Feature request: Support for Wireguard

[qdm12]

VPN providers support

Natively

• AirVPN
• Mullvad
• Windscribe
• IVPN
• Surfshark since 5989f29
• NordVPN since 07459ee
• FastestVPN since 13ffffb
• ProtonVPN since ac9446e

Using provider custom

Supported since 8645d97 using VPN_SERVICE_PROVIDER=custom

• VPNUnlimited
• Torguard
• PureVPN
• Cyberghost
• VyprVPN
• WeVPN
• PIA
• ProtonVPN
• PrivateVPN

Requires API

This is not done, and requires API communication to get the Wireguard keys etc.

• PIA - need to make PIA API package since it also depends on the token etc.
• PureVPN

Wireguard not supported

• HideMyAss
• SlickVPN
• VPNSecure.me
• IPVanish not supported
• Perfect privacy not supported
• Privado not supported
• ExpressVPN not supported

Extraction needed

This requires to extract the wireguard config from their proprietary app. Let's face it, this is a lot of work for little result, and I might never get to it. But here is the list still:

• NordVPN, see this comment
• Cyberghost, see this comment
• VyprVPN, following supported devices using VyprVPN version 4.0 and higher and Wireguard is not available to configure with Manual setup

Extra todos

• Adapt logger prefix to openvpn or wireguard depending on VPN chosen instead of vpn
• Read keys from files/secrets see Feature request: Allow WIREGUARD_PRIVATE_KEY to be specified via a secret file #614
• Read custom Wireguard configuration file => see Feature request: Wireguard configuration files reading for VPNSP=custom #610
• Rotate private keys
  • For Mullvad see Feature request: Support for Wireguard #134 (comment)

[burkasaurusrex]

Excited to see this under consideration. With wireguard being merged into the 5.6 kernel, it would be awesome to see kernel space support in addition to user space support via the wireguard-go.

Assuming the host's kernel is 5.6+ (or has been backported like in Ubuntu or Debain), I believe you could install wireguard in the container with apk add -U wireguard-tools. Then when you run the container, add --cap-add sys_module to give access to the wireguard kernel module.

It looks like there are a couple of examples (cmulk/wireguard-docker and activeeos/wireguard-docker) that attempt to even install the OOT kernel module in the host. Instead of doing that, maybe it would make the most sense to enable kernel support for hosts running 5.6+ / backported wireguard and wireguard-go for hosts running earlier kernels? 😄

Wireguard's official container framework is probably the most performant, but doesn't look particularly docker-friendly since it requires a lot of host-level config. I'd guess sharing the kernel module would still be more performant than wireguard-go, but I haven't done any testing. For what it's worth, it looks like wireguard-go has come a long way in the last few months.

[qdm12]

Hi there, thanks for the good read 👍

So wireguard-go is probably fast enough for pretty much any personal need. It might not be suitable if you have huge loads and multiple clients. But Go is very quick at networking things, it is a system language originally.

There is also a Rust version of Wireguard the team is developing, which is again faster, as fast or faster than C, so it should be very close to the kernel space implementation although it could run in a container in user space.

We could indeed add instructions on how to use the kernel space Wireguard if you have it setup on your host, that would be a nice addition.

[burkasaurusrex]

Cool, sounds good to me. Also I just noticed that LinuxServer.io added a Wireguard container last month here: linuxserver/docker-wireguard. In case it's helpful.

[qdm12]

@burkasaurusrex Thanks, unfortunately it's the same problem I want to avoid:

This image is designed for Ubuntu and Debian based systems only. During container start, it will download the necessary kernel headers and build the kernel module (until kernel 5.6, which has the module built-in, goes mainstream).

For now it seems only kernel based docker images exist out there which seem pointless to me, you might as well just run it without Docker in that case. Luckily a Go version exists (and a Rust one too) which can work across platforms, cpu arch and kernels 😉

[lavaguy1]

There is also a NordVPN docker container that uses Wireguard... https://github.com/bubuntux/nordvpn they call it "NordLynx" if that helps any. Doesn't seem to do any voodoo on the host...

[qdm12]

NordLynx - NordVpn wireguard implementation (3x-5x times faster). NOTE: Requires --cap-add=SYS_MODULE and --sysctl net.ipv4.conf.all.rp_filter=2

It installs Wireguard on your host kernel --cap-add=SYS_MODULE, not really a big fan of giving access to the Kernel to a container (even mine 😄). Gluetun already has net admin capability and runs the entrypoint as root (no way around it) but I would ideally like to avoid it for security reasons. Especially since it does tunneling to vpn servers which are not the safest places either (i. e. other VPN malicious clients). But I'll plug in the Go implementation of Wireguard (Windows GUI uses it too), it should give fast enough performance and won't require to modify the kernel. I did Shadowsocks in Go last weekend (#220) to replace the C Alpine one, this weekend will be about being able to persist and update ip addresses of vpn servers (for now it's hardcoded). I can try doing Wireguard next or next next weekend 😉

[lavaguy1]

https://www.youtube.com/watch?v=wv_phi5Z288

…

On Sat, Aug 22, 2020 at 3:18 PM Quentin McGaw ***@***.***> wrote: NordLynx - NordVpn wireguard implementation (3x-5x times faster). NOTE: Requires --cap-add=SYS_MODULE and --sysctl net.ipv4.conf.all.rp_filter=2 It installs Wireguard on your host kernel --cap-add=SYS_MODULE, not really a big fan of giving access to the Kernel to a container (even mine 😄). Gluetun already has net admin capability and runs the entrypoint as root (no way around it) but I would ideally like to avoid it for security reasons. Especially since it does tunneling to vpn servers which are not the safest places either (i. e. other VPN malicious clients). But I'll plug in the Go implementation of Wireguard (Windows GUI uses it too), it should give fast enough performance and won't require to modify the kernel. I did Shadowsocks in Go last weekend (#220 <#220>) to replace the C Alpine one, this weekend will be about being able to persist and update ip addresses of vpn servers (for now it's hardcoded). I can try doing Wireguard next or next next weekend 😉 — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#134 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFHXQC66AJCVCN36BYCPXU3SB7ASPANCNFSM4MGNIPWA> .