You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Replace linuxserver.io header badges and boilerplate with a fork
notice block pointing back to upstream for unrelated issues.
* Add "Changes from upstream" section summarising the single delta
(IP6_SUBNET / IPv6 GUA support) and linking to the detailed section.
* Add full "IPv6 GUA Support" section with host-mode and bridge-mode
setup instructions, complete docker-compose examples, and notes on
ephemeral host routes and required router configuration.
* Add IP6_SUBNET to both the docker-compose and docker cli example
blocks, the Parameters table, and the Server Mode regeneration-
trigger variable list.
* Update image references throughout from lscr.io/linuxserver/wireguard
to ohshitgorillas/wireguard; update git clone URL in "Building
locally" to point at this fork.
* Remove linuxserver-specific sections: Docker Mods badge block,
upstream image version check, Diun update-notification tip, and the
generic "most of our images are static" preamble in Updating Info.
* Retain references to linuxserver docs/utilities that are still valid
(read-only docs, qemu-static image, historical changelog entries).
https://claude.ai/code/session_01QdSdYNzFJjZVymw6NNbGP5
[](https://blog.linuxserver.io"all the things you can do with our containers including How-To guides, opinions and much more!")
6
-
[](https://linuxserver.io/discord"realtime support / chat with the community and the team.")
7
-
[](https://discourse.linuxserver.io"post on our community forum.")
8
-
[](https://github.com/linuxserver"view the source for all of our repositories.")
9
-
[](https://opencollective.com/linuxserver"please consider helping us by either donating or contributing to our budget")
10
-
11
-
The [LinuxServer.io](https://linuxserver.io) team brings you another container release featuring:
12
-
13
-
* regular and timely application updates
14
-
* easy user mappings (PGID, PUID)
15
-
* custom base image with s6 overlay
16
-
* weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth
17
-
* regular security updates
18
-
19
-
Find us at:
20
-
21
-
*[Blog](https://blog.linuxserver.io) - all the things you can do with our containers including How-To guides, opinions and much more!
22
-
*[Discord](https://linuxserver.io/discord) - realtime support / chat with the community and the team.
23
-
*[Discourse](https://discourse.linuxserver.io) - post on our community forum.
24
-
*[GitHub](https://github.com/linuxserver) - view the source for all of our repositories.
25
-
*[Open Collective](https://opencollective.com/linuxserver) - please consider helping us by either donating or contributing to our budget
> **Fork notice:** This is a community fork of [linuxserver/docker-wireguard](https://github.com/linuxserver/docker-wireguard).
4
+
> It is **not** an official LinuxServer.io image. Issues specific to this fork (IPv6 GUA support) should be
5
+
> filed here. General WireGuard container issues should be reported [upstream](https://github.com/linuxserver/docker-wireguard/issues).
38
6
39
7
[WireGuard®](https://www.wireguard.com/) is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.
This fork adds one feature on top of the upstream linuxserver image:
44
14
45
-
We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://distribution.github.io/distribution/spec/manifest-v2-2/#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
15
+
***IPv6 GUA (Global Unicast Address) support** — set the `IP6_SUBNET` environment variable to give the WireGuard tunnel a dual-stack (IPv4 + IPv6) configuration. The server gets `::1/128`; peers are assigned sequential `/128` addresses (`::2`, `::3`, …). The feature is entirely opt-in: omitting `IP6_SUBNET` produces behaviour identical to upstream. See the[IPv6 GUA Support](#ipv6-gua-global-unicast-address-support) section below for full setup instructions.
46
16
47
-
Simply pulling `lscr.io/linuxserver/wireguard:latest` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
17
+
Everything else — base image, s6 init, CoreDNS, key management, QR code generation — is unchanged from upstream.
18
+
19
+
## Supported Architectures
20
+
21
+
This fork is not published to a container registry. Build the image locally using the instructions in [Building locally](#building-locally). The upstream linuxserver image supports multi-platform builds via Docker manifest; the same applies here.
48
22
49
23
The architectures supported by this image are:
50
24
@@ -67,7 +41,7 @@ Some hosts may not load the iptables kernel modules by default. In order for the
67
41
68
42
If the environment variable `PEERS` is set to a number or a list of strings separated by comma, the container will run in server mode and the necessary server and peer/client confs will be generated. The peer/client config qr codes will be output in the docker log if `LOG_CONFS` is set to `true`. They will also be saved in text and png format under `/config/peerX` in case `PEERS` is a variable and an integer or `/config/peer_X` in case a list of names was provided instead of an integer.
69
43
70
-
Variables `SERVERURL`, `SERVERPORT`, `INTERNAL_SUBNET`, `PEERDNS`, `INTERFACE`, `ALLOWEDIPS`and `PERSISTENTKEEPALIVE_PEERS` are optional variables used for server mode. Any changes to these environment variables will trigger regeneration of server and peer confs. Peer/client confs will be recreated with existing private/public keys. Delete the peer folders for the keys to be recreated along with the confs.
44
+
Variables `SERVERURL`, `SERVERPORT`, `INTERNAL_SUBNET`, `PEERDNS`, `INTERFACE`, `ALLOWEDIPS`, `PERSISTENTKEEPALIVE_PEERS`and `IP6_SUBNET` are optional variables used for server mode. Any changes to these environment variables will trigger regeneration of server and peer confs. Peer/client confs will be recreated with existing private/public keys. Delete the peer folders for the keys to be recreated along with the confs.
71
45
72
46
To add more peers/clients later on, you increment the `PEERS` environment variable or add more elements to the list and recreate the container.
73
47
@@ -83,6 +57,95 @@ Do not set the `PEERS` environment variable. Drop your client conf(s) into the c
83
57
84
58
If you get IPv6 related errors in the log and connection cannot be established, edit the `AllowedIPs` line in your peer/client wg0.conf to include only `0.0.0.0/0` and not `::/0`; and restart the container.
85
59
60
+
## IPv6 GUA (Global Unicast Address) Support
61
+
62
+
WireGuard supports optional dual-stack (IPv4+IPv6) tunnel configuration via the `IP6_SUBNET` environment variable. When set, both the server and all peers receive an IPv6 GUA address in addition to their IPv4 address. IPv6 is disabled by default; existing IPv4-only configurations continue to work without modification.
63
+
64
+
`SYS_MODULE` capability **must** be added to `cap_add` when using IPv6. A static IPv6 route must also be configured on your router pointing `IP6_SUBNET` to your host — this is required for both host and bridge modes. Without the router route, IPv6 traffic will not reach your WireGuard peers.
65
+
66
+
### Host Mode
67
+
68
+
Enable IPv6 forwarding on the host by adding the following sysctls to your docker-compose:
69
+
70
+
```yaml
71
+
sysctls:
72
+
- net.ipv4.conf.all.src_valid_mark=1
73
+
- net.ipv6.conf.all.disable_ipv6=0
74
+
- net.ipv6.conf.all.forwarding=1
75
+
```
76
+
77
+
Configure a static IPv6 route on your router pointing `IP6_SUBNET` to the host device IP.
78
+
79
+
Example (host mode):
80
+
81
+
```yaml
82
+
services:
83
+
wireguard:
84
+
image: ohshitgorillas/wireguard:latest
85
+
container_name: wireguard
86
+
network_mode: host
87
+
cap_add:
88
+
- NET_ADMIN
89
+
- SYS_MODULE
90
+
volumes:
91
+
- /path/to/wireguard/config:/config
92
+
- /lib/modules:/lib/modules
93
+
sysctls:
94
+
- net.ipv4.conf.all.src_valid_mark=1
95
+
- net.ipv6.conf.all.disable_ipv6=0
96
+
- net.ipv6.conf.all.forwarding=1
97
+
environment:
98
+
- PEERS=3
99
+
- SERVERURL=wireguard.domain.com
100
+
- IP6_SUBNET=2001:db8:b00b:420::
101
+
- PEERDNS=8.8.8.8,2001:4860:4860::8888
102
+
restart: unless-stopped
103
+
```
104
+
105
+
### Bridge Mode
106
+
107
+
Create an external Docker network with IPv6 support:
Add a static IPv6 route on the host pointing `IP6_SUBNET` to the Docker network gateway. **Note:** host routes added via `ip route` are ephemeral — you must make them persistent via your system's network configuration or they will be lost on reboot.
114
+
115
+
```bash
116
+
sudo ip -6 route add 2001:db8:b00b:420::/64 via <docker_network_gateway>
117
+
```
118
+
119
+
Configure a static IPv6 route on your router pointing `IP6_SUBNET` to the host device IP.
120
+
121
+
Example (bridge mode):
122
+
123
+
```yaml
124
+
services:
125
+
wireguard:
126
+
image: ohshitgorillas/wireguard:latest
127
+
container_name: wireguard
128
+
cap_add:
129
+
- NET_ADMIN
130
+
- SYS_MODULE
131
+
ports:
132
+
- 51820:51820/udp
133
+
volumes:
134
+
- /path/to/wireguard/config:/config
135
+
- /lib/modules:/lib/modules
136
+
networks:
137
+
wireguard_net:
138
+
environment:
139
+
- PEERS=3
140
+
- SERVERURL=wireguard.domain.com
141
+
- IP6_SUBNET=2001:db8:b00b:420::
142
+
- PEERDNS=8.8.8.8,2001:4860:4860::8888
143
+
restart: unless-stopped
144
+
networks:
145
+
wireguard_net:
146
+
external: true
147
+
```
148
+
86
149
## Road warriors, roaming and returning home
87
150
88
151
If you plan to use Wireguard both remotely and locally, say on your mobile phone, you will need to consider routing. Most firewalls will not route ports forwarded on your WAN interface correctly to the LAN out of the box. This means that when you return home, even though you can see the Wireguard server, the return packets will probably get lost.
@@ -141,7 +204,7 @@ To help you get started creating a container from this image you can either use
141
204
---
142
205
services:
143
206
wireguard:
144
-
image: lscr.io/linuxserver/wireguard:latest
207
+
image: ohshitgorillas/wireguard:latest
145
208
container_name: wireguard
146
209
cap_add:
147
210
- NET_ADMIN
@@ -155,6 +218,7 @@ services:
155
218
- PEERS=1 #optional
156
219
- PEERDNS=auto #optional
157
220
- INTERNAL_SUBNET=10.13.13.0 #optional
221
+
- IP6_SUBNET= #optional - e.g. 2001:db8:b00b:420::
158
222
- ALLOWEDIPS=0.0.0.0/0 #optional
159
223
- PERSISTENTKEEPALIVE_PEERS= #optional
160
224
- LOG_CONFS=true #optional
@@ -183,6 +247,7 @@ docker run -d \
183
247
-e PEERS=1 `#optional` \
184
248
-e PEERDNS=auto `#optional` \
185
249
-e INTERNAL_SUBNET=10.13.13.0 `#optional` \
250
+
-e IP6_SUBNET= `#optional - e.g. 2001:db8:b00b:420::` \
186
251
-e ALLOWEDIPS=0.0.0.0/0 `#optional` \
187
252
-e PERSISTENTKEEPALIVE_PEERS= `#optional` \
188
253
-e LOG_CONFS=true `#optional` \
@@ -191,7 +256,7 @@ docker run -d \
191
256
-v /lib/modules:/lib/modules `#optional` \
192
257
--sysctl="net.ipv4.conf.all.src_valid_mark=1" \
193
258
--restart unless-stopped \
194
-
lscr.io/linuxserver/wireguard:latest
259
+
ohshitgorillas/wireguard:latest
195
260
```
196
261
197
262
## Parameters
@@ -209,6 +274,7 @@ Containers are configured using parameters passed at runtime (such as those abov
209
274
|`-e PEERS=1`| Number of peers to create confs for. Required for server mode. Can also be a list of names: `myPC,myPhone,myTablet` (alphanumeric only) |
210
275
|`-e PEERDNS=auto`| DNS server set in peer/client configs (can be set as `8.8.8.8`). Used in server mode. Defaults to `auto`, which uses wireguard docker host's DNS via included CoreDNS forward. |
211
276
|`-e INTERNAL_SUBNET=10.13.13.0`| Internal subnet for the wireguard and server and peers (only change if it clashes). Used in server mode. |
277
+
|`-e IP6_SUBNET=`| IPv6 subnet for dual-stack tunnel configuration (e.g. `2001:db8:b00b:420::`). Must end with `:`. Accepts optional CIDR prefix /64–/112. Server gets `::1/128`, peers get sequential `::2/128`, `::3/128`, etc. Requires `SYS_MODULE` cap and a static IPv6 route on your router. See [IPv6 GUA Support](#ipv6-gua-global-unicast-address-support). |
212
278
|`-e ALLOWEDIPS=0.0.0.0/0`| The IPs/Ranges that the peers will be able to reach using the VPN connection. If not specified the default value is: '0.0.0.0/0, ::0/0' This will cause ALL traffic to route through the VPN, if you want split tunneling, set this to only the IPs you would like to use the tunnel AND the ip of the server's WG ip, such as 10.13.13.1. |
213
279
|`-e PERSISTENTKEEPALIVE_PEERS=`| Set to `all` or a list of comma separated peers (ie. `1,4,laptop`) for the wireguard server to send keepalive packets to listed peers every 25 seconds. Useful if server is accessed via domain name and has dynamic IP. Used only in server mode. |
214
280
|`-e LOG_CONFS=true`| Generated QR codes will be displayed in the docker log. Set to `false` to skip log output. |
[](https://mods.linuxserver.io/?mod=wireguard"view available mods for this container.")[](https://mods.linuxserver.io/?mod=universal"view available universal mods.")
264
-
265
-
We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to enable additional functionality within the containers. The list of Mods available for this image (if any) as well as universal mods that can be applied to any one of our images can be accessed via the dynamic badges above.
266
-
267
327
## Support Info
268
328
269
329
* Shell access whilst the container is running:
@@ -284,17 +344,9 @@ We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to
284
344
docker inspect -f '{{ index .Config.Labels "build_version" }}' wireguard
285
345
```
286
346
287
-
* Image version number:
288
-
289
-
```bash
290
-
docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/wireguard:latest
291
-
```
292
-
293
347
## Updating Info
294
348
295
-
Most of our images are static, versioned, and require an image update and container recreation to update the app inside. With some exceptions (noted in the relevant readme.md), we do not recommend or support updating apps inside the container. Please consult the [Application Setup](#application-setup) section above to see if it is recommended for the image.
296
-
297
-
Below are the instructions for updating containers:
349
+
Rebuild the image and recreate the container to pick up changes:
298
350
299
351
### Via Docker Compose
300
352
@@ -332,11 +384,7 @@ Below are the instructions for updating containers:
332
384
333
385
### Via Docker Run
334
386
335
-
* Update the image:
336
-
337
-
```bash
338
-
docker pull lscr.io/linuxserver/wireguard:latest
339
-
```
387
+
* Rebuild the image (see [Building locally](#building-locally)).
340
388
341
389
* Stop the running container:
342
390
@@ -357,22 +405,17 @@ Below are the instructions for updating containers:
>We recommend [Diun](https://crazymax.dev/diun/) for update notifications. Other tools that automatically update containers unattended are not recommended or supported.
364
-
365
408
## Building locally
366
409
367
-
If you want to make local modifications to these images for development purposes or just to customize the logic:
0 commit comments