (or anything else) because it's just going to die inside the docker container because it doesn't know where to send the traffic that wasn't initiated internally.

[aptalca]

This is not a bug, but a question about how to set up something custom.

In a nutshell, you'd have the other container use wireguard client's network stack. Then you can either have the container listen on that port, or have nginx listen on that port and reverse proxy. There are other methods as well, but all are beyond the scope of this. We don't officially provide support for that.

Feel free to drop by our discord to discuss.

[JohnGalt1717]

It's a feature request not a how-to. I've tried what you suggested, and it didn't work if there were multiple docker containers as clients.

I.e:

Wireguard Client
Container A
Container B port 5597 open
Container C

The Wireguard client needs to forward incoming traffic on 5597 to Container B, nothing else.

This would need to also work for:

Wireguard Client
IP Address 1
IP Address 2 port 5597 open
IP Address 3

It should forward by IP address in that case outside of the container.

Presumably this would setup IP tables based on the environment variables passed to go and redirect the ports properly.

[julianpoy]

FYI if anyone else stumbles across this issue - You can enable external traffic coming in through VPN on a given port by adding this to the PostUp and PreDown section of your wg0.conf:

PostUp = FORWARDEDPORT=1234; iptables -A INPUT -i wg0 -p udp --dport $FORWARDEDPORT -j ACCEPT; iptables -A INPUT -i wg0 -p tcp --dport $FORWARDEDPORT -j ACCEPT; ...rest of your PostUp config...
PreDown = FORWARDEDPORT=1234; iptables -D INPUT -i wg0 -p udp --dport $FORWARDEDPORT -j ACCEPT; iptables -D INPUT -i wg0 -p tcp --dport $FORWARDEDPORT -j ACCEPT; ...rest of your PreDown config...

Where 1234 is your port (perhaps given to you by your VPN provider).
Note the "...rest of your PostUp config..." at the end of both of those lines.

[JohnGalt1717]

@julianpoy Thanks! How does one specify the dns or ip of the docker container or other destination?

[julianpoy]

If you're using the service:containername pattern, the other container should be bound to the same network stack and should work without any changes.

If you're using a user-defined network, you'll have to add some rules to forward to the desired container IP.

[undaunt]

@julianpoy I am attaching my wireguard container to my Traefik reverse proxy network, with a static IP, and am then funneling the linuxserver qbittorrent container through it via network_mode: service:wireguard. With a combination of your PostUp and PreDown above, combined with the suggested LAN access, I believe I have it working.

I can hit qBit at my subdomain, all my subdomains still reflect their Cloudflare IPs via ping, but doing a docker exec -ti qb bash -c 'curl https://am.i.mullvad.net/connected' gives me a proper Mullvad IP whereas any other container that isn't qbit or wireguard is giving my home IP.

Last thing to determine is if the port forwarding works on the torrent client properly as I cannot seem to get netcat working to test Mullvad's port checker tool. To forward the Wireguard traffic through my router/etc., would I need to port forward the wireguard port of 51820 instead of my prior qBit port of 51419? Thanks very much. Relevant compose:

# Wireguard VPN - Client Mode
  wireguard:
    image: ghcr.io/linuxserver/wireguard
    container_name: wireguard
    restart: unless-stopped
    networks:
      traefik-proxy:
        ipv4_address: 192.168.50.100
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    security_opt:
      - no-new-privileges
    ports:
      - "51820:51820/udp"
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
    volumes:
      - ${DOCKERDIR}/wireguard:/config # Drop your provider conf in as wg0.conf
      - /lib/modules:/lib/modules
    environment:
      - TZ
      - PUID
      - PGID

# qBittorrent - Torrent Downloader - Private Trackers
  qb:
    image: linuxserver/qbittorrent
    container_name: qb
    restart: unless-stopped
    network_mode: service:wireguard
    #networks:
    #  - $TRAEFIK_NETWORK
    security_opt:
      - no-new-privileges
    #ports:
    #  - "51419:51413"
    #  - "51419:51413/udp"
    volumes:
      - ${DOCKERDIR}/qb:/config
      - ${DLDIR}:/downloads
      - ${DLDIR}/watched/general:/watched
      - ${DLDIR}/torrents/general:/torrents
    environment:
      - TZ
      - PUID
      - PGID
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.qb-rtr.entrypoints=https"
      - "traefik.http.routers.qb-rtr.rule=Host(`qb.$DOMAINNAME`)"
      ## Middlewares
      - "traefik.http.routers.qb-rtr.middlewares=chain-authelia@file"
      ## HTTP Routers
      - "traefik.http.routers.qb-rtr.service=qb-svc"
      - "traefik.http.services.qb-svc.loadbalancer.server.port=8080"

[JohnGalt1717]

The problem with using service:wireguard is that if the wireguard endpoint goes down, it almost always crashes the other containers that are linked with service:wireguard.. Hence why I'd like to create a docker network for them and then have it redirect traffic to the specified container that isn't dependant on the service:wireguard but also have that network have a gateway of the wireguard client docker.

[ZeroPain]

The problem with using service:wireguard is that if the wireguard endpoint goes down, it almost always crashes the other containers that are linked with service:wireguard.. Hence why I'd like to create a docker network for them and then have it redirect traffic to the specified container that isn't dependant on the service:wireguard but also have that network have a gateway of the wireguard client docker.

If you find a way please let me know or post

[thespad]

The problem with using service:wireguard is that if the wireguard endpoint goes down, it almost always crashes the other containers that are linked with service:wireguard.. Hence why I'd like to create a docker network for them and then have it redirect traffic to the specified container that isn't dependant on the service:wireguard but also have that network have a gateway of the wireguard client docker.

That should never happen as Wireguard doesn't have any concept of an endpoint going down and will continue sending traffic regardless. Child containers would lose internet access but if that's enough to crash them then the applications running in those containers are bad.

[BrodyStone21]

Quick question; I'm also trying to get port forwarding set up. I have added custom IP routing in the config file like mentioned above, do I need to also add -p portnumber:portnumber to my container? Which one? I have a qbittorrent container that's using my wireguard container as its network.

If anyone has any ideas let me know!

[undaunt]

@BrodyStone21 I've since gotten this working, with forwarding as well as webUI with Traefik. The key is to forward the forwarded port of your VPN provider on the Wireguard container and not the torrent container, and then also ensure the torrent container uses that port for traffic.

Separately, ensure the webui port of the torrent client is set with your reverse proxy of choice, in my case Traefik.

# Wireguard - Performant VPN
  wireguard:
    image: ghcr.io/linuxserver/wireguard
    container_name: wireguard
    restart: always
    networks:
      - $TRAEFIK_NETWORK
    security_opt:
      - no-new-privileges:true
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=1
    ports:
      - 51820:51820
      - $WG_QB_PORT:$WG_QB_PORT
    volumes:
      - $DOCKERDIR/wireguard:/config
      - /lib/modules:/lib/modules
    environment:
      - TZ
      - PUID
      - PGID
    labels:
      ## Disable watchtower automatic updates to keep VPN online
      - com.centurylinklabs.watchtower.enable=false
      ## Enable Traefik
      - traefik.enable=true
      ## HTTP Routers
      - traefik.http.routers.qb-rtr.entrypoints=https
      - traefik.http.routers.qb-rtr.rule=Host(`qb.$DOMAINNAME`)
      ## Middlewares
      - traefik.http.routers.qb-rtr.middlewares=chain-authelia@file
      ## HTTP Services
      - traefik.http.routers.qb-rtr.service=qb-svc
      - traefik.http.services.qb-svc.loadbalancer.server.port=$WG_QB_PORT

# qBittorrent - Torrent Downloader
  qb:
    image: ghcr.io/linuxserver/qbittorrent
    container_name: qb
    restart: unless-stopped
    network_mode: service:wireguard
    security_opt:
      - no-new-privileges:true
    depends_on:
      - wireguard
    volumes:
      - $DOCKERDIR/qb:/config
      - $DLDIR:/downloads
      - $DLDIR/watched:/watched
      - $DLDIR/torrents:/torrents
    environment:
      - TZ
      - PUID
      - PGID
      - WEBUI_PORT=$WG_QB_PORT # Listening port 54819

[BrodyStone21]

@undaunt so lets say I have forwarded port 1234, should I go to my wireguard docker container and do -p 1234:1234 and then set QB to listen on that port? Is that it or am I missing something?

I just made a Reddit post here with all of my configs if you wouldn't mind taking a look I would appreciate it!