Unable to Access Services on Local Network (192.168.1.0/24) with Wireguard and Caddy Docker

Unable to Access Services on Local Network (192.168.1.0/24) with Wireguard, Caddy, and Docker

In this article, we will discuss the architecture problem of reaching services hosted on a local network, specifically the 192.168.1.0/24 network, using a domain such as example.com. We will focus on the time when you need to access the Wireguard UI service hosted within the same network.

Architecture Overview

Our proposed solution involves three main components:

1. Wireguard: A secure, fast, and easy-to-use VPN that allows you to tunnel your network traffic.
2. Caddy: A powerful, enterprise-ready, open-source web server with automatic HTTPS.
3. Docker: An open-source platform for developing, shipping, and running applications within containers.

Prerequisites

Before diving into the solution, ensure you have the following installed and configured:

1. A local network with the IP range of 192.168.1.0/24.
2. Wireguard server and client set up and connected.
3. Caddy server installed and configured.
4. Docker installed and running on the server where your services are hosted.

Docker Network Setup

To ensure that your services are accessible via Wireguard, you need to set up a dedicated Docker network. This will enable communication between your services inside Docker containers and the Wireguard network.

docker network create \
   --subnet=192.168.1.0/24 \
   --gateway=192.168.1.1 \
   wireguard-network

Service Exposure with Caddy

With Caddy, you can easily expose your services on the domain example.com. Edit your Caddyfile and add a new proxy for your service:

example.com {
   proxy /my-service 192.168.1.2:8080
}

Understanding the Caddyfile

In the Caddyfile snippet above:

• example.com is your domain.
• /my-service is the desired URL path for the service.
• 192.168.1.2:8080 is the IP address and internal port of the Docker container where the service is running.

Accessing Services via Wireguard

To access the services via Wireguard, you must configure the client to route traffic for the example.com domain through the Wireguard network.

[Interface]
 PrivateKey = 
 Address = 10.0.0.2/32

[Peer]
 PublicKey = 
 AllowedIPs = 192.168.1.0/24, 192.168.1.2/32, example.com
 Endpoint = :
 PersistentKeepalive = 25

Wireguard Configuration Explanation

In the Wireguard configuration snippet:

• Address is the IP address assigned to the Wireguard client.
• AllowedIPs specifies which IP ranges should be routed to the Wireguard server.
• Endpoint should contain the external IP address or hostname of the Wireguard server.

In summary, this article discussed how to access services hosted on the local network (192.168.1.0/24) using a domain (example.com) with Wireguard, Caddy, and Docker. We set up a Docker network with a dedicated subnet, exposed the services using Caddy, and configured Wireguard clients to route traffic for the specific domain through the Wireguard network.

References

• Wireguard official website
• Caddy official website
• Docker documentation