- Notifications
You must be signed in to change notification settings - Fork34
Pritunl Docker container with IPv6 and reverse-proxy support
License
goofball222/pritunl
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
Tag | pritunl Version | Description | Release Date |
---|---|---|---|
latest | v1.32.4034.11 | Latest stable release | 2024-09-27 |
Pritunl container built on Alpine Linux. Supports IPv6 and running behind a reverse proxy. This container requires an external Mongo DB and should be run via Docker Compose or other orchestration.
This container exposes the following five ports:
80/tcp
pritunl web server http port (standalone mode)443/tcp
pritunl web server https port (standalone and wireguard reverse-proxy mode)1194/tcp
pritunl VPN service port1194/tcp
pritunl OpenVPN service port1195/udp
pritunl wireguard service port - No default in app, this is a suggestion only.9700/tcp
pritunl web server http port (non-wireguard reverse-proxy mode)
Wireguard
The Docker host is required to have wireguard kernel modules installed and loaded.
Wireguard also requires that the pritunl web service exists internally on port 443 with SSL enabled (self-signed or LetsEncrypt cert). Without this clients will fail to connect or connection will time out after 15s in wireguard mode. This presents problems with existing reverse-proxy support using port 9700 and no SSL.
Wireguard + Traefik 1.X reverse-proxy + pritunl SSL self-signed cert:
- Set
InsecureSkipVerify = true
in Traefik 1.Xtraefik.toml
config file (configure Traefik to accept invalid/self-signed certs) - Set container ENV variable
REVERSE_PROXY=true
(configure pritunl for reverse-proxy/load-balance mode) - Set container ENV variable
WIREGUARD=true
(configure pritunl to run web interface on port 443 with SSL)
Further pritunl wireguard information available at:
OpenVPN server fails to start, insmod error
ip6tables v1.8.3 (legacy): can't initialize ip6tables table 'filter': Table does not exist (do you need to insmod?)
is repeatedly logged in the Docker container log along with python errors.
Load the ip6tables_filter kernel module on your Docker host and restart the container:
user@host:~$ sudo modprobe ip6table_filteruser@host:~$ sudo docker restart pritunl
This may need to be performed after kernel upgrades and reboots on the Docker host.
Basic docker-compose.yml to launch a Mongo DB container instance, pritunl in standalone mode, and make the web and VPN ports accessible
version:'3'services: mongo: image: mongo:latest container_name: pritunldb hostname: pritunldb network_mode: bridge volumes: - ./db:/data/db pritunl: image: goofball222/pritunl:latest container_name: pritunl hostname: pritunl depends_on: - mongo network_mode: bridge privileged:true sysctls: - net.ipv6.conf.all.disable_ipv6=0 links: - mongo volumes: - /etc/localtime:/etc/localtime:ro ports: - 80:80 - 443:443 - 1194:1194 - 1194:1194/udp - 1195:1195/udp environment: - TZ=UTC
Other/extended docker-compose.yml examples see:https://github.com/goofball222/pritunl/tree/main/examples
Environment variables:
Variable | Default | Description |
---|---|---|
DEBUG | false | Set totrue for extra entrypoint script verbosity for debugging |
MONGODB_URI | mongodb://mongo:27017/pritunl | Sets the URI Pritunl will access for the Mongo DB instance |
PRITUNL_OPTS | unset | Any additional custom run options for the container pritunl process |
REVERSE_PROXY | false | Set totrue to set the pritunl web interface to run in reverse-proxy mode (Traefik/nginx) |
WIREGUARD | false | Set totrue, Switches web interface back to port 443 and HTTPS if running wireguard with reverse-proxy (Traefik/nginx) |
About
Pritunl Docker container with IPv6 and reverse-proxy support