wg-easy

https://wg-easy.github.io/wg-easy/latest
Admin
wg-easy is the easiest way to run WireGuard VPN with a web-based administration user interface.
Tokens:11,217
Snippets:168
Trust Score:8.3
Update:1 month ago
Show doc for...
Tokens:
Raw
### Start the container service

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/podman-nft

Reload systemd and start the wg-easy service.

```bash
sudo systemctl daemon-reload
sudo systemctl start wg-easy
```

--------------------------------

### Run documentation server

Source: https://wg-easy.github.io/wg-easy/latest/contributing/general

Starts the local documentation server on port 8080 with hot-reloading enabled.

```bash
pnpm docs:serve
```

--------------------------------

### Start wg-easy Service

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/basic-installation

Navigates to the configuration directory and starts the wg-easy container in detached mode.

```bash
 cd /etc/docker/containers/wg-easy
 sudo docker compose up -d
```

--------------------------------

### Start Caddy Container

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/caddy

Command to start the Caddy service.

```bash
sudo docker compose up -d
```

--------------------------------

### Start Watchtower Service

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/auto-updates

Deploy the Watchtower container using Docker Compose.

```bash
cd /etc/docker/containers/watchtower
sudo docker compose up -d
```

--------------------------------

### nftables hooks for routed setup

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/routed

Alternative PostUp and PostDown hooks for systems using nftables.

```bash
nft add chain ip filter WG_EASY; nft add rule ip filter DOCKER-USER jump WG_EASY; nft add rule ip filter WG_EASY iifname {{device}} accept; nft add rule ip filter WG_EASY oifname {{device}} accept; nft add chain ip6 filter WG_EASY; nft add rule ip6 filter DOCKER-USER jump WG_EASY; nft add rule ip6 filter WG_EASY iifname {{device}} accept; nft add rule ip6 filter WG_EASY oifname {{device}} accept;
```

```bash
nft delete rule ip filter DOCKER-USER handle $(nft -a list chain ip filter DOCKER-USER | awk '/jump WG_EASY/ {print $NF}'); nft flush chain ip filter WG_EASY; nft delete chain ip filter WG_EASY; nft delete rule ip6 filter DOCKER-USER handle $(nft -a list chain ip6 filter DOCKER-USER | awk '/jump WG_EASY/ {print $NF}'); nft flush chain ip6 filter WG_EASY; nft delete chain ip6 filter WG_EASY
```

--------------------------------

### Start AdGuard Home Service

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/adguard

Navigate to the container directory and launch the AdGuard Home service using Docker Compose.

```bash
cd /etc/docker/containers/adguard
sudo docker compose up -d
```

--------------------------------

### iptables hooks for routed setup

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/routed

Configure PostUp and PostDown hooks in the wg-easy Web UI to manage traffic flow using iptables.

```bash
iptables -A INPUT -p udp -m udp --dport {{port}} -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; ip6tables -A INPUT -p udp -m udp --dport {{port}} -j ACCEPT; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -A FORWARD -o wg0 -j ACCEPT
```

```bash
iptables -D INPUT -p udp -m udp --dport {{port}} -j ACCEPT; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; ip6tables -D INPUT -p udp -m udp --dport {{port}} -j ACCEPT; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -D FORWARD -o wg0 -j ACCEPT
```

--------------------------------

### Authelia Client Configuration

Source: https://wg-easy.github.io/wg-easy/latest/advanced/config/external-authentication

YAML configuration block for defining the wg-easy client within an Authelia setup.

```yaml
- client_id: '...'
  client_name: wg-easy
  client_secret: '$pbkdf2-...'
  redirect_uris:
      - https://<your-domain>/api/auth/oidc/callback
      - https://<your-domain>/api/auth/oidc/link
  scopes:
      - openid
      - profile
      - email
  authorization_policy: one_factor
  pre_configured_consent_duration: 1 week
  require_pkce: true
  token_endpoint_auth_method: client_secret_post
```

--------------------------------

### Update wg-easy docker-compose configuration

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/adguard

Modify the environment variables and network settings in your docker-compose.yml file to match the required setup.

```yaml
services:
  wg-easy:
    ports:
      - "51820:51820/udp"
    ...
    networks:
      wg:
        interface_name: eth0
        ...
      traefik:
        interface_name: eth1
      ...
    ...
    environment:
      # Unattended Setup
      - INIT_ENABLED=true
      # Replace $username$ with your username
      - INIT_USERNAME=$username$
      # Replace $password$ with your unhashed password
      - INIT_PASSWORD=$password$
      # Replace $example.com$ with your domain
      - INIT_HOST=wg-easy.$example.com$
      - INIT_PORT=51820
      - INIT_DNS=10.42.42.43,fdcc:ad94:bacf:61a3::2b
      - INIT_IPV4_CIDR=10.8.0.0/24
      - INIT_IPV6_CIDR=fd42:42:42::/64
    ...

networks:
  wg:
    # Prevents Docker Compose from prefixing the network name.
    name: wg
    ...
  ...
```

--------------------------------

### Create configuration directories

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/podman-nft

Initialize the required directory structure for Podman configuration and volumes.

```bash
sudo mkdir -p /etc/containers/systemd/wg-easy
sudo mkdir -p /etc/containers/volumes/wg-easy
```

--------------------------------

### Create Configuration Directory

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/basic-installation

Creates the directory structure required to store wg-easy configuration files.

```bash
sudo mkdir -p /etc/docker/containers/wg-easy
```

--------------------------------

### List Clients

Source: https://wg-easy.github.io/wg-easy/latest/guides/cli

Displays a list of all currently configured clients with their details.

```bash
cli clients:list
```

--------------------------------

### Initialize Traefik Project Directory

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/traefik

Create the necessary directory structure for the Traefik container configuration.

```bash
sudo mkdir -p /etc/docker/containers/traefik
cd /etc/docker/containers/traefik
```

--------------------------------

### Run wg-easy Container

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/docker-run

Deploys the wg-easy container with specific network, volume, and kernel capability configurations.

```bash
docker run -d \
  --net wg \
  -e INSECURE=true \
  --name wg-easy \
  --ip6 fdcc:ad94:bacf:61a3::2a \
  --ip 10.42.42.42 \
  -v ~/.wg-easy:/etc/wireguard \
  -v /lib/modules:/lib/modules:ro \
  -p 51820:51820/udp \
  -p 51821:51821/tcp \
  --cap-add NET_ADMIN \
  --cap-add SYS_MODULE \
  --sysctl net.ipv4.ip_forward=1 \
  --sysctl net.ipv4.conf.all.src_valid_mark=1 \
  --sysctl net.ipv6.conf.all.disable_ipv6=0 \
  --sysctl net.ipv6.conf.all.forwarding=1 \
  --sysctl net.ipv6.conf.default.forwarding=1 \
  --restart unless-stopped \
  ghcr.io/wg-easy/wg-easy:15
```

--------------------------------

### Configure PostUp hook

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/podman-nft

Add the nftables rules required for WireGuard traffic routing and masquerading.

```bash
nft add table inet wg_table; nft add chain inet wg_table prerouting { type nat hook prerouting priority 100 \; }; nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \; }; nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade; nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade; nft add chain inet wg_table input { type filter hook input priority 0 \; policy accept \; }; nft add rule inet wg_table input udp dport {{port}} accept; nft add rule inet wg_table input tcp dport {{uiPort}} accept; nft add chain inet wg_table forward { type filter hook forward priority 0 \; policy accept \; }; nft add rule inet wg_table forward iifname "wg0" accept; nft add rule inet wg_table forward oifname "wg0" accept;
```

--------------------------------

### Define wg-easy network configuration

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/podman-nft

Create the network definition file for the wg-easy container.

```ini
[Network]
NetworkName=wg-easy
IPv6=true
```

--------------------------------

### Create Docker Network

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/traefik

Create the external network used by Traefik and wg-easy.

```bash
sudo docker network create traefik
```

--------------------------------

### Configure ip6table_nat for boot

Source: https://wg-easy.github.io/wg-easy/latest/faq

Append the ip6table_nat module to /etc/modules to ensure it loads automatically on system startup.

```bash
 echo "ip6table_nat" | sudo tee -a /etc/modules
```

--------------------------------

### Apply changes via restart

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/adguard

Restart the wg-easy container to apply the updated hook configurations.

```bash
sudo docker restart wg-easy
```

--------------------------------

### Create AdGuard configuration directory

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/adguard

Initializes the directory structure for AdGuard configuration files.

```bash
sudo mkdir -p /etc/docker/containers/adguard
```

--------------------------------

### Define wg-easy container configuration

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/podman-nft

Create the systemd container unit file for wg-easy with necessary capabilities and sysctl settings.

```ini
[Container]
ContainerName=wg-easy
Image=ghcr.io/wg-easy/wg-easy:15
AutoUpdate=registry

Volume=/etc/containers/volumes/wg-easy:/etc/wireguard:Z
Network=wg-easy.network
PublishPort=51820:51820/udp
PublishPort=51821:51821/tcp

# this is used to allow access over HTTP
# remove this when using a reverse proxy
Environment=INSECURE=true

AddCapability=NET_ADMIN
AddCapability=SYS_MODULE
AddCapability=NET_RAW
Sysctl=net.ipv4.ip_forward=1
Sysctl=net.ipv4.conf.all.src_valid_mark=1
Sysctl=net.ipv6.conf.all.disable_ipv6=0
Sysctl=net.ipv6.conf.all.forwarding=1
Sysctl=net.ipv6.conf.default.forwarding=1

[Install]
# this is used to start the container on boot
WantedBy=default.target
```

--------------------------------

### Initialize ACME Storage

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/traefik

Create the acme.json file with restricted permissions for security.

```bash
sudo touch /etc/docker/volumes/traefik/acme.json
sudo chmod 600 /etc/docker/volumes/traefik/acme.json
```

--------------------------------

### Adapt wg-easy Docker Composition

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/caddy

Configuration changes required for the wg-easy service to work with the Caddy network.

```yaml
services:
  wg-easy:
    # sync container name and port according to Caddyfile
    container_name: wg-easy
    environment:
      - PORT=80
    # no need to publish the HTTP server anymore
    ports:
      - "51820:51820/udp"
    # add to caddy network
    networks:
      caddy:
    ...

networks:
  caddy:
    external: true
  ...
```

--------------------------------

### Download Docker Compose File

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/basic-installation

Downloads the official docker-compose.yml file from the wg-easy repository.

```bash
sudo curl -o /etc/docker/containers/wg-easy/docker-compose.yml https://raw.githubusercontent.com/wg-easy/wg-easy/master/docker-compose.yml
```

--------------------------------

### Configure iptable_filter for boot

Source: https://wg-easy.github.io/wg-easy/latest/faq

Append the iptable_filter module to /etc/modules to ensure it loads automatically on system startup.

```bash
echo "iptable_filter" | sudo tee -a /etc/modules
```

--------------------------------

### Restart wg-easy Service

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/traefik

Apply the new labels by restarting the wg-easy container.

```bash
cd /etc/docker/containers/wg-easy
sudo docker compose up -d
```

--------------------------------

### Create AdGuard persistent volumes

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/adguard

Sets up persistent storage directories for AdGuard work and configuration files with restricted permissions.

```bash
sudo mkdir -p /etc/docker/volumes/adguard/adguard_work
sudo mkdir -p /etc/docker/volumes/adguard/adguard_conf
sudo chmod -R 700 /etc/docker/volumes/adguard
```

--------------------------------

### Load required kernel modules

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/podman-nft

Load the necessary kernel modules for WireGuard and nftables masquerading.

```text
wireguard
nft_masq
```

```text
wireguard
nft_masq
```

--------------------------------

### Configure iptable_nat for boot

Source: https://wg-easy.github.io/wg-easy/latest/faq

Append the iptable_nat module to /etc/modules to ensure it loads automatically on system startup.

```bash
 echo "iptable_nat" | sudo tee -a /etc/modules
```

--------------------------------

### Caddyfile Configuration

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/caddy

Caddyfile settings to proxy requests to the wg-easy container.

```text
# Caddyfile

{
        # setup your email address
        email mail@example.com
}

wg-easy.example.com {
        # since the container will share the network with wg-easy
        # we can use the proper container name
        reverse_proxy wg-easy:80
        tls internal
}
```

--------------------------------

### Update wg-easy with Docker Compose

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/auto-updates

Navigate to the container directory and pull the latest image before restarting.

```bash
cd /etc/docker/containers/wg-easy
sudo docker compose up -d --pull always
```

--------------------------------

### Show Client QR Code

Source: https://wg-easy.github.io/wg-easy/latest/guides/cli

Displays the QR code for a specific client, with an optional flag to disable IPv6.

```bash
cli clients:qr <client_id>
```

```bash
cli clients:qr <client_id> --no-ipv6
```

--------------------------------

### Persist WireGuard kernel module on boot

Source: https://wg-easy.github.io/wg-easy/latest/faq

Add the wireguard module to the system configuration to ensure it loads automatically upon system startup.

```bash
echo "wireguard" | sudo tee -a /etc/modules
```

--------------------------------

### Create IPv6 Docker Network

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/docker-run

Initializes a bridge network named 'wg' with both IPv4 and IPv6 subnets.

```bash
docker network create \
  -d bridge --ipv6 \
  --subnet 10.42.42.0/24 \
  --subnet fdcc:ad94:bacf:61a3::/64 \
   wg
```

--------------------------------

### Configure WireGuard Hooks

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/adguard

Define PostUp and PostDown iptables rules in the Admin Panel to manage network traffic and NAT.

```bash
iptables -A INPUT -p udp -m udp --dport {{port}} -j ACCEPT; ip6tables -A INPUT -p udp -m udp --dport {{port}} -j ACCEPT; iptables -t nat -A PREROUTING -i wg0 -p udp --dport 53 -j DNAT --to-destination 10.42.42.43; iptables -t nat -A PREROUTING -i wg0 -p tcp --dport 53 -j DNAT --to-destination 10.42.42.43; ip6tables -t nat -A PREROUTING -i wg0 -p udp --dport 53 -j DNAT --to-destination fdcc:ad94:bacf:61a3::2b; ip6tables -t nat -A PREROUTING -i wg0 -p tcp --dport 53 -j DNAT --to-destination fdcc:ad94:bacf:61a3::2b; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -s {{ipv4Cidr}} -o {{device}} -j MASQUERADE; ip6tables -t nat -A POSTROUTING -s {{ipv6Cidr}} -o {{device}} -j MASQUERADE;
```

```bash
iptables -D INPUT -p udp -m udp --dport {{port}} -j ACCEPT || true; ip6tables -D INPUT -p udp -m udp --dport {{port}} -j ACCEPT || true; iptables -t nat -D PREROUTING -i wg0 -p udp --dport 53 -j DNAT --to-destination 10.42.42.43 || true; iptables -t nat -D PREROUTING -i wg0 -p tcp --dport 53 -j DNAT --to-destination 10.42.42.43 || true; ip6tables -t nat -D PREROUTING -i wg0 -p udp --dport 53 -j DNAT --to-destination fdcc:ad94:bacf:61a3::2b || true; ip6tables -t nat -D PREROUTING -i wg0 -p tcp --dport 53 -j DNAT --to-destination fdcc:ad94:bacf:61a3::2b || true; iptables -D FORWARD -i wg0 -j ACCEPT || true; iptables -D FORWARD -o wg0 -j ACCEPT || true; ip6tables -D FORWARD -i wg0 -j ACCEPT || true; ip6tables -D FORWARD -o wg0 -j ACCEPT || true; iptables -t nat -D POSTROUTING -s {{ipv4Cidr}} -o {{device}} -j MASQUERADE || true; ip6tables -t nat -D POSTROUTING -s {{ipv6Cidr}} -o {{device}} -j MASQUERADE || true;
```

--------------------------------

### Restart the container

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/podman-nft

Restart the service to apply configuration changes.

```bash
sudo systemctl restart wg-easy
```

--------------------------------

### Persist ip6table_filter module on boot

Source: https://wg-easy.github.io/wg-easy/latest/faq

Append the module name to /etc/modules to ensure it is loaded automatically upon system startup.

```bash
echo "ip6table_filter" | sudo tee -a /etc/modules
```

--------------------------------

### Load ip6table_filter kernel module

Source: https://wg-easy.github.io/wg-easy/latest/faq

Manually load the filter kernel module to resolve permission denied errors during initialization.

```bash
sudo modprobe ip6table_filter
```

--------------------------------

### Directory Structure

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/caddy

The required file layout for the Caddy configuration.

```text
.
├── compose.yml
└── Caddyfile

1 directory, 2 files
```

--------------------------------

### Update wg-easy

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/basic-installation

Pulls the latest container image and restarts the service to apply updates.

```bash
cd /etc/docker/containers/wg-easy
sudo docker compose pull
sudo docker compose up -d
```

--------------------------------

### Access CLI via Docker Run

Source: https://wg-easy.github.io/wg-easy/latest/guides/cli

Use this command to execute the CLI directly from a container instance.

```bash
docker run --rm -it \
    -v ~/.wg-easy:/etc/wireguard \
    ghcr.io/wg-easy/wg-easy:15 \
    cli
```

--------------------------------

### Configure System UDP Buffer Sizes

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/adguard

Update sysctl settings to increase UDP buffer limits for improved DNS performance. Apply changes via sysctl or system reboot.

```text
net.core.rmem_max = 7500000
net.core.wmem_max = 7500000
```

--------------------------------

### Configure Static Traefik Settings

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/traefik

Define entry points, dashboard access, and certificate resolvers in traefik.yml.

```yaml
log:
    level: INFO

entryPoints:
    web:
        address: ':80/tcp'
        http:
            redirections:
                entryPoint:
                    to: websecure
                    scheme: https
    websecure:
        address: ':443/tcp'
        http:
            middlewares:
                - compress@file
                - hsts@file
            tls:
                certResolver: letsencrypt
        http3: {}

api:
    dashboard: true

certificatesResolvers:
    letsencrypt:
        acme:
            email: $mail@example.com$
            storage: acme.json
            httpChallenge:
                entryPoint: web

providers:
    docker:
        watch: true
        network: traefik
        exposedByDefault: false
    file:
        filename: traefik_dynamic.yml

serversTransport:
    insecureSkipVerify: true
```

--------------------------------

### Load WireGuard kernel module manually

Source: https://wg-easy.github.io/wg-easy/latest/faq

Use this command to manually load the WireGuard kernel module if the interface fails to initialize.

```bash
sudo modprobe wireguard
```

--------------------------------

### Update wg-easy with Docker Run

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/auto-updates

Stop, remove, and pull the latest image manually before re-running the container.

```bash
sudo docker stop wg-easy
sudo docker rm wg-easy
sudo docker pull ghcr.io/wg-easy/wg-easy
```

--------------------------------

### Configure PostDown hook

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/podman-nft

Remove the nftables table when the interface goes down.

```bash
nft delete table inet wg_table
```

--------------------------------

### Host kernel parameters for routing

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/routed

Configure sysctl settings on the host to enable packet forwarding.

```text
net.ipv4.ip_forward=1
net.ipv4.conf.all.src_valid_mark=1
net.ipv6.conf.all.disable_ipv6=0
net.ipv6.conf.all.forwarding=1
net.ipv6.conf.default.forwarding=1
```

```bash
sysctl -p /etc/sysctl.d/90-wireguard.conf
sysctl -n net.ipv4.ip_forward   # should print 1
```

--------------------------------

### Configure Dynamic Traefik Settings

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/traefik

Define middlewares, routers, and TLS options in traefik_dynamic.yml.

```yaml
http:
    middlewares:
        services:
            basicAuth:
                users:
                    - '$username$:$password$'
        compress:
            compress: {}
        hsts:
            headers:
                stsSeconds: 2592000
    routers:
        api:
            rule: Host(`traefik.$example.com$`)
            entrypoints:
                - websecure
            middlewares:
                - services
            service: api@internal

tls:
    options:
        default:
            cipherSuites:
                - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
                - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
                - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
            sniStrict: true
```

--------------------------------

### Generate Authelia Credentials

Source: https://wg-easy.github.io/wg-easy/latest/advanced/config/external-authentication

Commands to generate a random client ID and a hashed client secret for Authelia integration.

```bash
# Client ID
docker run --rm authelia/authelia:latest authelia crypto rand --length 72 --charset rfc3986
# Client Secret
docker run --rm authelia/authelia:latest authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
```

--------------------------------

### Configure Prometheus Scrape Job

Source: https://wg-easy.github.io/wg-easy/latest/advanced/metrics/prometheus

Add this configuration to your Prometheus file to scrape metrics from the wg-easy container. Ensure the credentials match the Bearer Password set in the Admin Panel.

```yaml
scrape_configs:
    - job_name: 'wg-easy'
      scrape_interval: 30s
      metrics_path: /metrics/prometheus
      static_configs:
          - targets:
                - 'localhost:51821'
      authorization:
          type: Bearer
          credentials: 'SuperSecurePassword'
```

--------------------------------

### Load iptable_filter kernel module

Source: https://wg-easy.github.io/wg-easy/latest/faq

Manually load the iptable_filter module to resolve permission denied errors during filter table initialization.

```bash
sudo modprobe iptable_filter
```

--------------------------------

### Stop the wg-easy container

Source: https://wg-easy.github.io/wg-easy/latest/advanced/migrate/from-14-to-15

Commands to stop the existing container before migration.

```bash
docker stop wg-easy
```

```bash
docker compose down
```

--------------------------------

### Configure wg-easy Labels

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/traefik

Add Traefik routing labels to the wg-easy service definition.

```yaml
services:
  wg-easy:
    ...
    container_name: wg-easy
    networks:
      ...
      traefik: {}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wg-easy.rule=Host(`wg-easy.$example.com$`)"
      - "traefik.http.routers.wg-easy.entrypoints=websecure"
      - "traefik.http.routers.wg-easy.service=wg-easy"
      - "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
      - "traefik.docker.network=traefik"
    ...

networks:
  ...
  traefik:
    external: true
```

--------------------------------

### Access CLI via Docker Compose

Source: https://wg-easy.github.io/wg-easy/latest/guides/cli

Use this command to enter the CLI environment when running via Docker Compose.

```bash
cd /etc/docker/containers/wg-easy
docker compose exec -it wg-easy cli
```

--------------------------------

### Update Containers with Podman

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/auto-updates

Trigger an auto-update for all containers configured for automatic updates.

```bash
sudo podman auto-update
```

--------------------------------

### Restart wg-easy container

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/adguard

Commands to stop and restart the wg-easy service using Docker Compose.

```bash
cd /etc/docker/containers/wg-easy
sudo docker compose down -v
sudo docker compose up -d
```

--------------------------------

### Configure Watchtower for Automated Updates

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/auto-updates

Define the Watchtower service and environment variables to automate container updates.

```yaml
services:
    watchtower:
        image: nickfedor/watchtower:latest
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        env_file:
            - watchtower.env
        restart: unless-stopped
```

```text
WATCHTOWER_CLEANUP=true
WATCHTOWER_SCHEDULE=0 0 4 * * *
TZ=Europe/Berlin

# Email
# WATCHTOWER_NOTIFICATIONS_LEVEL=info
# WATCHTOWER_NOTIFICATIONS=email
# WATCHTOWER_NOTIFICATION_EMAIL_FROM=mail@example.com
# WATCHTOWER_NOTIFICATION_EMAIL_TO=mail@example.com
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.example.com
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=mail@example.com
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD="SuperSecurePassword"
# WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
```

--------------------------------

### Configure INSECURE environment variable

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/reverse-proxyless

Add this configuration to your docker-compose.yml file to enable non-secure access to the web UI.

```yaml
environment:
    - INSECURE=true
```

--------------------------------

### Load ip6table_nat kernel module

Source: https://wg-easy.github.io/wg-easy/latest/faq

Manually load the ip6table_nat module to resolve missing nat table errors for IPv6.

```bash
sudo modprobe ip6table_nat
```

--------------------------------

### Caddy Docker Composition

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/caddy

Docker Compose configuration for the Caddy reverse proxy service.

```yaml
# compose.yml

services:
    caddy:
        container_name: caddy
        image: caddy:2.10.0-alpine
        # publish everything you deem necessary
        ports:
            - '80:80/tcp'
            - '443:443/tcp'
            - '443:443/udp'
        networks:
            - caddy
        restart: unless-stopped
        volumes:
            - './Caddyfile:/etc/caddy/Caddyfile:ro'
            - config:/config
            - data:/data

networks:
    caddy:
        name: caddy

volumes:
    config:
    data:
```

--------------------------------

### Authenticate with the API using Python

Source: https://wg-easy.github.io/wg-easy/latest/advanced/api

Uses Basic Authentication to access API endpoints. Ensure 2FA is disabled as it is not supported by the API.

```python
import requests
from requests.auth import HTTPBasicAuth

url = "https://example.com:51821/api/client"
response = requests.get(url, auth=HTTPBasicAuth('username', 'password'))
if response.status_code == 200:
    data = response.json()
    print(data)
else:
    print(f"Error: {response.status_code}")
```

--------------------------------

### Configure Docker network interface priority

Source: https://wg-easy.github.io/wg-easy/latest/faq

Explicitly define interface_name and gw_priority in docker-compose.yml to prevent connectivity loss caused by random interface assignment.

```yaml
services:
    wg-easy:
        # ... other configuration ...
        networks:
            wg:
                interface_name: eth0
                gw_priority: 1
                ipv4_address: 10.42.42.42
            nginx:
                interface_name: eth1
                gw_priority: 0

networks:
    wg:
        # ... wg network config ...
    nginx:
        external: true
```

--------------------------------

### Load iptable_nat kernel module

Source: https://wg-easy.github.io/wg-easy/latest/faq

Manually load the iptable_nat module to resolve missing nat table errors.

```bash
sudo modprobe iptable_nat
```

--------------------------------

### Docker Compose configuration for routed mode

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/routed

Use host network mode to allow WireGuard clients to retain their own IP addresses.

```yaml
services:
    wg-easy:
        image: ghcr.io/wg-easy/wg-easy:15
        container_name: wg-easy
        network_mode: 'host'
        volumes:
            - ./config:/etc/wireguard
            - /lib/modules:/lib/modules:ro
        cap_add:
            - NET_ADMIN
            - SYS_MODULE
        devices:
            - /dev/net/tun:/dev/net/tun
        restart: unless-stopped
```

--------------------------------

### Define Traefik Docker Compose Configuration

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/traefik

Configure the Traefik service with required volumes and network settings.

```yaml
services:
    traefik:
        image: traefik:3.3
        container_name: traefik
        restart: unless-stopped
        ports:
            - '80:80'
            - '443:443/tcp'
            - '443:443/udp'
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - /etc/docker/volumes/traefik/traefik.yml:/traefik.yml:ro
            - /etc/docker/volumes/traefik/traefik_dynamic.yml:/traefik_dynamic.yml:ro
            - /etc/docker/volumes/traefik/acme.json:/acme.json
        networks:
            - traefik

networks:
    traefik:
        external: true
```

--------------------------------

### Define AdGuard Docker Compose configuration

Source: https://wg-easy.github.io/wg-easy/latest/examples/tutorials/adguard

Configures the AdGuard Home container with network settings for WireGuard and Traefik integration.

```yaml
services:
    adguard:
        image: adguard/adguardhome:v0.107.64
        container_name: adguard
        restart: unless-stopped
        volumes:
            - /etc/docker/volumes/adguard/adguard_work:/opt/adguardhome/work
            - /etc/docker/volumes/adguard/adguard_conf:/opt/adguardhome/conf
        networks:
            wg:
                interface_name: eth0
                ipv4_address: 10.42.42.43
                ipv6_address: fdcc:ad94:bacf:61a3::2b
            traefik:
                interface_name: eth1
        labels:
            - 'traefik.enable=true'
            - 'traefik.http.routers.adguard.rule=Host(`adguard.$example.com$`)'
            - 'traefik.http.routers.adguard.entrypoints=websecure'
            - 'traefik.http.routers.adguard.service=adguard'
            - 'traefik.http.services.adguard.loadbalancer.server.port=3000'
            - 'traefik.docker.network=traefik'

networks:
    wg:
        external: true
    traefik:
        external: true
```

--------------------------------

### Reset Admin Password

Source: https://wg-easy.github.io/wg-easy/latest/guides/cli

Commands to reset the admin password either via an interactive prompt or by passing the password as an argument.

```bash
cd /etc/docker/containers/wg-easy
docker compose exec -it wg-easy cli db:admin:reset
```

```bash
cd /etc/docker/containers/wg-easy
docker compose exec -it wg-easy cli db:admin:reset --password <new_password>
```
Tokens:
Raw