[BUG] docker host cannot ping client

[icsy7867]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I am losing my mind a little bit. Wireguard server seems to be running great. Clients can connect to it, I can even SSH into the clients from within the docker container after adding openssh.

However, I need to be able to ping and SSH to the clients from the docker host server. However, these seem to go into a black hole of some sort. This is in RHEL9, but i dont see any sort of selinux stuff blocking anything.

The current client has IP Address: 192.168.100.13

docker -exec it wireguard bash
I can ping the wireguard client and SSH into it.

But from the docker host, a simple:
ping 192.168.100.13

Goes into a black hole. I just sits there an returns nothing.

Currently getting the docker IP address of the container:
docker inspect wireguard

and then adding a route on the host server:
ip route add 192.168.100.0/24 via 10.88.0.6

But same thing, ping 192.168.100.13 just seems to hang indefinitely.

Expected Behavior

I should be able to ping a wg client from localhost of my server running the wg container.

Steps To Reproduce

Run wg server
have a client connect.
try to ping the IP address from the host.

Environment

- OS: RHEL9
- How docker service was installed: Podman

CPU architecture

x86-64

Docker creation

Here is my run.sh script for redeploying.... Any help would be appreciated as I am losing my mind....

podman rm -f wireguard

#!/bin/bash
docker run -d \
  --name=wireguard \
  --cap-add=NET_ADMIN \
  --cap-add=SYS_MODULE \
  --cap-add=NET_RAW \
  --privileged \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=Etc/UTC \
  -e SERVERURL=my.server.com `#optional` \
  -e SERVERPORT=51820 `#optional` \
  -e PEERS=15 `#optional` \
  -e PEERDNS='8.8.8.8' `#optional` \
  -e INTERNAL_SUBNET=192.168.100.0 `#optional` \
  -e ALLOWEDIPS=192.168.100.0/24 `#optional` \
  -e PERSISTENTKEEPALIVE_PEERS= `#optional` \
  -e LOG_CONFS=true `#optional` \
  -p 51820:51820/udp \
  -v /lib/modules:/lib/modules `#optional` \
  --sysctl="net.ipv4.conf.all.src_valid_mark=1" \
  --restart unless-stopped \
  linuxserver/wireguard

podman cp $(pwd)/server-init.sh wireguard:/server-init.sh
podman exec -it wireguard sh /server-init.sh

ip route del 192.168.100.0/24
sleep 1
IPADDR=$(podman inspect wireguard | grep "IPAddress" | head -n 1 | awk -F': ' '{print $2}' | cut -d '"' -f2)
ip route add 192.168.100.0/24 via ${IPADDR} dev podman1
ip route add 10.168.100.0/24 via ${IPADDR} dev podman0

### Container logs

```bash
Container itself seems OK...


CoreDNS-1.10.0
linux/amd64, go1.19.9,
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 192.168.100.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 192.168.100.9/32 dev wg0
[#] ip -4 route add 192.168.100.8/32 dev wg0
[#] ip -4 route add 192.168.100.7/32 dev wg0
[#] ip -4 route add 192.168.100.6/32 dev wg0
[#] ip -4 route add 192.168.100.5/32 dev wg0
[#] ip -4 route add 192.168.100.4/32 dev wg0
[#] ip -4 route add 192.168.100.3/32 dev wg0
[#] ip -4 route add 192.168.100.2/32 dev wg0
[#] ip -4 route add 192.168.100.16/32 dev wg0
[#] ip -4 route add 192.168.100.15/32 dev wg0
[#] ip -4 route add 192.168.100.14/32 dev wg0
[#] ip -4 route add 192.168.100.13/32 dev wg0
[#] ip -4 route add 192.168.100.12/32 dev wg0
[#] ip -4 route add 192.168.100.11/32 dev wg0
[#] ip -4 route add 192.168.100.10/32 dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
[ls.io-init] done.

[aptalca]

Not a bug, and not something we directly provide support for. Also, the info provided is extremely confusing, random IPs and shell scripts referenced. . .

Here are some articles that talk about what you're trying to accomplish:
https://www.linuxserver.io/blog/routing-docker-host-and-container-traffic-through-wireguard
https://www.linuxserver.io/blog/advanced-wireguard-container-routing