RFC: Implementing Wireguard Support #2608
Replies: 10 comments 13 replies
-
|
Fantastic. Can't help with the 1gb image size, only to suggest peeking in thrnz/docker-wireguard-pia GitHub and seeing how they implement it. That image is 32mb. I'm running thrnz (32mb) into qbittorrent (200mb). It passes the forwarded port from PIA into qbittorrent using the PORT_SCRIPT env. Naturally this is PIA, and the beauty of your image is compatibility between so many providers. But maybe there's something to gleam from there. p.s. I moved from transmission to qbittorrent as I need BitTorrent v2, and the version of transmission here didn't support it. edit I see you support transmission 4.x now, so this is no longer an issue |
Beta Was this translation helpful? Give feedback.
-
|
Looking forward to this! When running the latest The Container network info: |
Beta Was this translation helpful? Give feedback.
-
|
Just want to say, I really appreciate everyone's effort that goes into developing this container. Wireguard support would be the cherry on the top, as in my own experience, it is consistently much faster than OVPN. I will test the container when I get a chance! |
Beta Was this translation helpful? Give feedback.
-
|
The waiting time was simply too long for me until this implementation is ready. I went a different way and it is currently running very stable for me. Especially since Wireguard is not in the kernel of a Synology NAS, something else is needed anyway. |
Beta Was this translation helpful? Give feedback.
-
|
Out of curiosity, did you get port forwarding to work as well? |
Beta Was this translation helpful? Give feedback.
-
|
Yes. Its FIREWALL_VPN_INPUT_PORTS=${VPN_PORT} |
Beta Was this translation helpful? Give feedback.
-
|
I still running this 2 service docker images because you get the latest updates of both words! And you are not dependent on something where there are rarely updates or no further development like this haugene project. |
Beta Was this translation helpful? Give feedback.
-
|
Ok, and have you taken some steps to secure the solution? I believe some security features such as vpn killswitch are built into haugenes solution via special iptables rules. For port forwarding, do you have this fully automated, or are you manually updating the port in transmission daemon according to the currently forwarded port? |
Beta Was this translation helpful? Give feedback.
-
|
gluetun already has iptables for security. And about your Panaroia. Gluetun is regularly updated and the security is regularly increased. |
Beta Was this translation helpful? Give feedback.
-
|
Just tried and it's working great. First tried fastestvpn conf and it was based on nameservers rather than ip address so it didn't work. Then used vpnunlimited wireguard config and it worked great. |
Beta Was this translation helpful? Give feedback.
-
|
I'm trying to run this on a Synology NAS. Used the provided yml (https://github.com/haugene/docker-transmission-openvpn/blob/wg/wireguard/docker-compose.yml) but I'm getting: mount --make-shared /run/netns failed: Permission denied I could be way off in my setup since there isn't much documentation (understandably), but does anyone know how I might be able to get past this? |
Beta Was this translation helpful? Give feedback.
-
|
Got the wireguard up and running but cannot open any port..checked with privatevpn and they don't support port forwarding for the wireguard, just wanted to check if other providers have this working? |
Beta Was this translation helpful? Give feedback.
-
|
Hey ! |
Beta Was this translation helpful? Give feedback.
-
|
I've set it up with PIA, deployed to Kubernetes using this old chart, seems to work fine. |
Beta Was this translation helpful? Give feedback.
-
|
@conclusionlogic Can you please share your values.yaml, I'm looking to deploy this to k8s so that'd make it easy for me. |
Beta Was this translation helpful? Give feedback.
-
|
Sure, no problem. values.yamlI’ve reset the The conclusionlogic/piawgcli:v0.0.1 image is built directly from https://gitlab.com/ddb_db/piawgcli source code. BTW, I've since switched to using https://gitlab.alfter.us/salfter/transmission-wireguard-pia / https://hub.docker.com/r/salfter/transmission-wireguard-pia/tags as my springboard. |
Beta Was this translation helpful? Give feedback.
-
|
I went a slightly different route and created this deployment to get transmission working through wireguard: deployment.yamlapiVersion: apps/v1
kind: Deployment
metadata:
name: transmission
spec:
selector:
matchLabels:
app: transmission
strategy:
type: Recreate
replicas: 1
template:
metadata:
labels:
app: transmission
spec:
containers:
- name: transmission
image: lscr.io/linuxserver/transmission:latest
ports:
- containerPort: 9091
volumeMounts:
- name: transmission
mountPath: /config
- name: transmission_download
mountPath: /downloads
subPath: transmission/
- name: transmission_download
mountPath: /watch
subPath: transmission/transmission/watch
- name: wireguard
image: "lscr.io/linuxserver/wireguard:latest"
securityContext:
capabilities:
add:
- NET_ADMIN
lifecycle:
postStart:
exec:
command:
[
"/bin/sh",
"-c",
"cp /wgconfig/* /config/;sed -i '/net.ipv4.conf.all.src_valid_mark/d' /usr/bin/wg-quick",
]
volumeMounts:
- name: wireguard-config
mountPath: /wgconfig
volumes:
- name: wireguard-config
secret:
secretName: wireguard-config
- name: transmission
persistentVolumeClaim:
claimName: transmission
- name: transmission_download
persistentVolumeClaim:
claimName: transmission_downloadand added this to wireguard to route all RFC1819 traffic through local gateway: I have to manually generate the config though, but that'll be rare and this is really simple otherwise. Hope it helps someone 😊 |
Beta Was this translation helpful? Give feedback.
-
|
Has there been any more progress on making the jump from OpenVPN to Wireguard? I tried to test out the proposed implementation of Wireguard, but found it a bit difficult, being a docker newbie and all. If the solution is now broken out into two separate images (wireguard and base/transmission), how do I then combine them correctly into one single docker compose file? I'm using PIA VPN and I generated a pia-wg.conf using this soluition: Given a few pointers on how to get the full solution up and running, just with using Wireguard instead of OpenVPN, I'll happily test out and report back since I'm quite eager to migrate to Wireguard. |
Beta Was this translation helpful? Give feedback.
-
|
Hey Moonraker2 ! If you also need my docker configuration (like variables), feel free to ask ;) |
Beta Was this translation helpful? Give feedback.
-
|
Hi @Uzurka That sounds interesting indeed. And yes, if you are able to share a docker compose file, that sure would be appreciated :) I'll also re-post the questions I asked to rakuri255, further up this thread: have you taken some steps to secure the solution? I believe some security features such as vpn killswitch are built into haugenes solution via special iptables rules. |
Beta Was this translation helpful? Give feedback.
-
|
There's an integrated kill-switch (iptables rules) |
Beta Was this translation helpful? Give feedback.
-
|
Sounds good. Are you able to share your docker compose file? |
Beta Was this translation helpful? Give feedback.
-
|
Sure ! Tho it's not docker compose but ansible vars, but still yml :) |
Beta Was this translation helpful? Give feedback.
-
Hello there 👋
I decided to start a new discussion to get feedback on the implementation and hopefully some testing of my proposed implementation of Wireguard support. The previous Wireguard discussion is a bit outdated and other related discussions also exist, for example here and here
This thread is about this proposed PR: #2607
A summary of what it does:
haugene/transmission-wireguard,haugene/transmission-openvpnand a common base imagehaugene/transmission-baseCurrent limitations and room for improvement:
If you have any comments about the image naming, common base image, and what we should name the GitHub repository that would also be great. Using a common base image will help us reduce build time of the main images because we now build Transmission from source and it takes a long time. With this setup all changes to the main images will be quick. After merging this we should change the openvpn image to use the same base. I would then also suggest renaming the GitHub repo to
haugene/docker-transmission-vpnto not lock into the openvpn name.CALL TO ACTION: Please test it, and read the PR if you're up for that. Any report of bugs 🐛 or suggestions for improvement is very welcomed. I've made a docker-compose.yml example to get you started. For reference I've used Mullvad when setting it up. Had some issues with PIA initially, but that's probably worth another shot now.
Thanks to @warlo for helping out with the implementation 🙌
Beta Was this translation helpful? Give feedback.
All reactions