Half-Working Routed Docker Subnet with WireGuard

Half-Working Routed Docker Subnet with WireGuard: A Comprehensive Guide

In this article, we will discuss the process of routing traffic from a Docker subnet to a WireGuard interface. Specifically, we will focus on the scenario where the Docker subnet is 192.168.50.0 and the WireGuard interface is wg0. We will also cover the case where the client wg0.conf file is configured to not automatically route traffic.

Prerequisites

Before we begin, it is assumed that you have already installed and configured Docker and WireGuard on your system. If you have not done so, please refer to the official documentation for each respective technology.

Routing Traffic from Docker Subnet to WireGuard Interface

To route traffic from the Docker subnet to the WireGuard interface, we will need to perform the following steps:

1. Create a new WireGuard interface on the host machine.
2. Add the Docker subnet to the WireGuard interface configuration.
3. Configure the WireGuard client to not automatically route traffic.
4. Start the WireGuard interface.
5. Configure the Docker network to use the WireGuard interface as its default gateway.

Creating a New WireGuard Interface

To create a new WireGuard interface on the host machine, we will use the following command:

This will create a new WireGuard interface named wg0. We can confirm that the interface has been created by running the following command:

Adding the Docker Subnet to the WireGuard Interface Configuration

Next, we will need to add the Docker subnet to the WireGuard interface configuration. This can be done by editing the wg0.conf file and adding the following line:

This will add the IP address 192.168.50.1/24 to the wg0 interface, effectively adding the Docker subnet to the WireGuard network.

Configuring the WireGuard Client to Not Automatically Route Traffic

By default, the WireGuard client will automatically route all traffic through the VPN. However, in our scenario, we want to prevent this from happening. To do so, we will need to edit the wg0.conf file and add the following line:

This will configure the WireGuard client to only route traffic that matches the specified IP ranges. Since we have specified 0.0.0.0/0 and ::/0, this will effectively disable automatic routing of all traffic.

Starting the WireGuard Interface

Once we have made the necessary changes to the wg0.conf file, we can start the WireGuard interface by running the following command:

Configuring the Docker Network to Use the WireGuard Interface as its Default Gateway

Finally, we will need to configure the Docker network to use the WireGuard interface as its default gateway. This can be done by running the following command:

This will create a new Docker network named my-network with the subnet 192.168.50.0/24 and the gateway 192.168.50.1. All containers created within this network will automatically use the WireGuard interface as their default gateway.

In this article, we have discussed the process of routing traffic from a Docker subnet to a WireGuard interface. Specifically, we have covered the scenario where the Docker subnet is 192.168.50.0 and the WireGuard interface is wg0. We have also discussed the case where the client wg0.conf file is configured to not automatically route traffic.

References

• Docker Documentation
• WireGuard Documentation