Isolate Wireguard peers to the local Docker network?
reddit / selfhosted

----------------------------------------------------------------------
theflln · 2023-11-06 15:17

I have a Debian server runing a bunch of docker containers. As it
goes, I have friends and family that access my media containers via a
Wireguard container within the same docker network as the media
containers.

As it is now, any peer who connects seems to have full access to the
entirety of my local network. How can I limit them to only having
access to the containers within the docker network, while also letting
the containers have access to the internet?

I can’t seems to find any guides for this. Any help, or even a point
in the right direction to find this information would be greatly
appreciated!

----------------------------------------------------------------------
Nikto_90 · 2023-11-06 15:35

Use Tailscale, I think what you want is doable by only exposing the
docker network to your wider Tailscale network.

----------------------------------------------------------------------
theflln · 2023-11-06 18:06

Thanks, I’ll have a look at this and see if it’ll do!

----------------------------------------------------------------------
Nikto_90 · 2023-11-06 18:10

Once you have Tailscale running on the server, add your docker network
as a subnet. The users in Tailscale will only be able to access/see
that network and the containers there. No other network will be
accessible.

----------------------------------------------------------------------
theflln · 2023-11-06 22:23

Awesome! Thank you, I’ll give this a try

----------------------------------------------------------------------
Ordinary_Employer_39 · 2023-12-01 02:10

This might be what you're looking for
https://github.com/NOXCIS/Wiregate