WireGuard-Go Docker Client for Synology NAS

Deutsch

WireGuard client as a Docker container using wireguard-go (userspace implementation). Requires no WireGuard kernel module — ideal for Synology NAS systems (DSM 7.x) whose kernel does not support WireGuard.

Tested on: Synology DS218+ (Intel Celeron J3355, DSM 7.3)

Why wireguard-go?

Synology DSM uses an older Linux kernel that does not include a WireGuard kernel module. Classic WireGuard containers (e.g. linuxserver/wireguard) fail because of this. This container uses wireguard-go, the official userspace implementation of WireGuard, which works without a kernel module.

	Kernel WireGuard	wireguard-go (this container)
Kernel module required	Yes	No
CAP_NET_ADMIN required	Yes	Yes
SYS_MODULE required	Yes	No
Performance	~1 Gbit/s+	~200-400 Mbit/s
Synology compatible	No (without SPK)	Yes

Prerequisites

• Synology NAS with DSM 7.x
• Container Manager installed (via Package Center)
• A WireGuard client configuration file (wireguard.conf) from your WireGuard server

Installation

1. Build the Docker image

The image must be built on a separate machine and then transferred to the Synology.

# Clone the repository
git clone https://github.com/CallMeTechie/docker-wireguard-go.git
cd docker-wireguard-go

# Build the image
docker build -t wireguard-go:latest .

# Export as .tar
docker save wireguard-go:latest -o wireguard-go.tar

Copy the file wireguard-go.tar (~8.5 MB) to your Synology (e.g. via SMB share or Synology Drive).

2. Import the image into Container Manager

1. Open Container Manager
2. Image > Add > Add from file
3. Select the wireguard-go.tar file
4. Wait for the import to complete

3. Create folder structure

Create the following folders in File Station:

docker > wireguard-go > config

Resulting structure:

/volume1/docker/wireguard-go/
├── docker-compose.yml
└── config/
    └── wireguard.conf      <-- Your WireGuard client configuration

4. Add WireGuard configuration

Copy your client configuration file via File Station to docker/wireguard-go/config/wireguard.conf.

Example of a typical client configuration:

[Interface]
PrivateKey = <YOUR_PRIVATE_KEY>
Address = 10.8.0.3/32
DNS = 1.1.1.1,8.8.8.8

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
PresharedKey = <OPTIONAL_PRESHARED_KEY>
Endpoint = <SERVER_IP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

The startup script processes wg-quick directives (Address, DNS, etc.) automatically. The file can be used directly as generated by common WireGuard managers (GateControl, wg-easy, Pi-VPN, etc.).

5. Create docker-compose.yml

Create the file docker/wireguard-go/docker-compose.yml via File Station with the following content:

version: '3.9'
services:
  wireguard:
    image: wireguard-go:latest
    container_name: wireguard-client
    cap_add:
      - NET_ADMIN
    volumes:
      - ./config:/config
    network_mode: host
    restart: always

6. Create and start the project

1. Open Container Manager
2. Project > Create
3. Project name: wireguard-go
4. Path: /volume1/docker/wireguard-go
5. Select Use existing docker-compose.yml
6. Click Next > Create

The container starts automatically.

7. Verify the connection

In Container Manager under Container > wireguard-client > Terminal:

wg show

Expected output:

interface: wg0
  public key: <PUBLIC_KEY>
  private key: (hidden)
  listening port: <PORT>

peer: <SERVER_PUBLIC_KEY>
  endpoint: <SERVER_IP>:51820
  allowed ips: 10.8.0.0/24
  latest handshake: X seconds ago
  transfer: X.XX KiB received, X.XX KiB sent
  persistent keepalive: every 25 seconds

To test the connection in the terminal:

ping -c 3 10.8.0.1

Configuration

Environment variables

Variable	Default	Description
IP_WG_ENV	(from config)	VPN IP address, automatically read from Address in wireguard.conf. Only needed if no Address field is present in the config.

Volumes

Container path	Description
/config	Configuration directory. Must contain wireguard.conf.

Optional files in /config

File	Description
wireguard.conf	(Required) WireGuard client configuration
iptables.sh	(Optional) Custom iptables rules executed at startup

Network mode

The container runs with network_mode: host. This means:

• The wg0 interface is created directly on the NAS
• All services on the NAS are accessible through the tunnel
• No separate port mapping required

AllowedIPs and routing

The startup script handles AllowedIPs intelligently:

• AllowedIPs = 0.0.0.0/0: Instead of redirecting all traffic (which would break NAS networking), only a route for the VPN subnet (e.g. 10.8.0.0/24) is created.
• AllowedIPs = 10.8.0.0/24: Route is applied directly as specified.
• Multiple entries: Each entry is added as a separate route.

Troubleshooting

Container does not start

Check the logs in Container Manager under Container > wireguard-client > Log.

Error message	Cause	Solution
wireguard.conf file is missing	No config file found	Copy wireguard.conf to the config/ folder
wireguard-go binary not found	Image problem	Rebuild and reimport the image
wireguard-go failed to initialize	TUN device cannot be created	Container needs CAP_NET_ADMIN (check docker-compose.yml)

Tunnel is up but no traffic

In Container Manager under Container > wireguard-client > Terminal:

ip route | grep 10.8

Expected output: 10.8.0.0/24 dev wg0 scope link

If the route is missing, check that AllowedIPs is set correctly in wireguard.conf.

Handshake present but ping fails

In Container Manager under Container > wireguard-client > Terminal:

wg show wg0
ip addr show wg0

Make sure that:

• The Address in the config matches the peer configuration on the server
• The server has the peer configured with the correct AllowedIPs

Updating the container

1. Import new image in Container Manager: Image > Add > Add from file
2. Stop the project: Project > wireguard-go > Stop
3. Recreate the project: Project > wireguard-go > Create (to use the new image)

Performance

Tested with iperf3 (original benchmark from upstream project):

Connection	Speed
Direct (no VPN)	9.42 Gbit/s
Boringtun v0.6.0	1.51 Gbit/s
wireguard-go	2.92 Gbit/s

For typical NAS use cases (file access, reverse proxy) the performance is more than sufficient.

Technical details

• Base image: Alpine Linux (latest)
• WireGuard implementation: wireguard-go (official userspace implementation)
• Included tools: wg, wg-quick, iproute2, iptables
• Image size: ~8.5 MB (compressed)
• Multi-stage build: Go compiler only in build step, not in final image
• Capabilities: Only NET_ADMIN required (no SYS_MODULE, no --privileged)

License

See LICENSE.

Credits

Originally based on matthewchng/docker-wireguard-go. Extended with automatic processing of wg-quick configurations and intelligent routing.