Wireguard - Docker

Install Wireguard

This is a quick start guide to get you up and running with WireGuard Easy.

The easiest way to run WireGuard Easy is with Docker Compose.

Create docker-compose.yml and execute sudo docker compose up -d

volumes:
  etc_wireguard:

services:
  wg-easy:
    #environment:
    #  Optional:
    #  - PORT=51821
    #  - HOST=0.0.0.0
    #  - INSECURE=false

    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    networks:
      wg:
        ipv4_address: 10.42.42.42
        ipv6_address: fdcc:ad94:bacf:61a3::2a
    volumes:
      - etc_wireguard:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
      # - NET_RAW # ⚠️ Uncomment if using Podman
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1

networks:
  wg:
    driver: bridge
    enable_ipv6: true
    ipam:
      driver: default
      config:
        - subnet: 10.42.42.0/24
        - subnet: fdcc:ad94:bacf:61a3::/64

Now setup a reverse proxy to be able to access the Web UI securely from the internet.

If you want to access the Web UI over HTTP, change the env var INSECURE to true. This is not recommended. Only use this for testing.

Secure Connection

Pastikan DNS domain sudah mengarah ke server

Pastikan vpn.deffcon.com sudah mengarah ke IP publik server Anda (103.250.10.5):

• Login ke penyedia domain Anda.
• Tambahkan record DNS type A:
  • Host: track
  • Value / IP: 103.250.10.5

Tunggu propagasi DNS beberapa menit (hingga 1 jam tergantung provider).

Instal Nginx

sudo apt update
sudo apt install nginx -y

Konfigurasi Nginx untuk reverse proxy

Buat file konfigurasi baru untuk domain Anda di /etc/nginx/sites-available/vpn.deffcon.com:

server {
    listen 80;
    server_name vpn.deffcon.com;

    location / {
        proxy_pass http://localhost:51821/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

PORT 51821 adalah port Wireguard di dalam Docker secara default

Kemudian aktifkan konfigurasi dengan perintah:

sudo ln -s /etc/nginx/sites-available/vpn.deffcon.com /etc/nginx/sites-enabled/

Cek konfigurasi & restart Nginx

sudo nginx -t
sudo systemctl restart nginx

Tambahkan HTTPS dengan Let's Encrypt

Agar lebih aman, gunakan SSL via Certbot:

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d vpn.deffcon.com

Simpan dan restart Nginx

sudo systemctl restart nginx

Auto-Renewal SSL

Let's Encrypt sertifikat berlaku 90 hari. Certbot biasanya sudah otomatis membuat cronjob untuk perpanjangan.

Cek dengan:

sudo certbot renew --dry-run

Uji Coba SSL

Pergi ke alamat vpn.deffcon.com , apakah sudah terencrypt SSL atau belum.