@@ -1317,10 +1576,39 @@
With Docker Compose wg-easy can be updated with a single command:
-Replace $DIR with the directory where your docker-compose.yml is located.
-cd $DIR
+cd /etc/docker/containers/wg-easy
sudo docker compose up -d --pull always
If you want the updates to be fully automatic you can install Watchtower. This will check for updates every day at 4:00 AM and update the container if a new version is available.
+File: /etc/docker/containers/watchtower/docker-compose.yml
+services:
+ watchtower:
+ image: containrrr/watchtower:latest
+ volumes:
+ - /var/run/docker.sock:/var/run/docker.sock
+ env_file:
+ - watchtower.env
+ restart: unless-stopped
+
File: /etc/docker/containers/watchtower/watchtower.env
+WATCHTOWER_CLEANUP=true
+WATCHTOWER_SCHEDULE=0 0 4 * * *
+TZ=Europe/Berlin
+
+# Email
+# WATCHTOWER_NOTIFICATIONS_LEVEL=info
+# WATCHTOWER_NOTIFICATIONS=email
+# WATCHTOWER_NOTIFICATION_EMAIL_FROM=mail@example.com
+# WATCHTOWER_NOTIFICATION_EMAIL_TO=mail@example.com
+# WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com
+# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=mail@example.com
+# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD="SuperSecurePassword"
+# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
+
cd /etc/docker/containers/watchtower
+sudo docker compose up -d
+
sudo docker stop wg-easy
sudo docker rm wg-easy
diff --git a/Pre-release/examples/tutorials/basic-installation/index.html b/Pre-release/examples/tutorials/basic-installation/index.html
index 3bd00cac..5993d9ab 100644
--- a/Pre-release/examples/tutorials/basic-installation/index.html
+++ b/Pre-release/examples/tutorials/basic-installation/index.html
@@ -22,7 +22,7 @@
-
+
@@ -153,11 +153,13 @@
-
-
+
@@ -401,6 +443,28 @@
+
+
+
+
+
+
+ FAQ
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -437,10 +501,10 @@
-
+
-
-
-
-
-
-
- Access the Web UI
-
-
-
@@ -1198,35 +1253,12 @@
-
+
- NGINX
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Podman
+ Podman + nftables
@@ -1275,6 +1307,194 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
- Create a directory for the configuration files (you can choose any directory you like):
-DIR=/docker/wg-easy
-sudo mkdir -p $DIR
+sudo mkdir -p /etc/docker/containers/wg-easy
- Download docker compose file
-sudo curl -o $DIR/docker-compose.yml https://raw.githubusercontent.com/wg-easy/wg-easy/master/docker-compose.yml
+sudo curl -o /etc/docker/containers/wg-easy/docker-compose.yml https://raw.githubusercontent.com/wg-easy/wg-easy/master/docker-compose.yml
- Start
wg-easy
- sudo docker-compose -f $DIR/docker-compose.yml up -d
+ cd /etc/docker/containers/wg-easy
+ sudo docker-compose up -d
If you are using a firewall, you need to open the following ports:
- UDP 51820 (WireGuard)
-- TCP 51821 (Web UI)
These ports can be changed, so if you change them you have to update your firewall rules accordingly.
-TODO
-
-Open your browser and navigate to https://<your-domain>:51821 or https://<your-ip>:51821.
-Follow the instructions to set up your WireGuard VPN.
+
+- To setup traefik follow the instructions here: Traefik
+- To setup caddy follow the instructions here: Caddy
+
To update wg-easy to the latest version, run:
-
@@ -1218,7 +1447,9 @@
Caddy
-TODO
+It seems like the Docs on how to setup Caddy are not available yet.
+Feel free to create a PR and add them here.
+
diff --git a/Pre-release/examples/tutorials/docker-run/index.html b/Pre-release/examples/tutorials/docker-run/index.html
index cbd5b961..43b4f0ec 100644
--- a/Pre-release/examples/tutorials/docker-run/index.html
+++ b/Pre-release/examples/tutorials/docker-run/index.html
@@ -22,7 +22,7 @@
-
+
@@ -148,11 +148,13 @@
-
-
+
@@ -396,6 +438,28 @@
+
+
+
+
+
+
+ FAQ
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -432,10 +496,10 @@
-
+
-
Docker Run
To setup the IPv6 Network, simply run once:
- docker network create \
+docker network create \
-d bridge --ipv6 \
-d default \
--subnet 10.42.42.0/24 \
@@ -1227,8 +1456,8 @@
To automatically install & run ``wg-easy, simply run:
- docker run -d \
+To automatically install & run wg-easy, simply run:
+docker run -d \
--net wg \
-e INSECURE=true \
--name wg-easy \
@@ -1248,10 +1477,7 @@
--restart unless-stopped \
ghcr.io/wg-easy/wg-easy:15
The Web UI will now be available on http://0.0.0.0:51821.
-
-💡 Your configuration files will be saved in ~/.wg-easy
-
+The Web UI will now be available at http://0.0.0.0:51821.
diff --git a/Pre-release/examples/tutorials/dockerless/index.html b/Pre-release/examples/tutorials/dockerless/index.html
index 95ff1457..6b640592 100644
--- a/Pre-release/examples/tutorials/dockerless/index.html
+++ b/Pre-release/examples/tutorials/dockerless/index.html
@@ -18,11 +18,11 @@
-
+
-
+
@@ -148,11 +148,13 @@
-
-
+
@@ -396,6 +438,28 @@
+
+
+
+
+
+
+ FAQ
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -432,10 +496,10 @@
-
+
-
Without Docker
-TODO
+This is currently not yet supported.
+
diff --git a/Pre-release/examples/tutorials/podman/index.html b/Pre-release/examples/tutorials/podman-nft/index.html
similarity index 78%
rename from Pre-release/examples/tutorials/podman/index.html
rename to Pre-release/examples/tutorials/podman-nft/index.html
index f393a6b3..402d72d1 100644
--- a/Pre-release/examples/tutorials/podman/index.html
+++ b/Pre-release/examples/tutorials/podman-nft/index.html
@@ -12,21 +12,21 @@
-
+
-
+
-
+
- Podman - wg-easy
+ Podman + nftables - wg-easy
@@ -115,7 +115,7 @@
@@ -153,11 +153,13 @@
-
-
+
@@ -401,6 +443,28 @@
+
+
+
+
+
+
+ FAQ
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -437,10 +501,10 @@
-
+
-
Podman
+ Podman + nftables
This guide will show you how to run wg-easy with rootful Podman and nftables.
@@ -1432,7 +1661,7 @@ sudo systemctl startapk add nftables; nft add table inet wg_table; nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \; }; nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade; nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade; nft add chain inet wg_table input { type filter hook input priority 0 \; policy drop \; }; nft add rule inet wg_table input udp dport {{port}} accept; nft add rule inet wg_table input tcp dport {{uiPort}} accept; nft add chain inet wg_table forward { type filter hook forward priority 0 \; policy drop \; }; nft add rule inet wg_table forward iifname "wg0" accept; nft add rule inet wg_table forward oifname "wg0" accept;
+nft add table inet wg_table; nft add chain inet wg_table prerouting { type nat hook prerouting priority 100 \; }; nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \; }; nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade; nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade; nft add chain inet wg_table input { type filter hook input priority 0 \; policy accept \; }; nft add rule inet wg_table input udp dport {{port}} accept; nft add rule inet wg_table input tcp dport {{uiPort}} accept; nft add chain inet wg_table forward { type filter hook forward priority 0 \; policy accept \; }; nft add rule inet wg_table forward iifname "wg0" accept; nft add rule inet wg_table forward oifname "wg0" accept;
- PostDown
@@ -1444,10 +1673,6 @@ sudo systemctl startsudo systemctl restart wg-easy
Traefik
-TODO
+
+
Opinionated
+
This guide is opinionated. If you use other conventions or folder layouts, feel free to change the commands and paths.
+
sudo mkdir -p /etc/docker/containers/traefik
+cd /etc/docker/containers/traefik
+
File: /etc/docker/containers/traefik/docker-compose.yml
+services:
+ traefik:
+ image: traefik:3.3
+ container_name: traefik
+ restart: unless-stopped
+ ports:
+ - "80:80"
+ - "443:443/tcp"
+ - "443:443/udp"
+ volumes:
+ - /var/run/docker.sock:/var/run/docker.sock
+ - /etc/docker/volumes/traefik/traefik.yml:/traefik.yml:ro
+ - /etc/docker/volumes/traefik/traefik_dynamic.yml:/traefik_dynamic.yml:ro
+ - /etc/docker/volumes/traefik/acme.json:/acme.json
+ networks:
+ - traefik
+
+networks:
+ traefik:
+ external: true
+
File: /etc/docker/volumes/traefik/traefik.yml
+log:
+ level: INFO
+
+entryPoints:
+ web:
+ address: ":80/tcp"
+ http:
+ redirections:
+ entryPoint:
+ to: websecure
+ scheme: https
+ websecure:
+ address: ":443/tcp"
+ http:
+ middlewares:
+ - compress@file
+ - hsts@file
+ tls:
+ certResolver: letsencrypt
+ http3: {}
+
+api:
+ dashboard: true
+
+certificatesResolvers:
+ letsencrypt:
+ acme:
+ email: $mail@example.com$
+ storage: acme.json
+ httpChallenge:
+ entryPoint: web
+
+providers:
+ docker:
+ watch: true
+ network: traefik
+ exposedByDefault: false
+ file:
+ filename: traefik_dynamic.yml
+
+serversTransport:
+ insecureSkipVerify: true
+
File: /etc/docker/volumes/traefik/traefik_dynamic.yml
+http:
+ middlewares:
+ services:
+ basicAuth:
+ users:
+ - "$username$:$password$"
+ compress:
+ compress: {}
+ hsts:
+ headers:
+ stsSeconds: 2592000
+ routers:
+ api:
+ rule: Host(`traefik.$example.com$`)
+ entrypoints:
+ - websecure
+ middlewares:
+ - services
+ service: api@internal
+
+tls:
+ options:
+ default:
+ cipherSuites:
+ - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+ - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+ - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
+ sniStrict: true
+
sudo touch /etc/docker/volumes/traefik/acme.json
+sudo chmod 600 /etc/docker/volumes/traefik/acme.json
+
sudo docker network create traefik
+
sudo docker-compose up -d
+
You can no access the Traefik dashboard at https://traefik.$example.com$ with the credentials you set in traefik_dynamic.yml.
+
+To add labels to your wg-easy service, you can add the following to your docker-compose.yml file:
+File: /etc/docker/containers/wg-easy/docker-compose.yml
+services:
+ wg-easy:
+ ...
+ container_name: wg-easy
+ networks:
+ ...
+ traefik: {}
+ labels:
+ - "traefik.enable=true"
+ - "traefik.http.routers.wg-easy.rule=Host(`wg-easy.$example.com$`)"
+ - "traefik.http.routers.wg-easy.entrypoints=websecure"
+ - "traefik.http.routers.wg-easy.service=wg-easy"
+ - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
+ ...
+
+networks:
+ ...
+ traefik:
+ external: true
+
cd /etc/docker/containers/wg-easy
+sudo docker-compose up -d
+
You can now access wg-easy at https://wg-easy.$example.com$ and start the setup.
diff --git a/Pre-release/faq/index.html b/Pre-release/faq/index.html
new file mode 100644
index 00000000..85538cbd
--- /dev/null
+++ b/Pre-release/faq/index.html
@@ -0,0 +1,1721 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ FAQ - wg-easy
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ FAQ
+
+Here are some frequently asked questions or errors about wg-easy. If you have a question that is not answered here, please feel free to open a discussion on GitHub.
+
+This error indicates that the WireGuard interface wg0 does not exist. This can happen if the WireGuard kernel module is not loaded or if the interface was not created properly.
+To resolve this issue, you can try the following steps:
+
+- Load the WireGuard kernel module: If the WireGuard kernel module is not loaded, you can load it manually by running:
+
+ sudo modprobe wireguard
+
+- Load the WireGuard kernel module on boot: If you want to ensure that the WireGuard kernel module is loaded automatically on boot, you can add it to the
/etc/modules file:
+
+echo "wireguard" | sudo tee -a /etc/modules
+
This error indicates that the nat table in iptables does not exist. This can happen if the iptables kernel module is not loaded or if the nat table is not supported by your kernel.
+To resolve this issue, you can try the following steps:
+
+- Load the
nat kernel module: If the nat kernel module is not loaded, you can load it manually by running:
+
+sudo modprobe iptable_nat
+
+- Load the
nat kernel module on boot: If you want to ensure that the nat kernel module is loaded automatically on boot, you can add it to the /etc/modules file:
+
+ echo "iptable_nat" | sudo tee -a /etc/modules
+
This error indicates that the nat table in ip6tables does not exist. This can happen if the ip6tables kernel module is not loaded or if the nat table is not supported by your kernel.
+To resolve this issue, you can try the following steps:
+
+- Load the
nat kernel module: If the nat kernel module is not loaded, you can load it manually by running:
+
+sudo modprobe ip6table_nat
+
+- Load the
nat kernel module on boot: If you want to ensure that the nat kernel module is loaded automatically on boot, you can add it to the /etc/modules file:
+
+ echo "ip6table_nat" | sudo tee -a /etc/modules
+
This error indicates that the filter table in iptables cannot be initialized due to permission issues. This can happen if you are not running the command with sufficient privileges.
+To resolve this issue, you can try the following steps:
+
+- Load the
filter kernel module: If the filter kernel module is not loaded, you can load it manually by running:
+
+sudo modprobe iptable_filter
+
+- Load the
filter kernel module on boot: If you want to ensure that the filter kernel module is loaded automatically on boot, you can add it to the /etc/modules file:
+
+echo "iptable_filter" | sudo tee -a /etc/modules
+
This error indicates that the filter table in ip6tables cannot be initialized due to permission issues. This can happen if you are not running the command with sufficient privileges.
+To resolve this issue, you can try the following steps:
+
+- Load the
filter kernel module: If the filter kernel module is not loaded, you can load it manually by running:
+
+sudo modprobe ip6table_filter
+
+- Load the
filter kernel module on boot: If you want to ensure that the filter kernel module is loaded automatically on boot, you can add it to the /etc/modules file:
+
+ echo "ip6table_filter" | sudo tee -a /etc/modules
+
+
+
+
+
+
+
+
+
+