Connect on existing docker network

[Karsto-sys]

Hi,

I’m trying to set up a gateway node on an existing Docker network but I’m unable to get it to connect. I followed the official guide, which states that I only need to configure the correct subnet.

[ { "Name": "dockerproxy", "Id": "3dd942c235179f6ae2949e5748b27d2c5ee1a5b72244450a88e6b906000bf486", "Created": "2023-07-27T05:45:37.235136397-07:00", "Scope": "local", "Driver": "bridge", "EnableIPv6": false, "IPAM": { "Driver": "default", "Options": {}, "Config": [ { "Subnet": "172.20.0.0/16", "Gateway": "172.20.0.1" } ] }, "Internal": false, "Attachable": false, "Ingress": false, "ConfigFrom": { "Network": "" }, "ConfigOnly": false, "Containers": {

logs from the container

2025/09/20 06:03:01 Error: Unable to connect to tunnel, please review your user permissions or if you are inside container ensure that you have added the capability NET_ADMIN
tcpdump: wg0: No such device exists
(No such device exists)
2025/09/20 06:09:45 Error: Unable to connect to tunnel, please review your user permissions or if you are inside container ensure that you have added the capability NET_ADMIN
tcpdump: wg0: No such device exists
(No such device exists)
Connecting gateway unraid...
Connecting gateway unraid...

From the logs, it looks like the WireGuard interface (wg0) is not being created. The error message suggests it might be related to missing NET_ADMIN capabilities, but I’ve already added that in my container configuration.

Could you help me understand what I’m missing to get the gateway connected?

[dmesad]

Hi!

That issue usually means the container lacks the necessary privileges to create the WireGuard interface. The key requirement is adding NET_ADMIN capability.

Here’s the minimal working configuration for the Wiredoor gateway container:

services:
  wiredoor-gw:
    image: wiredoor/wiredoor-cli:latest
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.ip_forward=1
    environment:
      WIREDOOR_URL: https://your-wiredoor-instance_or_ip
      TOKEN: your-gateway-node-token
    networks:
      - wiredoor

Make sure:

• You're using cap_add: [NET_ADMIN]
• Your Docker network matches the subnet configured in Wiredoor

If the issue persists, feel free to share your docker-compose.yml so I can take a closer look.

[Karsto-sys]

Hi , I tinkered a bit and i think there was a problem with my token now i get a new error

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on wg0, link-type RAW (Raw IP), snapshot length 262144 bytes tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on wg0, link-type RAW (Raw IP), snapshot length 262144 bytes Connecting gateway unraid... Port 443 is closed or unreachable: dial tcp 10.0.0.1:443: connect: connection refused ❌ Tunnel seems active, but Wiredoor server unreachable. Try running 'wiredoor connect' again or check server availability. Connecting gateway unraid... Port 443 is closed or unreachable: dial tcp 10.0.0.1:443: connect: connection refused

here is my docker compose

networks:
  dockerproxy:
    name: dockerproxy
    external: true

 
services:
  wiredoor-gw:
    image: ghcr.io/wiredoor/wiredoor-cli:latest
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.ip_forward=1
    environment:
      WIREDOOR_URL: https://wiredoor.******.com
      TOKEN: *******
    networks:
      - dockerproxy

my node config:

and my existing docker network

{ "Name": "dockerproxy", "Id": "3dd942c235179f6ae2949e5748b27d2c5ee1a5b72244450a88e6b906000bf486", "Created": "2023-07-27T05:45:37.235136397-07:00", "Scope": "local", "Driver": "bridge", "EnableIPv6": false, "IPAM": { "Driver": "default", "Options": {}, "Config": [ { "Subnet": "172.20.0.0/16", "Gateway": "172.20.0.1" } ] }, "Internal": false, "Attachable": false, "Ingress": false, "ConfigFrom": { "Network": "" }, "ConfigOnly": false, "Containers": { "06c5a74d44bae0f01f360f3e3e683dac6ed29e4de3b8ef940ce05a170583117a": { "Name": "wiredoor-wiredoor-gw-1", "EndpointID": "6e96fdae06163acd9b9bddd9ad26224c096d42e9c7f2297660f452922eb87841", "MacAddress": "02:42:ac:14:00:19", "IPv4Address": "172.20.0.25/16", "IPv6Address": "" },.....

I can ping from inside the gateway container to wiredoor

PING wiredoor.****.com (172.67.132.61): 56 data bytes 64 bytes from 172.67.132.61: seq=0 ttl=42 time=7.151 ms 64 bytes from 172.67.132.61: seq=1 ttl=42 time=7.004 ms 64 bytes from 172.67.132.61: seq=2 ttl=42 time=6.919 ms ^C 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max = 6.919/7.024/7.151 ms /app $

I also checked ports and everything looks good. I also tried with pangolin which works but I think wiredoor would fit my needs better

[Karsto-sys]

I found one error i misconfigured my dns entries...

but now im am stuck here

I cannot connect to a service even tough I can ping it from inside the gateway container...

[dmesad]

I’m not fully sure I understand your current setup or the exact point you’re at right now. Could you share a bit more detail (your updated configuration or logs) so I can better see what’s happening?

[Karsto-sys]

Hi, I followd this guide and its working now when I use the IP address of wiredoor, instead of the domain.