Create your own VPN with WireGuard on Docker

We are going to look together at how to easily create your own private VPN server with WireGuard running in a Docker container. I will guide you step by step through the installation, the configuration and the addition of clients to your VPN server.

Before we can create and start containers, we need to install Docker and Docker-compose. If you have already installed docker and docker-compose on your server, you can skip these steps.

Installing Docker

curl -fsSL https://get.docker.com/ | sh

Adding a user to the docker group in order to run the docker command

sudo usermod -aG docker username

Installing docker-compose

sudo curl -L https://github.com/docker/compose/releases/download/1.29.1/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose

Adding execution rights on docker-compose

sudo chmod +x /usr/local/bin/docker-compose

Create a docker-compose file

Next, we need to create a docker-compose file in order to manage our WireGuard container easily. To do this, I am using a docker image and template from the website https://linuxserver.io. The people at linuxserver.io are enthusiasts and maintain many images for the docker community.

First of all, we are going to create a new folder in the /opt directory called /opt/wireguard-server and create a new docker-compose.yaml file in that directory. You also have to change the ownership of this folder to your Linux user.

sudo mkdir /opt/wireguard-server
nano /opt/wireguard-server/docker-compose.yaml

In this file, we are going to use the following template; please refer to the linuxserver/wireguard documentation: https://hub.docker.com/r/linuxserver/wireguard

version: "2.1"
services:
  wireguard:
    image: linuxserver/wireguard
    container_name: wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
      - SERVEURURL=wireguard.domain.com #optional
      - SERVERPORT=51820 #optional
      - PEERS=1 #optional
      - PEERDNS=auto #optional
      - INTERNAL_SUBNET=10.10.10.0 #optional
    volumes:
      - /opt/wireguard-server/config:/config
      - /lib/modules:/lib/modules
    ports:
      - 51820:51820/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped

Replace SERVEURURL with a domain name or with the public IP address of your WireGuard server, because your clients will have to connect from outside your local network. You can also set it to auto, and the docker container will automatically determine your public IP address and use it in the client configuration.

Start your WireGuard server

You can now start your WireGuard container with the following command, and clients should be able to connect.

cd /opt/wireguard-server
docker-compose up -d

Distribute the configuration files to the clients

The most convenient approach for your client computers is to install the WireGuard application directly on the system. If you want to know how to do this, you can also refer to our article.

You will find the .cnf files needed when connecting from a WireGuard client in the /opt/wireguard-server/config folder. Each peer.cnf is saved according to its number in a folder called peer1, peer2, peer3 and so on.

cd /opt/wireguard-server/config/peer1

Add additional clients

If you want to add additional clients, you can simply increase the PEERS parameter in the docker-compose.yaml file. After changing this value, you have to restart your Docker container with the –force-recreate parameter.

docker-compose up -d --force-recreate

We hope you enjoyed this. See you very soon on Awoui.