Docker configuration for Mullvad VPN with Wireguard

[GiomB]

Hi ! I am totally new to docker and VPN management, sorry in advance if I'm terrible at it.

I want to isolate some dockers with my Mullvad VPN and of course with Wireguard, as it seems the new must-have for everyone here.
BUT I really don't understand, even with the "environment variables" of the documentation, how to set up wireguard.
I understand I have to fill WIREGUARD_PRIVATE_KEY, WIREGUARD_ADDRESS, WIREGUARD_ENDPOINT_PORT, the country etc ...
But with what ? When I go to my mullvad account, I generate one private key.
After that, I select my country and city and it gives me one .conf file with in it ANOTHER private key, one public key, and I believe the wireguard adress (like xx.xx.xx.xx/xx).
So which private key do I have to take ? And is the .conf useful, like I have to copy it to /config ?
When I try to launch the docker (with portainer, idk if it matters), I have always "cannot parse private key" error.
I believe I do something wrong and I can't find any solution in the github, so here am I :)
If that was already explained, please excuse me and redirect me.
And if not, could someone share with me his docker compose file for mullvad, or explain me the way mullvad works ?

Thanks a lot !!

[qdm12]

with in it ANOTHER private key

Yes I saw that too, I believe the key they show in the web ui is the hash digest of the actual private key which is in the configuration file. That bummed me out too 😄

So which private key do I have to take ? And is the .conf useful, like I have to copy it to /config ?

Copy paste the Private Key and Address values from any of the Wireguard configurations you downloaded. You only need to set WIREGUARD_PRIVATE_KEY and WIREGUARD_ADDRESS as specified in the Mullvad table. For example:

docker run -it --rm --cap-add=NET_ADMIN \
-e VPNSP=mullvad \
-e VPN_TYPE=wireguard \
-e WIREGUARD_ADDRESS="11.48.216.37/32" \
-e WIREGUARD_PRIVATE_KEY="OFf8G73HKurisHXAUmrXxU5C0VD50EMn3N9KAbut/1k=" \
qmcgaw/gluetun

Note that with Mullvad, you can use the same address and private key for all servers (which is awesome), so it's really a set once and forget type of environment variables. The server 'public key', endpoint, port and location information are all built in gluetun so no need to set them (they are taken from https://api.mullvad.net/www/relays/all/ and stored in the program here).

For Wireguard files support, you can subscribe to #610 although using those two environment variables you set once are most likely much easier to use for Mullvad.

A few VPN knowledge points:

• Wireguard is only 1-5% faster than OpenVPN and that is only true on very close VPN servers. Bandwidth wise it's about the same realistically. Now it's simpler than OpenVPN with wayyy less options so I prefer it as a developer, but end-user wise, it's more or less the same 😉

A few Docker knowledge points:

• A docker running thing is called a Docker container

Finally, I can share a docker-compose.yml if you want if you can't set it up in Portainer, just let me know!

[GiomB]

Thank you very much for all your very clear explanations! I'm glad I took Mullvad as my VPN, they look great 😃

With all what you said, I managed to run the gluetun container directly from the terminal (I had only tried from portainer actually).
But with a docker-compose file launched by a terminal or portainer, I always have this new issue:

2021/09/16 13:14:30 INFO storage: merging by most recent 11860 hardcoded servers and 11860 servers read from /gluetun/servers.json
2021/09/16 13:14:30 ERROR cannot read VPN settings: cannot read Wireguard settings: environment variable WIREGUARD_ADDRESS: address "10.66.254.95/32": invalid CIDR address: "10.66.254.95/32"
2021/09/16 13:14:30 INFO Shutdown successful

I think it is an issue with docker-compose since I use exactly the same private key and adress than with just docker run.
Here is my docker-compose.yml file:

version: "2"
services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    network_mode: bridge
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8000:8000/tcp # Built-in HTTP control server
    # command:
    volumes:
      - /media/carteSD/gluetun:/gluetun
    environment:
      # More variables are available, see the Wiki table
      - VPNSP=mullvad
      - VPN_TYPE=wireguard
      - WIREGUARD_ADDRESS="10.66.254.95/32"
      - WIREGUARD_PRIVATE_KEY="cD266su4s4LTtLPP8qWA6b1NyVSfJqNvVJJp8hTwzls="
    restart: always

What did I do wrong ?
I would like very much your docker-compose file to compare with mine.

Thank you very much for your work !

[qdm12]

Double quotes are a double edge sword

-- me, circa 2021

Docker run needs the double quotes to avoid interpreting the /, but using them with docker-compose.yml causes them to be read as is by the program. Just remove the double quotes 😉

[GiomB]

Wooow ! It works, I can continue my self-hosting adventure. It was a big beginner's mistake.
Merci beaucoup ! 🤩

[qdm12]

Enjoy! And no it's not a beginner mistake actually, everyone gets bitten by it regularly 😄