Pritunl Docker Container

Docker tags:

• Recent changes, see: GitHub CHANGELOG.md
• Report any bugs, issues or feature requests on GitHub

Description

Pritunl container built on Alpine Linux. Supports IPv6 and running behind a reverse proxy. This container requires an external Mongo DB and should be run via Docker Compose or other orchestration.

Usage

This container exposes the following five ports:

• 80/tcp pritunl web server http port (standalone mode)
• 443/tcp pritunl web server https port (standalone and wireguard reverse-proxy mode)
• 1194/tcp pritunl VPN service port
• 1194/tcp pritunl OpenVPN service port
• 1195/udp pritunl wireguard service port - No default in app, this is a suggestion only.
• 9700/tcp pritunl web server http port (non-wireguard reverse-proxy mode)

Wireguard

The Docker host is required to have wireguard kernel modules installed and loaded.

Wireguard also requires that the pritunl web service exists internally on port 443 with SSL enabled (self-signed or LetsEncrypt cert). Without this clients will fail to connect or connection will time out after 15s in wireguard mode. This presents problems with existing reverse-proxy support using port 9700 and no SSL.

Wireguard + Traefik 1.X reverse-proxy + pritunl SSL self-signed cert:

• Set InsecureSkipVerify = true in Traefik 1.X traefik.toml config file (configure Traefik to accept invalid/self-signed certs)
• Set container ENV variable REVERSE_PROXY=true (configure pritunl for reverse-proxy/load-balance mode)
• Set container ENV variable WIREGUARD=true (configure pritunl to run web interface on port 443 with SSL)

Further pritunl wireguard information available at:

• https://docs.pritunl.com/docs/wireguard
• https://docs.pritunl.com/docs/wireguard-client

OpenVPN server fails to start, insmod error

ip6tables v1.8.3 (legacy): can't initialize ip6tables table 'filter': Table does not exist (do you need to insmod?) is repeatedly logged in the Docker container log along with python errors.

Load the ip6tables_filter kernel module on your Docker host and restart the container:

user@host:~$ sudo modprobe ip6table_filter
user@host:~$ sudo docker restart pritunl

This may need to be performed after kernel upgrades and reboots on the Docker host.

• https://ilhicas.com/2018/04/08/Fixing-do-you-need-insmod.html

Basic docker-compose.yml to launch a Mongo DB container instance, pritunl in standalone mode, and make the web and VPN ports accessible

version: '3'

services:
  mongo:
    image: mongo:latest
    container_name: pritunldb
    hostname: pritunldb
    network_mode: bridge
    volumes:
      - ./db:/data/db

  pritunl:
    image: goofball222/pritunl:latest
    container_name: pritunl
    hostname: pritunl
    depends_on:
        - mongo
    network_mode: bridge
    privileged: true
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
    links:
      - mongo
    volumes:
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 80:80
      - 443:443
      - 1194:1194
      - 1194:1194/udp
      - 1195:1195/udp
    environment:
      - TZ=UTC

Other/extended docker-compose.yml examples see: https://github.com/goofball222/pritunl/tree/main/examples

Environment variables: