Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
This repository was archived by the owner on Oct 11, 2024. It is now read-only.
/pritunlPublic archive

Pritunl Docker container with IPv6 and reverse-proxy support

License

NotificationsYou must be signed in to change notification settings

goofball222/pritunl

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Latest Build StatusDocker PullsDocker StarsLicense

Docker tags:

Tagpritunl VersionDescriptionRelease Date
latestv1.32.4034.11Latest stable release2024-09-27


Description

Pritunl container built on Alpine Linux. Supports IPv6 and running behind a reverse proxy. This container requires an external Mongo DB and should be run via Docker Compose or other orchestration.


Usage

This container exposes the following five ports:

  • 80/tcp pritunl web server http port (standalone mode)
  • 443/tcp pritunl web server https port (standalone and wireguard reverse-proxy mode)
  • 1194/tcp pritunl VPN service port
  • 1194/tcp pritunl OpenVPN service port
  • 1195/udp pritunl wireguard service port - No default in app, this is a suggestion only.
  • 9700/tcp pritunl web server http port (non-wireguard reverse-proxy mode)

Wireguard

The Docker host is required to have wireguard kernel modules installed and loaded.

Wireguard also requires that the pritunl web service exists internally on port 443 with SSL enabled (self-signed or LetsEncrypt cert). Without this clients will fail to connect or connection will time out after 15s in wireguard mode. This presents problems with existing reverse-proxy support using port 9700 and no SSL.

Wireguard + Traefik 1.X reverse-proxy + pritunl SSL self-signed cert:

  • SetInsecureSkipVerify = true in Traefik 1.Xtraefik.toml config file (configure Traefik to accept invalid/self-signed certs)
  • Set container ENV variableREVERSE_PROXY=true (configure pritunl for reverse-proxy/load-balance mode)
  • Set container ENV variableWIREGUARD=true (configure pritunl to run web interface on port 443 with SSL)

Further pritunl wireguard information available at:


OpenVPN server fails to start, insmod error

ip6tables v1.8.3 (legacy): can't initialize ip6tables table 'filter': Table does not exist (do you need to insmod?) is repeatedly logged in the Docker container log along with python errors.

Load the ip6tables_filter kernel module on your Docker host and restart the container:

user@host:~$ sudo modprobe ip6table_filteruser@host:~$ sudo docker restart pritunl

This may need to be performed after kernel upgrades and reboots on the Docker host.


Basic docker-compose.yml to launch a Mongo DB container instance, pritunl in standalone mode, and make the web and VPN ports accessible

version:'3'services:  mongo:    image: mongo:latest    container_name: pritunldb    hostname: pritunldb    network_mode: bridge    volumes:      - ./db:/data/db  pritunl:    image: goofball222/pritunl:latest    container_name: pritunl    hostname: pritunl    depends_on:        - mongo    network_mode: bridge    privileged:true    sysctls:      - net.ipv6.conf.all.disable_ipv6=0    links:      - mongo    volumes:      - /etc/localtime:/etc/localtime:ro    ports:      - 80:80      - 443:443      - 1194:1194      - 1194:1194/udp      - 1195:1195/udp    environment:      - TZ=UTC

Other/extended docker-compose.yml examples see:https://github.com/goofball222/pritunl/tree/main/examples


Environment variables:

VariableDefaultDescription
DEBUGfalseSet totrue for extra entrypoint script verbosity for debugging
MONGODB_URImongodb://mongo:27017/pritunlSets the URI Pritunl will access for the Mongo DB instance
PRITUNL_OPTSunsetAny additional custom run options for the container pritunl process
REVERSE_PROXYfalseSet totrue to set the pritunl web interface to run in reverse-proxy mode (Traefik/nginx)
WIREGUARDfalseSet totrue, Switches web interface back to port 443 and HTTPS if running wireguard with reverse-proxy (Traefik/nginx)

[8]ページ先頭

©2009-2025 Movatter.jp