Hi all, I’m very very new to unraid and most things NAS/ docker. 
 

I have been playing around with unraid for nearly a month, managed most things or if not a google has helped. This one I’m really struggling with….

 

I want to run SabNZB and Qbit torrent via a vpn. K e watched several videos and I’ve downloaded several apps….. binhex qbit, Binhex Sab, 2 WireGuard and also tried the inbuilt von manager. 
 

 Now comes the strange bit…… I have searched all over my machine, deleted docker containers and old left over files, yet I still seem to be behind some Kind of VPN, when I go into the terminal of my docker apps, (either host or bridge) I Always get a different ip to the WAN of my home. All similar but slightly different. I CANNOT find any other .conf file on my system. Is there anything I can do to correct this or do I have to start again? 
 

When running curl ipconfig from the terminal I’m getting an ip that when I look it ip is Amsterdam and I did put a wg0.conf from Amsterdam on so I think it’s still lurking somewhere. 
 

I have just upgraded to Version 7 too. 
 

any ideas or advice welcome. 
 

thanks. 
 

 

 

unraid v7 has some stuff with tailscale...

 

if you did anything with wiregurad its is saved on teh flash drive delete teh contents and the folder located at 

/boot/config/wireguard

then reboot to clear unriads wireguards stuff.

Thanks for the reply @bmartino1 I have already cleared that folder and rebooted and stil

having the same issue. I do have an ASUS router with inbuilt VNP, I have also made sure it isn’t routed through that. 

this sounds like you have CGNAT and/or a dynamic IP. if the Wan of your home keeps canning. Make a dynamic dns name for use with outside of your home. I use https://freedns.afraid.org/

 

 

and use a subdomain with a dns record to the IP. then run a script weekly/daily to update that IP address. If your CGNAT you will not be able to port forward as you don't have a forward facing Public IP.

 

Regarding the docker settings, host replaced unraids ports and uses unraids IP address. so unraid is set to 192.168.1.254 and you set the docker to host its ip is also 192.168.1.254

you would want to set things like database to this for ease of access and configurations. Or specal server service like ssh/sftp/calmscan ... when things that run a service for your system...

 

When setting the docker to bridge mode, it gets a dynamic ip from the bridge network. Usually a 172.x.x.x and to access it you go to unraids IP 192.168.1.254 however this doesn't replace unraids default ports from running in bridge mode.

 

when running in custom you use ipvlan/macvlan depending on you unriad docker settings. you assign a static ip if left balnk it will dhcp ask teh router per the macvlan subnet pool data assigned. It is better to set a static custum ip. so a docker set to custom will get a 192.168.1.x and its ports are accessible via 192.168.1.x

 

Review:

 

 

as this sounds more like a networking issue not a config setting... As you have already destroyed the WireGuard keys and settings. Thus after a reboot of deleting that folder WireGuard should be back to original default configuration...

 

given your issues I would recommend you look into tailscale which uses wiregurad underneath... and use the custom docker network for those dockers.

 

As always review the DOCs!

https://tailscale.com/kb/1464/funnel-vs-sharing

https://docs.unraid.net/unraid-os/release-notes/7.0.0/#tailscale-integration

https://docs.unraid.net/unraid-os/manual/security/tailscale/

Thanks again for your reply @bmartino1. I don’t believe that I have a CGNAT issue, I am running a dynamic dns via my router. I have WireGuard turned on and a config on my phone so if I want to access anything inside I’m the house I just WireGuard in. Im running on a BT FTTP service so I doubt it’s a static ip and I believe CGNAT is mostly mobile connections?! 
 

I am also relatively new to docker but I’m getting the hang of it slowly. When I run a ip test on my home BB it comes up as One IP address and when running via curl ipconfig.io via the terminal screen the ip is always similar but never identical. I only have about 6 apps I’m currently running but I can do it twice in 10 minutes and get a different but similar result (same docker ip changes)…… again it differs from my home IP address. I have a busy day at work tomorrow but I will try running some tests and post the ip addresses here (apart from home ip but I will give a rough idea of what the home Is compared to ip via the docker terminal. 
 

also a FYI as I’ve not seen this before,  I have a uk WireGuard VPN that I run my shield, and two smart tvs on, using a Surfshark WG conf, when I was doing this the other day, I connected 1 tv, checked IP address and it come back in uk, the 2nd tv said it was in Germany….. I turned off the function of the 2nd tv being routed via the vpn (on my router) and turned the function back on….. and it said Sweden….. however this is the EXACT same WireGuard conf file that the other tv runs through but two different countries. I found that strange. Both the exact same tv delivered on the same day. Both connected by a Ethernet cable with static IP on TV and MAC/IP bound in the router. Very very different. 

@bmartino1 Continuing from last night, here are the random addresses i get. Possibly a incorrect setting somewhere but as Im still in my first month trial, im still drowining in deep waters.

 

Current Home IP: 8X.1XX.183.15

Docker containers

Binhex-Sab (Bridge)

Test 1: 212.127.1.69
Test 2: 212.127.1.106
Test 3: 212.127.0.95

IPTV Boss (Host)

Test 1: 212.127.0.68 
Test 2: 212.127.0.81
Test 3: 212.127.0.91

Jellyfin (Host)

Test 1: 212.127.0.117
Test 2: 212.217.1.107
Test 3: 212.217.1.109

Next PVR (Host)

Test 1: 212.217.0.125
Test 2: 212.217.1.75
Test 3: 212.217.0.98

Sonarr (host)

Command not found

Speedtest Tracker (br0)

Test 1: 212.217.1.67
Test 2: 212.217.0.118
Test 3: 212.217.0.77

All commands ran are "curl ipconfig.io" 

 

that looks correct if the dockers are behind a vpn. as they are geo hopping and public enpoint hopping.

this may not be correct if your vpn device added is the ip scheme and net of 212.127.x.x which means the vpn network you crated may need some network settings adjusted.

 

to check that you would need to connect to your wiregurad vpn and check its endpoint public ip.

 

with bin hex dockers, they have their own vpn WireGuard config built in (some docker at least)

Also Not sure on:

curl ipconfig.io

could alos be false capturing your public ip or the VPN IP...

 

?try another one:

curl ifconfig.me
#Alternatively, you can use other public IP-checking services:
curl icanhazip.com
curl api.ipify.org

These commands will return your container's public IP address by querying a public service.

Note: The Docker container's IP address is typically private and local to the host network, so to see the actual public IP, the container needs to access an external service like the ones above.

 

in the docker what is the output of 

ip a

 

to check that you would need to connect to your wiregurad vpn and check its endpoint public ip. 
 

that’s what I can’t do as I can’t find my WG file 🤦🏻‍♂️🤣

running curl ifconfig.me is giving me my home physical ip. 
 

im not sure what to do now, being new to the OS I’ve installed several different apps to run a VPN through and I can’t see any WireGuard files anywhere. I put on a binhex qbit and wanted that and Next PVR only run through a vpn, but everything else not to be. Watched a YouTube video about how to run Next PVR through binhex Qbit to reuse the vpn didn’t work. 
 

I’ve got 4 days off now and today is the last day of my trial, might wipe the drives and start again. Save what config files I can from my apps and start again. 

 

Or….. am I beinh stupid and there is nothing wrong with my setup and that the curl ipconfig.io isn’t working correct or I’m using the wrong command? 

Edited January 15, 20251 yr by Houghton19

not sure. a fresh start on latest stable v7 would solve... But definitely be recommended. it could be both. I'm not sure where else to direct you in terms of configurations.

 

if your router supports vpn a WireGuard config may be setup there. you may need to stop point forwarding.

 

Usually with WireGuard. You have the endpoint your using and your local client.

 

Quote

that’s what I can’t do as I can’t find my WG file

? Then what endpoint are you connecting too. As the ifconfig.me may be pulling the ISP switch CGNAT public IP. I'm not familiar with use ifconfig.me to grab the public ip i've used other means and tools.

 

At this stage if you can start fresh, do so. But realize that even if you do, you may encounter this same strange issue where I think you miss understanding your own LAN network vs the WireGuard connection ip and your pulbic ip from ISP...

 

whats unraids IP address?

Terminal ip a

 

otherwise, if it was a docker stopping the docker would close the connection...

 

This is also why i'd ask you to docker console and run ip a to grab the docker ip to compare to the curl command....

 

for binhex docker you may need to ask on the docker support page.

@bmartino1 How do I run Terminal ip a? I tried typing that in the docker terminal and it gave me a error. my LAN network is different again and my Unraid IP is 192.168.10.22

 

figured out that was a command for the actual docker, not the containers (sorry treat me like a 5 year old) 

 

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
3: eth0: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc fq master bond0 state UP group default qlen 1000
    link/ether 34:7d:e4:4c:f0:78 brd ff:ff:ff:ff:ff:ff
4: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP group default qlen 1000
    link/ether 34:7d:e4:4c:f0:78 brd ff:ff:ff:ff:ff:ff
5: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 34:7d:e4:4c:f0:78 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.22/24 metric 1 scope global br0
       valid_lft forever preferred_lft forever
6: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:27:6f:09:58 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
7: br-9b71f7acaaa8: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1420 qdisc noqueue state DOWN group default 
    link/ether 02:42:25:bc:39:88 brd ff:ff:ff:ff:ff:ff
    inet 172.31.200.1/24 brd 172.31.200.255 scope global br-9b71f7acaaa8
       valid_lft forever preferred_lft forever
    inet6 fe80::42:25ff:febc:3988/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
9: veth84d400b@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether e6:9f:df:12:eb:43 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::e49f:dfff:fe12:eb43/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
10: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:3a:f3:72 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
12: veth710c2bb@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether 9e:f3:08:16:ac:94 brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::9cf3:8ff:fe16:ac94/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever

Edited January 16, 20251 yr by Houghton19

OK, so ive had a bit more of a look this morning, I have installed a WG client again, placed a WG file into the folder.  Before starting WG i have run Ifconfig.me and i got my home WAN address, then started WG and ran the curl ifconfig.me and got the same IP that i am getting from the wireguard docker after pushing NextPVR through the WG container with extra parameter of --net=container:Wireguard-Client.  This now wont let me log into the program via my web browser but im guessing thats because the vpn has no open ports. I think im going to put off a fresh reinstall at the moment (just if i was to now would be the best time due to days off) but i cant find any WG.conf file remaining on system (other than the new one i just installed this morning). using the ifconfig.me on my other docker containers reviels my home WAN ip so guess the other command is something different. 

 

https://unraid.net/blog/wireguard-on-unraid?srsltid=AfmBOoq9RCWuoJ3fZx1X38Ow8NgToZyJRzEG8i7dQ0lOQotNXrnLxIsH

 

 

 

 

id recommend you use tailscale. Start over... post diag or post part of you current vpn mager settings... yo dont' have wiegurd configured coretly and that not how that docekr network cand works the way you think it does....

 

upgrade and use unraid v7...

 

enable 

I need you network layout:

ISP > Router > switch > unraid

and what type of wireguard VPN your tying to setup...

?site to site?
server host?
etc...

 

read the docs:

https://docs.unraid.net/unraid-os/manual/security/vpn/

 

Thanks for all your efforts @bmartino1. I think I have semi sorted this....... it seems that the curl command on the containers is just sending it somewhere else, using you curl ifconfig.me works a treat and points it in the correct ip address. 

 

I already have a wireguard running on my router, this is for all my internal devices, The wireguard is controlled by my ASUS router, I have a No-IP account setup for DDNS for if my WAN ip address changes so i do always have access to my internal devices, all I have to do is open the wireguard app, turn on that config and then i can connect to any of my devices in the house..... (only have two, my pc that is 192.168.10.64 and my Unraid NAS is 192.168.10.22.... I suppose 3 as i can also connect to the router).

 

 

I am only running a handfull of docker containers, all I want to do is have some VPN on my NAS that I can conseal a little bit of usage/ help stop blocks.....

 

I have SABNZB...... I dont feel I need a vpn as it has a "ssl" option so I should be safe with that...

QBit Torrent.... obvious reasons.....

NextPVR is a IPTV app that I use to record F1 content in 4k and then it saves to a folder I have on my NAS called Recordings, then I can view that from my jellyfin.

I have found that due to ISP blocks in the UK I have less issues behind a VPN. 

 

I have tried installing a wireguard app and also uploading the wg0.conf to the built in vpn under settings. these obviously then stop me being able to access the dockers WebUI as it blocks the inbound traffic. I have installed a wireguard docker container installed the wg0.conf and cound see in the docker terminal that its pointing to the vpn ip address, I then tried running the other dockers through this one via the drop down "container" option and also by adding it via the extra perameters option.

 

 

Edited January 18, 20251 yr by Houghton19