Re: WG on LXC

["Daniel Gröber" <dxld@darkboxed.org>]

Hi Peter,

On Fri, Mar 22, 2024 at 06:52:16PM +0000, Peter Lister wrote:
> I'm using wg on my home network, using a Linux router with OpenWRT and
> running services (e.g. IMAP) on LXC containers.
> 
> Having read how wg is intended to work within name spaces, I expected to
> easily create LXC containers with *only* a wg interface, 

This is a relatively new way of doing things, not every tool is going to
support it.

What exactly are you trying to accomplish by doing this? In my mind you can
simply have *one* wg tunnel on the LXC host machine and use routed veth
networking to connect the containers to this uplink, but I'm probably
missing something.

> It also seems odd that client hosts need each wg client to use per-server
> endpoint addresses when they are all hosted on one physical server's network
> interface.

I'm not sure I've understood your current setup. Could you make your
explaination a bit more concrete? Wg configs snippets from the Host and
container would be helpful.

> I'm sure it's possible to script a solution, but ideally I want to specify
> lxc.net.0.type as "wireguard", give it a key pair and that should be that,
> with all config living outside the container.

Sounds nice but you'll want to talk to the LXC project instead of WireGuard
if getting that supported is your goal.

--Daniel