mirror of
https://github.com/wg-easy/wg-easy.git
synced 2025-09-30 13:32:19 +08:00
114 lines
2.8 KiB
Markdown
114 lines
2.8 KiB
Markdown
---
|
|
title: Podman
|
|
---
|
|
|
|
This guide will show you how to run `wg-easy` with rootful Podman and nftables.
|
|
|
|
## Requirements
|
|
|
|
1. Podman installed with version 4.4 or higher
|
|
|
|
## Configuration
|
|
|
|
Create a Folder for the configuration files:
|
|
|
|
```shell
|
|
sudo mkdir -p /etc/containers/systemd/wg-easy
|
|
sudo mkdir -p /etc/containers/volumes/wg-easy
|
|
```
|
|
|
|
Create a file `/etc/containers/systemd/wg-easy/wg-easy.container` with the following content:
|
|
|
|
<!-- ref: major version -->
|
|
|
|
```ini
|
|
[Container]
|
|
ContainerName=wg-easy
|
|
Image=ghcr.io/wg-easy/wg-easy:15
|
|
AutoUpdate=registry
|
|
|
|
Volume=/etc/containers/volumes/wg-easy:/etc/wireguard:Z
|
|
Network=wg-easy.network
|
|
PublishPort=51820:51820/udp
|
|
PublishPort=51821:51821/tcp
|
|
|
|
# this is used to allow access over HTTP
|
|
# remove this when using a reverse proxy
|
|
Environment=INSECURE=true
|
|
|
|
AddCapability=NET_ADMIN
|
|
AddCapability=SYS_MODULE
|
|
AddCapability=NET_RAW
|
|
Sysctl=net.ipv4.ip_forward=1
|
|
Sysctl=net.ipv4.conf.all.src_valid_mark=1
|
|
Sysctl=net.ipv6.conf.all.disable_ipv6=0
|
|
Sysctl=net.ipv6.conf.all.forwarding=1
|
|
Sysctl=net.ipv6.conf.default.forwarding=1
|
|
|
|
[Install]
|
|
# this is used to start the container on boot
|
|
WantedBy=default.target
|
|
```
|
|
|
|
Create a file `/etc/containers/systemd/wg-easy/wg-easy.network` with the following content:
|
|
|
|
```ini
|
|
[Network]
|
|
NetworkName=wg-easy
|
|
IPv6=true
|
|
```
|
|
|
|
## Load Kernel Modules
|
|
|
|
You will need to load the following kernel modules
|
|
|
|
```txt
|
|
wireguard
|
|
nft_masq
|
|
```
|
|
|
|
Create a file `/etc/modules-load.d/wg-easy.conf` with the following content:
|
|
|
|
```txt
|
|
wireguard
|
|
nft_masq
|
|
```
|
|
|
|
## Start the Container
|
|
|
|
```shell
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl start wg-easy
|
|
```
|
|
|
|
## Edit Hooks
|
|
|
|
In the Admin Panel of your WireGuard server, go to the `Hooks` tab and add the following hook:
|
|
|
|
1. PostUp
|
|
|
|
```shell
|
|
apk add nftables; nft add table inet wg_table; nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \; }; nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade; nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade; nft add chain inet wg_table input { type filter hook input priority 0 \; policy drop \; }; nft add rule inet wg_table input udp dport {{port}} accept; nft add rule inet wg_table input tcp dport {{uiPort}} accept; nft add chain inet wg_table forward { type filter hook forward priority 0 \; policy drop \; }; nft add rule inet wg_table forward iifname "wg0" accept; nft add rule inet wg_table forward oifname "wg0" accept;
|
|
```
|
|
|
|
2. PostDown
|
|
|
|
```shell
|
|
nft delete table inet wg_table
|
|
```
|
|
|
|
If you don't have iptables loaded on your server, you could see many errors in the logs or in the UI. You can ignore them.
|
|
|
|
## Restart the Container
|
|
|
|
Restart the container to apply the new hooks:
|
|
|
|
```shell
|
|
sudo systemctl restart wg-easy
|
|
```
|
|
|
|
<!--
|
|
TODO: improve docs after better nftables support
|
|
TODO: fix accept web ui port
|
|
-->
|