Accessing an Internal Docker Network through a WireGuard Tunnel on an Orange Pi 4 B VPS
In this article, we will discuss how to set up a WireGuard tunnel on an Orange Pi 4 B VPS running the wg-easy Docker image and use it to proxy Minecraft server requests.
Prerequisites
Before we begin, make sure you have the following:
- An Orange Pi 4 B board
- A VPS with Ubuntu 20.04 or later
- Root or sudo access to the VPS
- Docker installed on the VPS
- The wg-easy Docker image installed on the VPS
- The WireGuard package installed on the Orange Pi 4 B
Setting Up WireGuard on the Orange Pi 4 B
First, we need to set up WireGuard on the Orange Pi 4 B. You can download WireGuard for your operating system or use the WireGuard tools package to manage WireGuard interfaces.
Generating Keys
To generate the keys for your WireGuard interface, run:
$ wg genkey | tee privatekey & wg pubkey > publickey
This will generate a private key for the interface and its corresponding public key. Keep the private key safe, as you will need it to configure the WireGuard tunnel.
Creating the WireGuard Configuration File
Next, create the WireGuard configuration file:
$ sudo nano /etc/wireguard/wg0.conf
Add the following to the configuration file:
[Interface]
PrivateKey = [Insert Private Key Here]
ListenPort = 51820
[Peer]
PublicKey = [Insert Public Key of VPS Peer]
Endpoint = [VPS IP Address]:51820
AllowedIPs = 0.0.0.0/0
Replace [Insert Private Key Here] with the private key you generated earlier and [Insert Public Key of VPS Peer] with the public key of the VPS peer. Replace [VPS IP Address] with the IP address of the VPS.
Setting Up the WireGuard Peer on the VPS
Next, we need to set up the WireGuard peer on the VPS. First, we need to create a new network for the Docker containers.
Creating the Docker Network
Run the following command to create a new network for the Docker containers:
$ docker network create docker-net
Creating a Docker Container for WireGuard
Next, create a new Docker container for WireGuard using the wg-easy Docker image. Run:
$ docker run -d --name wg-easy -p 51820:51820/udp -v /etc/wireguard:/etc/wireguard wgeasy/wg-easy:latest
This will create a new Docker container for WireGuard and expose the WireGuard port (51820) on the VPS. It will also mount the WireGuard directory on the VPS to the container.
Configuring the WireGuard Tunnel
Next, we need to configure the WireGuard tunnel. Open a web browser and go to https://[VPS IP Address]:51821 to open the wg-easy web interface. Click on "Add Peer"
Add the following settings for the peer:
- Peer Public Key: Insert the public key of the Orange Pi 4 B peer
- Endpoint: Insert the IP address of the Orange Pi 4 B
- Allowed IPs: 0.0.0.0/0
- Preshared Key: Leave blank
Click "Save" and "Close". This will create the WireGuard peer on the VPS.
Setting Up a Minecraft Server on the VPS
Next, we need to set up a Minecraft server on the VPS. You can use any Minecraft server software you like.
Creating a Docker Container for the Minecraft Server
Create a new Docker container for the Minecraft server using the following command:
$ docker run -d --name minecraft-server -p 25565:25565 --network docker-net [Minecraft Server Docker Image]
Replace [Minecraft Server Docker Image] with the Docker image for your Minecraft server.
Configuring the Minecraft Server to Use the WireGuard Tunnel
Next, we need to configure the Minecraft server to use the WireGuard tunnel. We will use iptables to forward traffic from the Minecraft server to the WireGuard interface.
Run the following command to forward traffic from the Minecraft server to the WireGuard interface:
$ iptables -t nat -A PREROUTING -p tcp --dport 25565 -j DNAT --to-dest [WireGuard IP Address]
Replace [WireGuard IP Address] with the IP address of the WireGuard interface on the VPS.
Testing the Setup
To test the setup, connect to the Minecraft server from a Minecraft client outside of the WireGuard network. If you can connect, you have successfully set up the WireGuard tunnel and proxy Minecraft server requests through it.
In this article, we discussed how to set up a WireGuard tunnel between an Orange Pi 4 B and a VPS running the wg-easy Docker image. We then set up a Minecraft server on the VPS and configured it to use the WireGuard tunnel. This allows us to proxy Minecraft server requests through the VPS.