A WireGuard VPN server in Docker provides a private route through a server you control. The setup below connects one device and verifies its traffic path.

Allow roughly 15 minutes once Docker, SSH access, and public connectivity are ready. Server provisioning and network troubleshooting can take additional time. Treat high speed as something to measure rather than a guaranteed result.

Before deploying your WireGuard VPN server in Docker

Start with an Ubuntu 24.04 LTS server running Docker Engine and its Compose plugin. Follow Docker’s installation instructions if either component is missing.

Use a public IPv4 address or a hostname pointing to it. Allow inbound UDP port 51820 through the provider’s firewall. For a home server, forward that UDP port to its LAN address.

The host needs working WireGuard and iptables kernel support. Confirm compatibility before deployment because Docker cannot supply a missing host kernel feature.

Deploy WireGuard with Docker Compose

The LinuxServer.io image generates server and client configurations from environment variables.

Create the Compose configuration

Prepare a private configuration directory using your normal SSH account:

mkdir -p ~/wireguard/config
cd ~/wireguard
chmod 700 config
id -u
id -g

Create compose.yaml with the configuration below. Replace YOUR_PUBLIC_IP and substitute the displayed user and group IDs for 1000.

services:
  wireguard:
    image: lscr.io/linuxserver/wireguard:latest
    container_name: wireguard
    cap_add:
      - NET_ADMIN
    environment:
      PUID: "1000"PGID: "1000"TZ: Etc/UTC
      SERVERURL: YOUR_PUBLIC_IP
      SERVERPORT: "51820"PEERS: "1"PEERDNS: "1.1.1.1"ALLOWEDIPS: "0.0.0.0/0"LOG_CONFS: "false"volumes:
      - ./config:/config
    ports:
      - "51820:51820/udp"sysctls:
      net.ipv4.ip_forward: "1"
      net.ipv4.conf.all.src_valid_mark: "1"restart: unless-stopped

PEERS creates one device profile, while PEERDNS selects its DNS resolver. Setting LOG_CONFS=false keeps configuration QR codes out of container logs.

Preload required kernel modules on the host if necessary. The image documents optional SYS_MODULE and /lib/modules access for loading missing modules from the container.

Start the container and check network access

Start the service and inspect its status and logs:

sudo docker compose up -d
sudo docker compose ps
sudo docker compose logs wireguard

A running container still needs a reachable public endpoint. Check the provider firewall and any router forwarding rules.

Docker’s firewall documentation explains that published ports can bypass UFW rules. Don’t assume UFW alone controls the container’s network exposure.

Connect a device and choose VPN routing

Each participating device, called a peer, needs its own profile. Transfer config/peer1/peer1.conf securely to the device and import it into an official WireGuard client.

This configuration routes all IPv4 destinations through the VPN. Split tunneling routes only selected destinations, determined by AllowedIPs. The wg-quick manual explains these routing rules.

IPv6 needs separate handling because 0.0.0.0/0 covers IPv4 only. Block untunneled IPv6 on the client until dual-stack routing is configured and tested. On Windows, retain the client’s full-tunnel blocking behavior described in its network documentation.

Verify your WireGuard Docker VPN and troubleshoot performance

Successful deployment means traffic follows the intended route, beyond simply displaying an active connection.

Confirm the tunnel carries traffic

Connect from another network, such as mobile data, then browse a website. Inspect the server using WireGuard’s status command:

sudo docker exec wireguard wg show

Look for a recent handshake and increasing transfer counters. Confirm the client’s public IPv4 matches the server’s address. Check DNS resolution and ensure IPv6 cannot bypass the tunnel.

Measure speed and isolate failures

Compare throughput with and without the tunnel using the same test endpoint. For controlled measurements, iperf3 provides client/server testing and reverse-direction tests through -R.

Troubleshoot according to the symptom:

  • Without a handshake, check the endpoint, UDP reachability, and keys.
  • With a handshake but no browsing, check forwarding, routing, and DNS.
  • With stalled transfers, investigate MTU, the maximum packet size.

Keep automatic MTU sizing initially, as recommended by the wg-quick documentation. Change it when testing identifies a packet-size problem.

Secure and maintain the WireGuard VPN server

Treat configuration files as credentials because they contain private keys. Restrict access and keep an encrypted backup of the configuration directory.

Create separate profiles for additional devices by increasing PEERS and recreating the container. Changing configuration variables preserves existing keys; it does not replace compromised credentials. Follow the image’s regeneration instructions when rotating keys.

After backing up, update the image and recreate the service:

sudo docker compose pull
sudo docker compose up -d

The bind mount preserves configuration across container recreation. Repeat the connection checks after each update before relying on the tunnel.

Confirm the deployment before relying on it

A WireGuard VPN server in Docker is ready when handshakes, routing, and DNS work as intended. Confirm IPv6 handling and measure performance before relying on it. Protect the backup and issue a separate profile for each additional device.

FAQ

Does WireGuard in Docker need privileged mode?

The example uses NET_ADMIN rather than unrestricted privileged mode. Module loading may require the optional access documented by LinuxServer.io. LinuxServer.io

Can I route only selected traffic through WireGuard?

Set AllowedIPs to the required destination ranges instead of the default route. Include the tunnel server address when needed. git.zx2c4.com

Why does WireGuard connect without providing internet access?

A handshake confirms peer communication but doesn’t prove correct forwarding or DNS. Check both before changing keys or reinstalling the container. WireGuard

Will this setup guarantee gigabit speeds?

Deployment alone does not establish any particular throughput. WireGuard labels its published benchmarks outdated, making actual connection measurements more useful. WireGuard