4mo ago

wireguard docker client error with ip6_tables

Hi! I am trying to set up a wireguard client in docker. I use the linuxserver image, I it running in server mode on a different machine (exactly the same ubuntu version) and i can login with my laptop to the wireguard server, but the docker wg-client has problems, i hope someone has an idea :)

The client docker container has trouble starting and throws this error: [___](modprobe: FATAL: Module ip6_tables not found in directory /lib/modules/6.8.0-47-generic ip6tables-restore v1.8.10 (legacy): ip6tables-restore: unable to initialize table 'raw' Error occurred at line: 1 Try 'ip6tables-restore -h' or 'ip6tables-restore --help' for more information. )

I copied the config to the server with the wg server running, it has the same problem with the client. I can ping google.com from inside the server container, but not from inside the client container. Here is the output of the 'route' cmd from the client:Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 172.18.0.0 * 255.255.0.0 U 0 0 0 eth0

I searched for a solution quite a bit, but cant seem to find something that works. changed the .yml compose file according to some suggestions but without success.

I tried to install the missing module but could not get it working.

Its a completely clean install of ubuntu 24.04.1 LTS, Kernel: Linux 6.8.0-47-generic.

here is the compose file, in case its needed, it should be exact same one as provided by linux-server in their github:

here is the complete error log from the wg-client docker:

Thanks a lot. I appreciate every input!

3 comments

Does your wireguard config have ipv6 addresses? If your not using them you can safely remove them.
For example Change AllowedIPs = 0.0.0.0/0, ::/0 To AllowedIPs = 0.0.0.0/0
Also could try adding net.ipv6.conf.all.disable_ipv6=1 in the sysctls section
Multiple edits: I’m terrible with formatting while not on a phone.
More edits: just found out i can expand errors and the compose. Looks like it is the AllowedIPs line in peer1.conf. Just removing , ::/0 as above “should” solve it
- Wow, thanks!! That actually solved it apparently! Why does the wireguard config change if i can ping outside the docker container though? Is it because the wireguard client inside the container opens up ip adresses or something? :) Thanks again! Itried to find a solution for many hours yesterday :D
  Oh and is the ',' in the allowed ips meant as an "and" or rather an "or"?
  
  Thats great! Overly simplistic explanation, the container is in its own little network and when you connect wireguard inside the container it is punching a hole out to where the wireguard server is located. Without knowing your setup its difficult, but that is probably why your ping is acting as it does. The container doesn’t know how to get to where you’re attempting to ping.
  The allowed ips is a list, off the top of my head it accepts single IPs and cidr blocks. 0.0.0.0/0 is the cidr block that essentially means all ipv4 IPs, ::/0 is the same for ipv6. So to answer directly, the , is an or, its for any IP in the list.