From e5ed71c841c305c43ce134f812eae1c94e6054bb Mon Sep 17 00:00:00 2001 From: "Edgar R.N" Date: Thu, 25 Sep 2025 21:15:04 +0200 Subject: [PATCH] docs: Temporary fix multi-network iptables Signed-off-by: Edgar R.N --- docs/content/examples/tutorials/adguard.md | 74 +++++++++++++--------- 1 file changed, 45 insertions(+), 29 deletions(-) diff --git a/docs/content/examples/tutorials/adguard.md b/docs/content/examples/tutorials/adguard.md index d535e130..cd13b6bd 100644 --- a/docs/content/examples/tutorials/adguard.md +++ b/docs/content/examples/tutorials/adguard.md @@ -30,31 +30,31 @@ File: `/etc/docker/containers/adguard/docker-compose.yml` ```yaml services: - adguard: - image: adguard/adguardhome:v0.107.64 - container_name: adguard - restart: unless-stopped - volumes: - - /etc/docker/volumes/adguard/adguard_work:/opt/adguardhome/work - - /etc/docker/volumes/adguard/adguard_conf:/opt/adguardhome/conf - networks: - wg: - ipv4_address: 10.42.42.43 - ipv6_address: fdcc:ad94:bacf:61a3::2b - traefik: {} - labels: - - "traefik.enable=true" - - "traefik.http.routers.adguard.rule=Host(`adguard.$example.com$`)" - - "traefik.http.routers.adguard.entrypoints=websecure" - - "traefik.http.routers.adguard.service=adguard" - - "traefik.http.services.adguard.loadbalancer.server.port=3000" - - "traefik.docker.network=traefik" + adguard: + image: adguard/adguardhome:v0.107.64 + container_name: adguard + restart: unless-stopped + volumes: + - /etc/docker/volumes/adguard/adguard_work:/opt/adguardhome/work + - /etc/docker/volumes/adguard/adguard_conf:/opt/adguardhome/conf + networks: + wg: + ipv4_address: 10.42.42.43 + ipv6_address: fdcc:ad94:bacf:61a3::2b + traefik: {} + labels: + - 'traefik.enable=true' + - 'traefik.http.routers.adguard.rule=Host(`adguard.$example.com$`)' + - 'traefik.http.routers.adguard.entrypoints=websecure' + - 'traefik.http.routers.adguard.service=adguard' + - 'traefik.http.services.adguard.loadbalancer.server.port=3000' + - 'traefik.docker.network=traefik' networks: - wg: - external: true - traefik: - external: true + wg: + external: true + traefik: + external: true ``` ## Update `wg-easy` configuration @@ -73,7 +73,14 @@ services: ports: - "51820:51820/udp" ... + networks: + wg: + ... + interface_name: wgeth + ... + ... environment: + - WG_DEVICE=wgeth # Unattended Setup - INIT_ENABLED=true # Replace $username$ with your username @@ -86,6 +93,13 @@ services: - INIT_DNS=10.42.42.43,fdcc:ad94:bacf:61a3::2b - INIT_IPV4_CIDR=10.8.0.0/24 - INIT_IPV6_CIDR=fd42:42:42::/64 + # NOTE: The UI Hooks will overwrite these env vars. + # To make the configuration permanent: + # 1. Paste these rules into the UI's "Hooks" section, replacing the defaults. + # 2. Save the settings in the UI. + # 3. Restart the wg-easy container. + - WG_POST_UP=iptables -t nat -A PREROUTING -i wgeth -p udp --dport 53 -j DNAT --to-destination 10.42.42.43; iptables -t nat -A PREROUTING -i wgeth -p tcp --dport 53 -j DNAT --to-destination 10.42.42.43; ip6tables -t nat -A PREROUTING -i wgeth -p udp --dport 53 -j DNAT --to-destination fdcc:ad94:bacf:61a3::2b; ip6tables -t nat -A PREROUTING -i wgeth -p tcp --dport 53 -j DNAT --to-destination fdcc:ad94:bacf:61a3::2b; iptables -A FORWARD -i wgeth -j ACCEPT; iptables -A FORWARD -o wgeth -j ACCEPT; ip6tables -A FORWARD -i wgeth -j ACCEPT; ip6tables -A FORWARD -o wgeth -j ACCEPT; iptables -t nat -A POSTROUTING -o wgeth -j MASQUERADE; ip6tables -t nat -A POSTROUTING -o wgeth -j MASQUERADE + - WG_POST_DOWN=iptables -t nat -D PREROUTING -i wgeth -p udp --dport 53 -j DNAT --to-destination 10.42.42.43 || true; iptables -t nat -D PREROUTING -i wgeth -p tcp --dport 53 -j DNAT --to-destination 10.42.42.43 || true; ip6tables -t nat -D PREROUTING -i wgeth -p udp --dport 53 -j DNAT --to-destination fdcc:ad94:bacf:61a3::2b || true; ip6tables -t nat -D PREROUTING -i wgeth -p tcp --dport 53 -j DNAT --to-destination fdcc:ad94:bacf:61a3::2b || true; iptables -D FORWARD -i wgeth -j ACCEPT || true; iptables -D FORWARD -o wgeth -j ACCEPT || true; ip6tables -D FORWARD -i wgeth -j ACCEPT || true; ip6tables -D FORWARD -o wgeth -j ACCEPT || true; iptables -t nat -D POSTROUTING -o wgeth -j MASQUERADE || true; ip6tables -t nat -D POSTROUTING -o wgeth -j MASQUERADE || true ... networks: @@ -98,24 +112,26 @@ networks: ## Start services -1. Start `AdGuardHome`: +1. Restart `wg-easy` to apply changes: + _Previous settings and configurations will be restored to default_ ```shell - cd /etc/docker/containers/adguard + cd /etc/docker/containers/wg-easy + sudo docker compose down -v sudo docker compose up -d ``` -2. Restart `wg-easy` to apply changes: +2. Start `AdGuardHome`: ```shell - cd /etc/docker/containers/wg-easy + cd /etc/docker/containers/adguard sudo docker compose up -d ``` 3. Navigate to `https://adguard.$example.com$` to begin the AdGuard Home setup. -/// warning | Important: Configure AdGuard Home Web Interface Port -During the initial AdGuard Home setup, on the page for configuring ports, you **must** set the **Web Interface port** to **3000**. Do not use the default port 80, as this will not work with the Traefik configuration. +/// warning | Important: Configure AdGuard Home Admin Web Interface Port +During the initial AdGuard Home setup on the `Step 2/5` page, you **must** set the **Admin Web Interface Port** to **3000**. Do not use the default port 80, as it will not work with the Traefik configuration. After completing the setup, the AdGuard UI might appear unresponsive. This is expected. **Simply reload the page**, and the panel will display correctly. ///