amnezia-vpn/amneziawg-tools
1
0
Fork 0
mirror of https://github.com/amnezia-vpn/amneziawg-tools.git synced 2026-10-14 05:41:59 +00:00
Code Issues 37 Projects Packages Wiki Activity

[GH-ISSUE #42] Problems with simultaneous restarts inside docker container #16

New issue
Open
opened 2026-10-13 21:02:25 +00:00 by bsakaguchi · 1 comment
bsakaguchi commented 2026-10-13 21:02:25 +00:00
Owner
Copy link

Originally created by @nike38rus on GitHub (Mar 21, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-tools/issues/42

Hi there!

I'm using awg-tools inside docker containers. First startup is OK. But when container crashed and being restarted by docker there is error during startup routine of awg-quick up %INTERFACE% (due to healthcheck failure for example):

2026-03-21 04:38:24.252983+00:00[#] iptables-restore -n
2026-03-21 04:38:24.281251+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?).

Docker image: amneziavpn/amneziawg-go, latest tag.
Restart policy: On failure, maximum retry count = 5.
amneziawg-tools: v1.0.20210914
Container startup command:
awg-quick up %INTERFACE% && while true; do if /usr/bin/wget -qO- -T 5 https://ipinfo.io/ip &>/dev/null; then echo "Tunnel is alive"; else echo ">>> Tunnel is DOWN <<<"; exit 1; fi; sleep 5; done

Investigate vector:

  • First time container is restarted by startup command because of wget check was failed
  • Next times container is restarted because awg-quick up %INTERFACE% throwed non-zero exit code
  • 2nd and all the next restart errors are the same - after invoking iptables-restore -n
  • First startup iptables-restoire -n was invoked twice, next startups - three times during each awg-quick up %INTERFACE%
  • I've added PreUp commands to check if there's stale records left in iptables upon restarts - that's false, each startup is performing with clean iptables and PBR tables.
  • There no such problem if I just stop and run container again (and if it starts from the first run). I guess docker stores some kind of state of the container during restarts that makes awg-quick up %INTERFACE% invoke iptables-restore -n three times instead of two times.

Please help to fix.

%INTERFACE%.conf:

[Interface]
Address = redacted
PrivateKey = redacted
Jc = redacted
Jmin = redacted
Jmax = redacted
S1 = redacted
S2 = redacted
H1 = redacted
H2 = redacted
H3 = redacted
H4 = redacted

MTU = 1280

# for debugging
PreUp = iptables-save
PreUp = ip rule show
PreUp = ip route show table all

# to avoid race condidions when invoking iptables. not working, will delete
PostUp = sleep 5
# allow packets routing through container
PostUp = sysctl -qw net.ipv4.ip_forward=1
# Will be used below
PostUp = ip route show table all | grep "default dev %i" | awk '{print $5}' | head -n1 > /tmp/pbr_table
PostUp = ip route show default | awk '{print $3}' > /tmp/default_gw

# route traffic from private local subnet to amnezia tunnel
PostUp = ip rule add iif eth0 lookup $(cat /tmp/pbr_table)
# route traffic from amnezia tunnel to local private subnet
PostUp = ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table)

# SNAT all traffic routed into amnezia tunnel
PostUp = iptables -t nat -C POSTROUTING -o %i -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o %i -j MASQUERADE

# clean all the mess when stop the tunnel manually. Not invoked upon container restarts or stop, docker do it itself
PostDown = ip rule del iif eth0 lookup $(cat /tmp/pbr_table)
PostDown = ip route del 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table)
PostDown = iptables -t nat -D POSTROUTING -o %i -j MASQUERADE

[Peer]
PublicKey = redacted
PresharedKey = redacted
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = redacted
PersistentKeepalive = 25

startup log:

2026-03-21 04:37:49.406247+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 04:37:49.434586+00:00[#] ip link add de type amneziawg
2026-03-21 04:37:49.437501+00:00Error: Unknown device type.
2026-03-21 04:37:49.437749+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 04:37:49.437783+00:00[#] amneziawg-go de
2026-03-21 04:37:49.442874+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 04:37:49.442918+00:00│                                                              │
2026-03-21 04:37:49.442929+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 04:37:49.442945+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 04:37:49.442952+00:00│       information on installing the kernel module,           │
2026-03-21 04:37:49.442959+00:00│       please visit:                                          │
2026-03-21 04:37:49.442968+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 04:37:49.442975+00:00│                                                              │
2026-03-21 04:37:49.442981+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 04:37:49.459049+00:00[#] iptables-save
2026-03-21 04:37:49.463374+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:37:49 2026
2026-03-21 04:37:49.465216+00:00*nat
2026-03-21 04:37:49.465289+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 04:37:49.465308+00:00:INPUT ACCEPT [0:0]
2026-03-21 04:37:49.465338+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 04:37:49.465368+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 04:37:49.465383+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 04:37:49.465395+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 04:37:49.465407+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 04:37:49.465427+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 04:37:49.465454+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:41085
2026-03-21 04:37:49.465467+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:38170
2026-03-21 04:37:49.465479+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 41085 -j SNAT --to-source :53
2026-03-21 04:37:49.465496+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 38170 -j SNAT --to-source :53
2026-03-21 04:37:49.465509+00:00COMMIT
2026-03-21 04:37:49.465761+00:00# Completed on Sat Mar 21 04:37:49 2026
2026-03-21 04:37:49.466435+00:00[#] ip rule show
2026-03-21 04:37:49.469293+00:000:	from all lookup local
2026-03-21 04:37:49.469359+00:0032766:	from all lookup main
2026-03-21 04:37:49.469372+00:0032767:	from all lookup default
2026-03-21 04:37:49.469738+00:00[#] ip route show table all
2026-03-21 04:37:49.472084+00:00default via 192.168.10.1 dev eth0 
2026-03-21 04:37:49.472316+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 04:37:49.472345+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:37:49.472359+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:37:49.472370+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 04:37:49.472427+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 04:37:49.472445+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 04:37:49.472460+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 04:37:49.473807+00:00[#] awg setconf de /dev/fd/63
2026-03-21 04:37:49.478508+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 04:37:49.480198+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 04:37:49.489414+00:00[#] awg set de fwmark 51820
2026-03-21 04:37:49.490350+00:00[#] ip -6 rule add not fwmark 51820 table 51820
2026-03-21 04:37:49.491630+00:00[#] ip -6 rule add table main suppress_prefixlength 0
2026-03-21 04:37:49.492860+00:00[#] ip -6 route add ::/0 dev de table 51820
2026-03-21 04:37:49.496346+00:00[#] ip6tables-restore -n
2026-03-21 04:37:49.503020+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 04:37:49.504408+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 04:37:49.505815+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 04:37:49.509606+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 04:37:49.511172+00:00[#] iptables-restore -n
2026-03-21 04:37:49.514108+00:00[#] sleep 5
2026-03-21 04:37:54.517149+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 04:37:54.520880+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 04:37:54.547043+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw
2026-03-21 04:37:54.551061+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table)
2026-03-21 04:37:54.555279+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table)
2026-03-21 04:37:54.559947+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE
2026-03-21 04:37:59.631492+00:00>>> Tunnel is DOWN <<<
2026-03-21 04:38:00.611961+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 04:38:00.631060+00:00[#] ip link add de type amneziawg
2026-03-21 04:38:00.633864+00:00Error: Unknown device type.
2026-03-21 04:38:00.634166+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 04:38:00.634202+00:00[#] amneziawg-go de
2026-03-21 04:38:00.635619+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 04:38:00.635674+00:00│                                                              │
2026-03-21 04:38:00.635692+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 04:38:00.635698+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 04:38:00.635704+00:00│       information on installing the kernel module,           │
2026-03-21 04:38:00.635709+00:00│       please visit:                                          │
2026-03-21 04:38:00.635718+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 04:38:00.635723+00:00│                                                              │
2026-03-21 04:38:00.635729+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 04:38:00.637379+00:00[#] iptables-save
2026-03-21 04:38:00.638765+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:00 2026
2026-03-21 04:38:00.639264+00:00*nat
2026-03-21 04:38:00.639290+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 04:38:00.639298+00:00:INPUT ACCEPT [0:0]
2026-03-21 04:38:00.639315+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 04:38:00.639322+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 04:38:00.639328+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 04:38:00.639334+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 04:38:00.639339+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 04:38:00.639349+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 04:38:00.639354+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:35637
2026-03-21 04:38:00.639360+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:49670
2026-03-21 04:38:00.639365+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 35637 -j SNAT --to-source :53
2026-03-21 04:38:00.639374+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 49670 -j SNAT --to-source :53
2026-03-21 04:38:00.639379+00:00COMMIT
2026-03-21 04:38:00.639385+00:00# Completed on Sat Mar 21 04:38:00 2026
2026-03-21 04:38:00.639823+00:00[#] ip rule show
2026-03-21 04:38:00.641175+00:000:	from all lookup local
2026-03-21 04:38:00.641330+00:0032766:	from all lookup main
2026-03-21 04:38:00.641348+00:0032767:	from all lookup default
2026-03-21 04:38:00.641655+00:00[#] ip route show table all
2026-03-21 04:38:00.642736+00:00default via 192.168.10.1 dev eth0 
2026-03-21 04:38:00.642769+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:00.642781+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:00.642787+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:00.642793+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 04:38:00.642806+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 04:38:00.642812+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:00.642818+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 04:38:00.643273+00:00[#] awg setconf de /dev/fd/63
2026-03-21 04:38:00.645125+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 04:38:00.646397+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 04:38:00.653221+00:00[#] awg set de fwmark 51820
2026-03-21 04:38:00.653904+00:00[#] ip -6 rule add not fwmark 51820 table 51820
2026-03-21 04:38:00.654878+00:00[#] ip -6 rule add table main suppress_prefixlength 0
2026-03-21 04:38:00.656067+00:00[#] ip -6 route add ::/0 dev de table 51820
2026-03-21 04:38:00.659118+00:00[#] ip6tables-restore -n
2026-03-21 04:38:00.664199+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 04:38:00.665348+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 04:38:00.666309+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 04:38:00.668916+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 04:38:00.669935+00:00[#] iptables-restore -n
2026-03-21 04:38:00.672210+00:00[#] sleep 5
2026-03-21 04:38:05.674884+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 04:38:05.677916+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 04:38:05.689917+00:00[#] iptables-restore -n
2026-03-21 04:38:05.724552+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?).
2026-03-21 04:38:06.470449+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 04:38:06.494040+00:00[#] ip link add de type amneziawg
2026-03-21 04:38:06.497291+00:00Error: Unknown device type.
2026-03-21 04:38:06.497643+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 04:38:06.497761+00:00[#] amneziawg-go de
2026-03-21 04:38:06.499633+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 04:38:06.499736+00:00│                                                              │
2026-03-21 04:38:06.499785+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 04:38:06.499796+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 04:38:06.499805+00:00│       information on installing the kernel module,           │
2026-03-21 04:38:06.499815+00:00│       please visit:                                          │
2026-03-21 04:38:06.499830+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 04:38:06.499841+00:00│                                                              │
2026-03-21 04:38:06.499850+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 04:38:06.502165+00:00[#] iptables-save
2026-03-21 04:38:06.504605+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:06 2026
2026-03-21 04:38:06.505762+00:00*nat
2026-03-21 04:38:06.506005+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 04:38:06.506055+00:00:INPUT ACCEPT [0:0]
2026-03-21 04:38:06.506069+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 04:38:06.506081+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 04:38:06.506095+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 04:38:06.506106+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 04:38:06.506117+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 04:38:06.506140+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 04:38:06.506153+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:46551
2026-03-21 04:38:06.506164+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:56880
2026-03-21 04:38:06.506181+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 46551 -j SNAT --to-source :53
2026-03-21 04:38:06.506193+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 56880 -j SNAT --to-source :53
2026-03-21 04:38:06.506203+00:00COMMIT
2026-03-21 04:38:06.506214+00:00# Completed on Sat Mar 21 04:38:06 2026
2026-03-21 04:38:06.506870+00:00[#] ip rule show
2026-03-21 04:38:06.509552+00:000:	from all lookup local
2026-03-21 04:38:06.509631+00:0032766:	from all lookup main
2026-03-21 04:38:06.509648+00:0032767:	from all lookup default
2026-03-21 04:38:06.510369+00:00[#] ip route show table all
2026-03-21 04:38:06.512350+00:00default via 192.168.10.1 dev eth0 
2026-03-21 04:38:06.512377+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:06.512392+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:06.512398+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:06.512418+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 04:38:06.512425+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 04:38:06.512430+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:06.512442+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 04:38:06.513262+00:00[#] awg setconf de /dev/fd/63
2026-03-21 04:38:06.516219+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 04:38:06.517679+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 04:38:06.527894+00:00[#] awg set de fwmark 51820
2026-03-21 04:38:06.528929+00:00[#] ip -6 rule add not fwmark 51820 table 51820
2026-03-21 04:38:06.530179+00:00[#] ip -6 rule add table main suppress_prefixlength 0
2026-03-21 04:38:06.531202+00:00[#] ip -6 route add ::/0 dev de table 51820
2026-03-21 04:38:06.534266+00:00[#] ip6tables-restore -n
2026-03-21 04:38:06.539093+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 04:38:06.540201+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 04:38:06.541446+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 04:38:06.544833+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 04:38:06.546581+00:00[#] iptables-restore -n
2026-03-21 04:38:06.550698+00:00[#] sleep 5
2026-03-21 04:38:11.553846+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 04:38:11.557081+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 04:38:11.568828+00:00[#] iptables-restore -n
2026-03-21 04:38:11.593050+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?).
2026-03-21 04:38:12.545103+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 04:38:12.564814+00:00[#] ip link add de type amneziawg
2026-03-21 04:38:12.567636+00:00Error: Unknown device type.
2026-03-21 04:38:12.567921+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 04:38:12.567959+00:00[#] amneziawg-go de
2026-03-21 04:38:12.569483+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 04:38:12.569516+00:00│                                                              │
2026-03-21 04:38:12.569539+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 04:38:12.569546+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 04:38:12.569555+00:00│       information on installing the kernel module,           │
2026-03-21 04:38:12.569571+00:00│       please visit:                                          │
2026-03-21 04:38:12.569579+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 04:38:12.569587+00:00│                                                              │
2026-03-21 04:38:12.569594+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 04:38:12.571781+00:00[#] iptables-save
2026-03-21 04:38:12.573910+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:12 2026
2026-03-21 04:38:12.575689+00:00*nat
2026-03-21 04:38:12.575737+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 04:38:12.575767+00:00:INPUT ACCEPT [0:0]
2026-03-21 04:38:12.575777+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 04:38:12.575785+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 04:38:12.575793+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 04:38:12.575801+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 04:38:12.575815+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 04:38:12.575824+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 04:38:12.575832+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:40991
2026-03-21 04:38:12.575841+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:37861
2026-03-21 04:38:12.575854+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 40991 -j SNAT --to-source :53
2026-03-21 04:38:12.575862+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 37861 -j SNAT --to-source :53
2026-03-21 04:38:12.575870+00:00COMMIT
2026-03-21 04:38:12.575878+00:00# Completed on Sat Mar 21 04:38:12 2026
2026-03-21 04:38:12.577032+00:00[#] ip rule show
2026-03-21 04:38:12.578133+00:000:	from all lookup local
2026-03-21 04:38:12.578155+00:0032766:	from all lookup main
2026-03-21 04:38:12.578163+00:0032767:	from all lookup default
2026-03-21 04:38:12.578963+00:00[#] ip route show table all
2026-03-21 04:38:12.581807+00:00default via 192.168.10.1 dev eth0 
2026-03-21 04:38:12.581856+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:12.581867+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:12.581877+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:12.581906+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 04:38:12.581918+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 04:38:12.581945+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:12.581969+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 04:38:12.583560+00:00[#] awg setconf de /dev/fd/63
2026-03-21 04:38:12.587348+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 04:38:12.589519+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 04:38:12.599735+00:00[#] awg set de fwmark 51820
2026-03-21 04:38:12.600939+00:00[#] ip -6 rule add not fwmark 51820 table 51820
2026-03-21 04:38:12.602451+00:00[#] ip -6 rule add table main suppress_prefixlength 0
2026-03-21 04:38:12.604888+00:00[#] ip -6 route add ::/0 dev de table 51820
2026-03-21 04:38:12.609381+00:00[#] ip6tables-restore -n
2026-03-21 04:38:12.616783+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 04:38:12.620188+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 04:38:12.621739+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 04:38:12.624898+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 04:38:12.625939+00:00[#] iptables-restore -n
2026-03-21 04:38:12.628357+00:00[#] sleep 5
2026-03-21 04:38:17.631214+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 04:38:17.634199+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 04:38:17.645662+00:00[#] iptables-restore -n
2026-03-21 04:38:17.660878+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?).
2026-03-21 04:38:19.165864+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 04:38:19.186953+00:00[#] ip link add de type amneziawg
2026-03-21 04:38:19.190286+00:00Error: Unknown device type.
2026-03-21 04:38:19.190624+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 04:38:19.190653+00:00[#] amneziawg-go de
2026-03-21 04:38:19.192508+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 04:38:19.192576+00:00│                                                              │
2026-03-21 04:38:19.192586+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 04:38:19.192592+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 04:38:19.192599+00:00│       information on installing the kernel module,           │
2026-03-21 04:38:19.192614+00:00│       please visit:                                          │
2026-03-21 04:38:19.192620+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 04:38:19.192625+00:00│                                                              │
2026-03-21 04:38:19.192632+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 04:38:19.194568+00:00[#] iptables-save
2026-03-21 04:38:19.195950+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:19 2026
2026-03-21 04:38:19.196622+00:00*nat
2026-03-21 04:38:19.196703+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 04:38:19.196714+00:00:INPUT ACCEPT [0:0]
2026-03-21 04:38:19.196720+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 04:38:19.196726+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 04:38:19.196731+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 04:38:19.196737+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 04:38:19.196754+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 04:38:19.196760+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 04:38:19.196768+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:41191
2026-03-21 04:38:19.196774+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:35011
2026-03-21 04:38:19.196784+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 41191 -j SNAT --to-source :53
2026-03-21 04:38:19.196790+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 35011 -j SNAT --to-source :53
2026-03-21 04:38:19.196796+00:00COMMIT
2026-03-21 04:38:19.196806+00:00# Completed on Sat Mar 21 04:38:19 2026
2026-03-21 04:38:19.197228+00:00[#] ip rule show
2026-03-21 04:38:19.198633+00:000:	from all lookup local
2026-03-21 04:38:19.198671+00:0032766:	from all lookup main
2026-03-21 04:38:19.198695+00:0032767:	from all lookup default
2026-03-21 04:38:19.199012+00:00[#] ip route show table all
2026-03-21 04:38:19.200382+00:00default via 192.168.10.1 dev eth0 
2026-03-21 04:38:19.200496+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:19.200634+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:19.200719+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:19.200760+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 04:38:19.200809+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 04:38:19.200864+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:19.200922+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 04:38:19.201582+00:00[#] awg setconf de /dev/fd/63
2026-03-21 04:38:19.203863+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 04:38:19.205170+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 04:38:19.213722+00:00[#] awg set de fwmark 51820
2026-03-21 04:38:19.214413+00:00[#] ip -6 rule add not fwmark 51820 table 51820
2026-03-21 04:38:19.216238+00:00[#] ip -6 rule add table main suppress_prefixlength 0
2026-03-21 04:38:19.217778+00:00[#] ip -6 route add ::/0 dev de table 51820
2026-03-21 04:38:19.221017+00:00[#] ip6tables-restore -n
2026-03-21 04:38:19.225672+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 04:38:19.226889+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 04:38:19.228060+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 04:38:19.230754+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 04:38:19.231950+00:00[#] iptables-restore -n
2026-03-21 04:38:19.234198+00:00[#] sleep 5
2026-03-21 04:38:24.236730+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 04:38:24.239776+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 04:38:24.252983+00:00[#] iptables-restore -n
2026-03-21 04:38:24.281251+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?).
2026-03-21 04:38:26.499285+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 04:38:26.521804+00:00[#] ip link add de type amneziawg
2026-03-21 04:38:26.527248+00:00Error: Unknown device type.
2026-03-21 04:38:26.527807+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 04:38:26.527933+00:00[#] amneziawg-go de
2026-03-21 04:38:26.530643+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 04:38:26.530747+00:00│                                                              │
2026-03-21 04:38:26.530763+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 04:38:26.530772+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 04:38:26.530781+00:00│       information on installing the kernel module,           │
2026-03-21 04:38:26.530801+00:00│       please visit:                                          │
2026-03-21 04:38:26.530810+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 04:38:26.530818+00:00│                                                              │
2026-03-21 04:38:26.530834+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 04:38:26.534049+00:00[#] iptables-save
2026-03-21 04:38:26.537194+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:26 2026
2026-03-21 04:38:26.537857+00:00*nat
2026-03-21 04:38:26.537903+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 04:38:26.537914+00:00:INPUT ACCEPT [0:0]
2026-03-21 04:38:26.537922+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 04:38:26.537929+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 04:38:26.537936+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 04:38:26.537965+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 04:38:26.537972+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 04:38:26.537979+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 04:38:26.537986+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:39503
2026-03-21 04:38:26.538000+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:60722
2026-03-21 04:38:26.538007+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 39503 -j SNAT --to-source :53
2026-03-21 04:38:26.538014+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 60722 -j SNAT --to-source :53
2026-03-21 04:38:26.538026+00:00COMMIT
2026-03-21 04:38:26.538033+00:00# Completed on Sat Mar 21 04:38:26 2026
2026-03-21 04:38:26.538489+00:00[#] ip rule show
2026-03-21 04:38:26.540797+00:000:	from all lookup local
2026-03-21 04:38:26.540845+00:0032766:	from all lookup main
2026-03-21 04:38:26.540854+00:0032767:	from all lookup default
2026-03-21 04:38:26.541144+00:00[#] ip route show table all
2026-03-21 04:38:26.542850+00:00default via 192.168.10.1 dev eth0 
2026-03-21 04:38:26.542939+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:26.542952+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:26.542978+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 04:38:26.542985+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 04:38:26.542991+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 04:38:26.543001+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 04:38:26.543007+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 04:38:26.543528+00:00[#] awg setconf de /dev/fd/63
2026-03-21 04:38:26.545429+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 04:38:26.546837+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 04:38:26.558273+00:00[#] awg set de fwmark 51820
2026-03-21 04:38:26.559692+00:00[#] ip -6 rule add not fwmark 51820 table 51820
2026-03-21 04:38:26.561287+00:00[#] ip -6 rule add table main suppress_prefixlength 0
2026-03-21 04:38:26.563178+00:00[#] ip -6 route add ::/0 dev de table 51820
2026-03-21 04:38:26.567342+00:00[#] ip6tables-restore -n
2026-03-21 04:38:26.573925+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 04:38:26.575429+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 04:38:26.576675+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 04:38:26.579676+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 04:38:26.580960+00:00[#] iptables-restore -n
2026-03-21 04:38:26.583934+00:00[#] sleep 5
2026-03-21 04:38:31.585599+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 04:38:31.587543+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 04:38:31.599389+00:00[#] iptables-restore -n
2026-03-21 04:38:31.632294+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?).
Originally created by @nike38rus on GitHub (Mar 21, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-tools/issues/42 Hi there! I'm using awg-tools inside docker containers. First startup is OK. But when container crashed and being restarted by docker there is error during startup routine of `awg-quick up %INTERFACE%` (due to healthcheck failure for example): ``` 2026-03-21 04:38:24.252983+00:00[#] iptables-restore -n 2026-03-21 04:38:24.281251+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?). ``` Docker image: [amneziavpn/amneziawg-go](https://hub.docker.com/r/amneziavpn/amneziawg-go), latest tag. Restart policy: On failure, maximum retry count = 5. amneziawg-tools: v1.0.20210914 Container startup command: `awg-quick up %INTERFACE% && while true; do if /usr/bin/wget -qO- -T 5 https://ipinfo.io/ip &>/dev/null; then echo "Tunnel is alive"; else echo ">>> Tunnel is DOWN <<<"; exit 1; fi; sleep 5; done` Investigate vector: - First time container is restarted by startup command because of wget check was failed - Next times container is restarted because `awg-quick up %INTERFACE%` throwed non-zero exit code - 2nd and all the next restart errors are the same - after invoking `iptables-restore -n` - First startup `iptables-restoire -n` was invoked twice, next startups - three times during each `awg-quick up %INTERFACE%` - I've added PreUp commands to check if there's stale records left in iptables upon restarts - that's false, each startup is performing with clean iptables and PBR tables. - There no such problem if I just stop and run container again (and if it starts from the first run). I guess docker stores some kind of state of the container during restarts that makes `awg-quick up %INTERFACE%` invoke `iptables-restore -n` three times instead of two times. Please help to fix. %INTERFACE%.conf: ``` [Interface] Address = redacted PrivateKey = redacted Jc = redacted Jmin = redacted Jmax = redacted S1 = redacted S2 = redacted H1 = redacted H2 = redacted H3 = redacted H4 = redacted MTU = 1280 # for debugging PreUp = iptables-save PreUp = ip rule show PreUp = ip route show table all # to avoid race condidions when invoking iptables. not working, will delete PostUp = sleep 5 # allow packets routing through container PostUp = sysctl -qw net.ipv4.ip_forward=1 # Will be used below PostUp = ip route show table all | grep "default dev %i" | awk '{print $5}' | head -n1 > /tmp/pbr_table PostUp = ip route show default | awk '{print $3}' > /tmp/default_gw # route traffic from private local subnet to amnezia tunnel PostUp = ip rule add iif eth0 lookup $(cat /tmp/pbr_table) # route traffic from amnezia tunnel to local private subnet PostUp = ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table) # SNAT all traffic routed into amnezia tunnel PostUp = iptables -t nat -C POSTROUTING -o %i -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o %i -j MASQUERADE # clean all the mess when stop the tunnel manually. Not invoked upon container restarts or stop, docker do it itself PostDown = ip rule del iif eth0 lookup $(cat /tmp/pbr_table) PostDown = ip route del 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table) PostDown = iptables -t nat -D POSTROUTING -o %i -j MASQUERADE [Peer] PublicKey = redacted PresharedKey = redacted AllowedIPs = 0.0.0.0/0, ::/0 Endpoint = redacted PersistentKeepalive = 25 ``` startup log: ``` 2026-03-21 04:37:49.406247+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 04:37:49.434586+00:00[#] ip link add de type amneziawg 2026-03-21 04:37:49.437501+00:00Error: Unknown device type. 2026-03-21 04:37:49.437749+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 04:37:49.437783+00:00[#] amneziawg-go de 2026-03-21 04:37:49.442874+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 04:37:49.442918+00:00│ │ 2026-03-21 04:37:49.442929+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 04:37:49.442945+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 04:37:49.442952+00:00│ information on installing the kernel module, │ 2026-03-21 04:37:49.442959+00:00│ please visit: │ 2026-03-21 04:37:49.442968+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 04:37:49.442975+00:00│ │ 2026-03-21 04:37:49.442981+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 04:37:49.459049+00:00[#] iptables-save 2026-03-21 04:37:49.463374+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:37:49 2026 2026-03-21 04:37:49.465216+00:00*nat 2026-03-21 04:37:49.465289+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 04:37:49.465308+00:00:INPUT ACCEPT [0:0] 2026-03-21 04:37:49.465338+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 04:37:49.465368+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 04:37:49.465383+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 04:37:49.465395+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 04:37:49.465407+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 04:37:49.465427+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 04:37:49.465454+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:41085 2026-03-21 04:37:49.465467+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:38170 2026-03-21 04:37:49.465479+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 41085 -j SNAT --to-source :53 2026-03-21 04:37:49.465496+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 38170 -j SNAT --to-source :53 2026-03-21 04:37:49.465509+00:00COMMIT 2026-03-21 04:37:49.465761+00:00# Completed on Sat Mar 21 04:37:49 2026 2026-03-21 04:37:49.466435+00:00[#] ip rule show 2026-03-21 04:37:49.469293+00:000: from all lookup local 2026-03-21 04:37:49.469359+00:0032766: from all lookup main 2026-03-21 04:37:49.469372+00:0032767: from all lookup default 2026-03-21 04:37:49.469738+00:00[#] ip route show table all 2026-03-21 04:37:49.472084+00:00default via 192.168.10.1 dev eth0 2026-03-21 04:37:49.472316+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 04:37:49.472345+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:37:49.472359+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:37:49.472370+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 04:37:49.472427+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 04:37:49.472445+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 04:37:49.472460+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 04:37:49.473807+00:00[#] awg setconf de /dev/fd/63 2026-03-21 04:37:49.478508+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 04:37:49.480198+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 04:37:49.489414+00:00[#] awg set de fwmark 51820 2026-03-21 04:37:49.490350+00:00[#] ip -6 rule add not fwmark 51820 table 51820 2026-03-21 04:37:49.491630+00:00[#] ip -6 rule add table main suppress_prefixlength 0 2026-03-21 04:37:49.492860+00:00[#] ip -6 route add ::/0 dev de table 51820 2026-03-21 04:37:49.496346+00:00[#] ip6tables-restore -n 2026-03-21 04:37:49.503020+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 04:37:49.504408+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 04:37:49.505815+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 04:37:49.509606+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 04:37:49.511172+00:00[#] iptables-restore -n 2026-03-21 04:37:49.514108+00:00[#] sleep 5 2026-03-21 04:37:54.517149+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 04:37:54.520880+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 04:37:54.547043+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw 2026-03-21 04:37:54.551061+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table) 2026-03-21 04:37:54.555279+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table) 2026-03-21 04:37:54.559947+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE 2026-03-21 04:37:59.631492+00:00>>> Tunnel is DOWN <<< 2026-03-21 04:38:00.611961+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 04:38:00.631060+00:00[#] ip link add de type amneziawg 2026-03-21 04:38:00.633864+00:00Error: Unknown device type. 2026-03-21 04:38:00.634166+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 04:38:00.634202+00:00[#] amneziawg-go de 2026-03-21 04:38:00.635619+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 04:38:00.635674+00:00│ │ 2026-03-21 04:38:00.635692+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 04:38:00.635698+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 04:38:00.635704+00:00│ information on installing the kernel module, │ 2026-03-21 04:38:00.635709+00:00│ please visit: │ 2026-03-21 04:38:00.635718+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 04:38:00.635723+00:00│ │ 2026-03-21 04:38:00.635729+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 04:38:00.637379+00:00[#] iptables-save 2026-03-21 04:38:00.638765+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:00 2026 2026-03-21 04:38:00.639264+00:00*nat 2026-03-21 04:38:00.639290+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 04:38:00.639298+00:00:INPUT ACCEPT [0:0] 2026-03-21 04:38:00.639315+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 04:38:00.639322+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 04:38:00.639328+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 04:38:00.639334+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 04:38:00.639339+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 04:38:00.639349+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 04:38:00.639354+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:35637 2026-03-21 04:38:00.639360+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:49670 2026-03-21 04:38:00.639365+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 35637 -j SNAT --to-source :53 2026-03-21 04:38:00.639374+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 49670 -j SNAT --to-source :53 2026-03-21 04:38:00.639379+00:00COMMIT 2026-03-21 04:38:00.639385+00:00# Completed on Sat Mar 21 04:38:00 2026 2026-03-21 04:38:00.639823+00:00[#] ip rule show 2026-03-21 04:38:00.641175+00:000: from all lookup local 2026-03-21 04:38:00.641330+00:0032766: from all lookup main 2026-03-21 04:38:00.641348+00:0032767: from all lookup default 2026-03-21 04:38:00.641655+00:00[#] ip route show table all 2026-03-21 04:38:00.642736+00:00default via 192.168.10.1 dev eth0 2026-03-21 04:38:00.642769+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 04:38:00.642781+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:00.642787+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:00.642793+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 04:38:00.642806+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 04:38:00.642812+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 04:38:00.642818+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 04:38:00.643273+00:00[#] awg setconf de /dev/fd/63 2026-03-21 04:38:00.645125+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 04:38:00.646397+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 04:38:00.653221+00:00[#] awg set de fwmark 51820 2026-03-21 04:38:00.653904+00:00[#] ip -6 rule add not fwmark 51820 table 51820 2026-03-21 04:38:00.654878+00:00[#] ip -6 rule add table main suppress_prefixlength 0 2026-03-21 04:38:00.656067+00:00[#] ip -6 route add ::/0 dev de table 51820 2026-03-21 04:38:00.659118+00:00[#] ip6tables-restore -n 2026-03-21 04:38:00.664199+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 04:38:00.665348+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 04:38:00.666309+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 04:38:00.668916+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 04:38:00.669935+00:00[#] iptables-restore -n 2026-03-21 04:38:00.672210+00:00[#] sleep 5 2026-03-21 04:38:05.674884+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 04:38:05.677916+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 04:38:05.689917+00:00[#] iptables-restore -n 2026-03-21 04:38:05.724552+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?). 2026-03-21 04:38:06.470449+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 04:38:06.494040+00:00[#] ip link add de type amneziawg 2026-03-21 04:38:06.497291+00:00Error: Unknown device type. 2026-03-21 04:38:06.497643+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 04:38:06.497761+00:00[#] amneziawg-go de 2026-03-21 04:38:06.499633+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 04:38:06.499736+00:00│ │ 2026-03-21 04:38:06.499785+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 04:38:06.499796+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 04:38:06.499805+00:00│ information on installing the kernel module, │ 2026-03-21 04:38:06.499815+00:00│ please visit: │ 2026-03-21 04:38:06.499830+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 04:38:06.499841+00:00│ │ 2026-03-21 04:38:06.499850+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 04:38:06.502165+00:00[#] iptables-save 2026-03-21 04:38:06.504605+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:06 2026 2026-03-21 04:38:06.505762+00:00*nat 2026-03-21 04:38:06.506005+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 04:38:06.506055+00:00:INPUT ACCEPT [0:0] 2026-03-21 04:38:06.506069+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 04:38:06.506081+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 04:38:06.506095+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 04:38:06.506106+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 04:38:06.506117+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 04:38:06.506140+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 04:38:06.506153+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:46551 2026-03-21 04:38:06.506164+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:56880 2026-03-21 04:38:06.506181+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 46551 -j SNAT --to-source :53 2026-03-21 04:38:06.506193+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 56880 -j SNAT --to-source :53 2026-03-21 04:38:06.506203+00:00COMMIT 2026-03-21 04:38:06.506214+00:00# Completed on Sat Mar 21 04:38:06 2026 2026-03-21 04:38:06.506870+00:00[#] ip rule show 2026-03-21 04:38:06.509552+00:000: from all lookup local 2026-03-21 04:38:06.509631+00:0032766: from all lookup main 2026-03-21 04:38:06.509648+00:0032767: from all lookup default 2026-03-21 04:38:06.510369+00:00[#] ip route show table all 2026-03-21 04:38:06.512350+00:00default via 192.168.10.1 dev eth0 2026-03-21 04:38:06.512377+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 04:38:06.512392+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:06.512398+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:06.512418+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 04:38:06.512425+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 04:38:06.512430+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 04:38:06.512442+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 04:38:06.513262+00:00[#] awg setconf de /dev/fd/63 2026-03-21 04:38:06.516219+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 04:38:06.517679+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 04:38:06.527894+00:00[#] awg set de fwmark 51820 2026-03-21 04:38:06.528929+00:00[#] ip -6 rule add not fwmark 51820 table 51820 2026-03-21 04:38:06.530179+00:00[#] ip -6 rule add table main suppress_prefixlength 0 2026-03-21 04:38:06.531202+00:00[#] ip -6 route add ::/0 dev de table 51820 2026-03-21 04:38:06.534266+00:00[#] ip6tables-restore -n 2026-03-21 04:38:06.539093+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 04:38:06.540201+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 04:38:06.541446+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 04:38:06.544833+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 04:38:06.546581+00:00[#] iptables-restore -n 2026-03-21 04:38:06.550698+00:00[#] sleep 5 2026-03-21 04:38:11.553846+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 04:38:11.557081+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 04:38:11.568828+00:00[#] iptables-restore -n 2026-03-21 04:38:11.593050+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?). 2026-03-21 04:38:12.545103+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 04:38:12.564814+00:00[#] ip link add de type amneziawg 2026-03-21 04:38:12.567636+00:00Error: Unknown device type. 2026-03-21 04:38:12.567921+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 04:38:12.567959+00:00[#] amneziawg-go de 2026-03-21 04:38:12.569483+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 04:38:12.569516+00:00│ │ 2026-03-21 04:38:12.569539+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 04:38:12.569546+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 04:38:12.569555+00:00│ information on installing the kernel module, │ 2026-03-21 04:38:12.569571+00:00│ please visit: │ 2026-03-21 04:38:12.569579+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 04:38:12.569587+00:00│ │ 2026-03-21 04:38:12.569594+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 04:38:12.571781+00:00[#] iptables-save 2026-03-21 04:38:12.573910+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:12 2026 2026-03-21 04:38:12.575689+00:00*nat 2026-03-21 04:38:12.575737+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 04:38:12.575767+00:00:INPUT ACCEPT [0:0] 2026-03-21 04:38:12.575777+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 04:38:12.575785+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 04:38:12.575793+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 04:38:12.575801+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 04:38:12.575815+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 04:38:12.575824+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 04:38:12.575832+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:40991 2026-03-21 04:38:12.575841+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:37861 2026-03-21 04:38:12.575854+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 40991 -j SNAT --to-source :53 2026-03-21 04:38:12.575862+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 37861 -j SNAT --to-source :53 2026-03-21 04:38:12.575870+00:00COMMIT 2026-03-21 04:38:12.575878+00:00# Completed on Sat Mar 21 04:38:12 2026 2026-03-21 04:38:12.577032+00:00[#] ip rule show 2026-03-21 04:38:12.578133+00:000: from all lookup local 2026-03-21 04:38:12.578155+00:0032766: from all lookup main 2026-03-21 04:38:12.578163+00:0032767: from all lookup default 2026-03-21 04:38:12.578963+00:00[#] ip route show table all 2026-03-21 04:38:12.581807+00:00default via 192.168.10.1 dev eth0 2026-03-21 04:38:12.581856+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 04:38:12.581867+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:12.581877+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:12.581906+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 04:38:12.581918+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 04:38:12.581945+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 04:38:12.581969+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 04:38:12.583560+00:00[#] awg setconf de /dev/fd/63 2026-03-21 04:38:12.587348+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 04:38:12.589519+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 04:38:12.599735+00:00[#] awg set de fwmark 51820 2026-03-21 04:38:12.600939+00:00[#] ip -6 rule add not fwmark 51820 table 51820 2026-03-21 04:38:12.602451+00:00[#] ip -6 rule add table main suppress_prefixlength 0 2026-03-21 04:38:12.604888+00:00[#] ip -6 route add ::/0 dev de table 51820 2026-03-21 04:38:12.609381+00:00[#] ip6tables-restore -n 2026-03-21 04:38:12.616783+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 04:38:12.620188+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 04:38:12.621739+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 04:38:12.624898+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 04:38:12.625939+00:00[#] iptables-restore -n 2026-03-21 04:38:12.628357+00:00[#] sleep 5 2026-03-21 04:38:17.631214+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 04:38:17.634199+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 04:38:17.645662+00:00[#] iptables-restore -n 2026-03-21 04:38:17.660878+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?). 2026-03-21 04:38:19.165864+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 04:38:19.186953+00:00[#] ip link add de type amneziawg 2026-03-21 04:38:19.190286+00:00Error: Unknown device type. 2026-03-21 04:38:19.190624+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 04:38:19.190653+00:00[#] amneziawg-go de 2026-03-21 04:38:19.192508+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 04:38:19.192576+00:00│ │ 2026-03-21 04:38:19.192586+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 04:38:19.192592+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 04:38:19.192599+00:00│ information on installing the kernel module, │ 2026-03-21 04:38:19.192614+00:00│ please visit: │ 2026-03-21 04:38:19.192620+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 04:38:19.192625+00:00│ │ 2026-03-21 04:38:19.192632+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 04:38:19.194568+00:00[#] iptables-save 2026-03-21 04:38:19.195950+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:19 2026 2026-03-21 04:38:19.196622+00:00*nat 2026-03-21 04:38:19.196703+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 04:38:19.196714+00:00:INPUT ACCEPT [0:0] 2026-03-21 04:38:19.196720+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 04:38:19.196726+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 04:38:19.196731+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 04:38:19.196737+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 04:38:19.196754+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 04:38:19.196760+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 04:38:19.196768+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:41191 2026-03-21 04:38:19.196774+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:35011 2026-03-21 04:38:19.196784+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 41191 -j SNAT --to-source :53 2026-03-21 04:38:19.196790+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 35011 -j SNAT --to-source :53 2026-03-21 04:38:19.196796+00:00COMMIT 2026-03-21 04:38:19.196806+00:00# Completed on Sat Mar 21 04:38:19 2026 2026-03-21 04:38:19.197228+00:00[#] ip rule show 2026-03-21 04:38:19.198633+00:000: from all lookup local 2026-03-21 04:38:19.198671+00:0032766: from all lookup main 2026-03-21 04:38:19.198695+00:0032767: from all lookup default 2026-03-21 04:38:19.199012+00:00[#] ip route show table all 2026-03-21 04:38:19.200382+00:00default via 192.168.10.1 dev eth0 2026-03-21 04:38:19.200496+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 04:38:19.200634+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:19.200719+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:19.200760+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 04:38:19.200809+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 04:38:19.200864+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 04:38:19.200922+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 04:38:19.201582+00:00[#] awg setconf de /dev/fd/63 2026-03-21 04:38:19.203863+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 04:38:19.205170+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 04:38:19.213722+00:00[#] awg set de fwmark 51820 2026-03-21 04:38:19.214413+00:00[#] ip -6 rule add not fwmark 51820 table 51820 2026-03-21 04:38:19.216238+00:00[#] ip -6 rule add table main suppress_prefixlength 0 2026-03-21 04:38:19.217778+00:00[#] ip -6 route add ::/0 dev de table 51820 2026-03-21 04:38:19.221017+00:00[#] ip6tables-restore -n 2026-03-21 04:38:19.225672+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 04:38:19.226889+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 04:38:19.228060+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 04:38:19.230754+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 04:38:19.231950+00:00[#] iptables-restore -n 2026-03-21 04:38:19.234198+00:00[#] sleep 5 2026-03-21 04:38:24.236730+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 04:38:24.239776+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 04:38:24.252983+00:00[#] iptables-restore -n 2026-03-21 04:38:24.281251+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?). 2026-03-21 04:38:26.499285+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 04:38:26.521804+00:00[#] ip link add de type amneziawg 2026-03-21 04:38:26.527248+00:00Error: Unknown device type. 2026-03-21 04:38:26.527807+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 04:38:26.527933+00:00[#] amneziawg-go de 2026-03-21 04:38:26.530643+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 04:38:26.530747+00:00│ │ 2026-03-21 04:38:26.530763+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 04:38:26.530772+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 04:38:26.530781+00:00│ information on installing the kernel module, │ 2026-03-21 04:38:26.530801+00:00│ please visit: │ 2026-03-21 04:38:26.530810+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 04:38:26.530818+00:00│ │ 2026-03-21 04:38:26.530834+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 04:38:26.534049+00:00[#] iptables-save 2026-03-21 04:38:26.537194+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 04:38:26 2026 2026-03-21 04:38:26.537857+00:00*nat 2026-03-21 04:38:26.537903+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 04:38:26.537914+00:00:INPUT ACCEPT [0:0] 2026-03-21 04:38:26.537922+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 04:38:26.537929+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 04:38:26.537936+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 04:38:26.537965+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 04:38:26.537972+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 04:38:26.537979+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 04:38:26.537986+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:39503 2026-03-21 04:38:26.538000+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:60722 2026-03-21 04:38:26.538007+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 39503 -j SNAT --to-source :53 2026-03-21 04:38:26.538014+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 60722 -j SNAT --to-source :53 2026-03-21 04:38:26.538026+00:00COMMIT 2026-03-21 04:38:26.538033+00:00# Completed on Sat Mar 21 04:38:26 2026 2026-03-21 04:38:26.538489+00:00[#] ip rule show 2026-03-21 04:38:26.540797+00:000: from all lookup local 2026-03-21 04:38:26.540845+00:0032766: from all lookup main 2026-03-21 04:38:26.540854+00:0032767: from all lookup default 2026-03-21 04:38:26.541144+00:00[#] ip route show table all 2026-03-21 04:38:26.542850+00:00default via 192.168.10.1 dev eth0 2026-03-21 04:38:26.542939+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 04:38:26.542952+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:26.542978+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 04:38:26.542985+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 04:38:26.542991+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 04:38:26.543001+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 04:38:26.543007+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 04:38:26.543528+00:00[#] awg setconf de /dev/fd/63 2026-03-21 04:38:26.545429+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 04:38:26.546837+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 04:38:26.558273+00:00[#] awg set de fwmark 51820 2026-03-21 04:38:26.559692+00:00[#] ip -6 rule add not fwmark 51820 table 51820 2026-03-21 04:38:26.561287+00:00[#] ip -6 rule add table main suppress_prefixlength 0 2026-03-21 04:38:26.563178+00:00[#] ip -6 route add ::/0 dev de table 51820 2026-03-21 04:38:26.567342+00:00[#] ip6tables-restore -n 2026-03-21 04:38:26.573925+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 04:38:26.575429+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 04:38:26.576675+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 04:38:26.579676+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 04:38:26.580960+00:00[#] iptables-restore -n 2026-03-21 04:38:26.583934+00:00[#] sleep 5 2026-03-21 04:38:31.585599+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 04:38:31.587543+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 04:38:31.599389+00:00[#] iptables-restore -n 2026-03-21 04:38:31.632294+00:00iptables-restore: line 6 failed: Bad rule (does a matching rule exist in that chain?). ```
bsakaguchi commented 2026-10-13 21:02:26 +00:00
Author
Owner
Copy link

@nike38rus commented on GitHub (Mar 21, 2026):

Update:

I've removed IPv6 from AllowedIPs option and the problem dissapeared (AllowedIPs = 0.0.0.0/0). Now container is crasing only due wget check failures. I don't need IPv6 inside amnezia tunnel, so I guess I've fixed my problem. But the root cause of the problem is still somewhere there so I'll keep this issue open.
Startup log:

2026-03-21 05:49:03.838982+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 05:49:03.867685+00:00[#] ip link add de type amneziawg
2026-03-21 05:49:03.873452+00:00Error: Unknown device type.
2026-03-21 05:49:03.873882+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 05:49:03.873927+00:00[#] amneziawg-go de
2026-03-21 05:49:03.881468+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 05:49:03.881529+00:00│                                                              │
2026-03-21 05:49:03.881546+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 05:49:03.881575+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 05:49:03.881588+00:00│       information on installing the kernel module,           │
2026-03-21 05:49:03.881599+00:00│       please visit:                                          │
2026-03-21 05:49:03.881617+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 05:49:03.881628+00:00│                                                              │
2026-03-21 05:49:03.881639+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 05:49:03.893267+00:00[#] iptables-save
2026-03-21 05:49:03.895691+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:03 2026
2026-03-21 05:49:03.896786+00:00*nat
2026-03-21 05:49:03.896841+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 05:49:03.896856+00:00:INPUT ACCEPT [0:0]
2026-03-21 05:49:03.896883+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 05:49:03.896894+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 05:49:03.896904+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 05:49:03.896915+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 05:49:03.896925+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 05:49:03.896935+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 05:49:03.896950+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:43537
2026-03-21 05:49:03.896961+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:44485
2026-03-21 05:49:03.896971+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 43537 -j SNAT --to-source :53
2026-03-21 05:49:03.896986+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 44485 -j SNAT --to-source :53
2026-03-21 05:49:03.896997+00:00COMMIT
2026-03-21 05:49:03.897007+00:00# Completed on Sat Mar 21 05:49:03 2026
2026-03-21 05:49:03.897876+00:00[#] ip rule show
2026-03-21 05:49:03.902742+00:000:	from all lookup local
2026-03-21 05:49:03.902807+00:0032766:	from all lookup main
2026-03-21 05:49:03.902822+00:0032767:	from all lookup default
2026-03-21 05:49:03.903773+00:00[#] ip route show table all
2026-03-21 05:49:03.906400+00:00default via 192.168.10.1 dev eth0 
2026-03-21 05:49:03.906443+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:03.906478+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:03.906487+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:03.906493+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 05:49:03.906502+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 05:49:03.906508+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:03.906514+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 05:49:03.909718+00:00[#] awg setconf de /dev/fd/63
2026-03-21 05:49:03.914601+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 05:49:03.919989+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 05:49:03.938024+00:00[#] awg set de fwmark 51820
2026-03-21 05:49:03.939746+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 05:49:03.941312+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 05:49:03.942410+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 05:49:03.946425+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 05:49:03.948074+00:00[#] iptables-restore -n
2026-03-21 05:49:03.951946+00:00[#] sleep 5
2026-03-21 05:49:08.954657+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 05:49:08.956780+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 05:49:08.995835+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw
2026-03-21 05:49:09.000010+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table)
2026-03-21 05:49:09.003901+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table)
2026-03-21 05:49:09.008335+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE
2026-03-21 05:49:14.072960+00:00>>> Tunnel is DOWN <<<
2026-03-21 05:49:15.350580+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 05:49:15.371262+00:00[#] ip link add de type amneziawg
2026-03-21 05:49:15.374184+00:00Error: Unknown device type.
2026-03-21 05:49:15.374458+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 05:49:15.374495+00:00[#] amneziawg-go de
2026-03-21 05:49:15.376032+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 05:49:15.376078+00:00│                                                              │
2026-03-21 05:49:15.376097+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 05:49:15.376103+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 05:49:15.376109+00:00│       information on installing the kernel module,           │
2026-03-21 05:49:15.376115+00:00│       please visit:                                          │
2026-03-21 05:49:15.376125+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 05:49:15.376134+00:00│                                                              │
2026-03-21 05:49:15.376140+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 05:49:15.377963+00:00[#] iptables-save
2026-03-21 05:49:15.380023+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:15 2026
2026-03-21 05:49:15.381229+00:00*nat
2026-03-21 05:49:15.381261+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 05:49:15.381280+00:00:INPUT ACCEPT [0:0]
2026-03-21 05:49:15.381287+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 05:49:15.381292+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 05:49:15.381299+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 05:49:15.381305+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 05:49:15.381310+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 05:49:15.381321+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 05:49:15.381327+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:46607
2026-03-21 05:49:15.381333+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:42248
2026-03-21 05:49:15.381342+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 46607 -j SNAT --to-source :53
2026-03-21 05:49:15.381348+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 42248 -j SNAT --to-source :53
2026-03-21 05:49:15.381354+00:00COMMIT
2026-03-21 05:49:15.381359+00:00# Completed on Sat Mar 21 05:49:15 2026
2026-03-21 05:49:15.381822+00:00[#] ip rule show
2026-03-21 05:49:15.383565+00:000:	from all lookup local
2026-03-21 05:49:15.383596+00:0032766:	from all lookup main
2026-03-21 05:49:15.383603+00:0032767:	from all lookup default
2026-03-21 05:49:15.384407+00:00[#] ip route show table all
2026-03-21 05:49:15.385909+00:00default via 192.168.10.1 dev eth0 
2026-03-21 05:49:15.385935+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:15.385946+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:15.385979+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:15.386006+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 05:49:15.386014+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 05:49:15.386019+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:15.386051+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 05:49:15.386546+00:00[#] awg setconf de /dev/fd/63
2026-03-21 05:49:15.388498+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 05:49:15.389741+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 05:49:15.396828+00:00[#] awg set de fwmark 51820
2026-03-21 05:49:15.397545+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 05:49:15.398585+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 05:49:15.399716+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 05:49:15.402492+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 05:49:15.403610+00:00[#] iptables-restore -n
2026-03-21 05:49:15.406551+00:00[#] sleep 5
2026-03-21 05:49:20.409595+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 05:49:20.412288+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 05:49:20.416267+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw
2026-03-21 05:49:20.418779+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table)
2026-03-21 05:49:20.422258+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table)
2026-03-21 05:49:20.426451+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE
2026-03-21 05:49:25.490664+00:00>>> Tunnel is DOWN <<<
2026-03-21 05:49:26.393249+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 05:49:26.412941+00:00[#] ip link add de type amneziawg
2026-03-21 05:49:26.416021+00:00Error: Unknown device type.
2026-03-21 05:49:26.416273+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 05:49:26.416311+00:00[#] amneziawg-go de
2026-03-21 05:49:26.417737+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 05:49:26.417780+00:00│                                                              │
2026-03-21 05:49:26.417788+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 05:49:26.417794+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 05:49:26.417800+00:00│       information on installing the kernel module,           │
2026-03-21 05:49:26.417810+00:00│       please visit:                                          │
2026-03-21 05:49:26.417816+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 05:49:26.417822+00:00│                                                              │
2026-03-21 05:49:26.417827+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 05:49:26.420578+00:00[#] iptables-save
2026-03-21 05:49:26.422864+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:26 2026
2026-03-21 05:49:26.423618+00:00*nat
2026-03-21 05:49:26.423702+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 05:49:26.423719+00:00:INPUT ACCEPT [0:0]
2026-03-21 05:49:26.423736+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 05:49:26.423746+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 05:49:26.423757+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 05:49:26.423768+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 05:49:26.423790+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 05:49:26.423801+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 05:49:26.423812+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:46067
2026-03-21 05:49:26.423823+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:58748
2026-03-21 05:49:26.423839+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 46067 -j SNAT --to-source :53
2026-03-21 05:49:26.423850+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 58748 -j SNAT --to-source :53
2026-03-21 05:49:26.423860+00:00COMMIT
2026-03-21 05:49:26.423877+00:00# Completed on Sat Mar 21 05:49:26 2026
2026-03-21 05:49:26.424346+00:00[#] ip rule show
2026-03-21 05:49:26.426771+00:000:	from all lookup local
2026-03-21 05:49:26.426861+00:0032766:	from all lookup main
2026-03-21 05:49:26.426880+00:0032767:	from all lookup default
2026-03-21 05:49:26.427290+00:00[#] ip route show table all
2026-03-21 05:49:26.428616+00:00default via 192.168.10.1 dev eth0 
2026-03-21 05:49:26.428643+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:26.428654+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:26.428674+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:26.428691+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 05:49:26.428713+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 05:49:26.428722+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:26.428740+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 05:49:26.429842+00:00[#] awg setconf de /dev/fd/63
2026-03-21 05:49:26.433450+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 05:49:26.435397+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 05:49:26.451891+00:00[#] awg set de fwmark 51820
2026-03-21 05:49:26.452953+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 05:49:26.454826+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 05:49:26.456193+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 05:49:26.460393+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 05:49:26.463458+00:00[#] iptables-restore -n
2026-03-21 05:49:26.472419+00:00[#] sleep 5
2026-03-21 05:49:31.475126+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 05:49:31.477382+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 05:49:31.481106+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw
2026-03-21 05:49:31.484156+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table)
2026-03-21 05:49:31.488385+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table)
2026-03-21 05:49:31.493503+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE
2026-03-21 05:49:36.557887+00:00>>> Tunnel is DOWN <<<
2026-03-21 05:49:37.794731+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 05:49:37.815470+00:00[#] ip link add de type amneziawg
2026-03-21 05:49:37.818188+00:00Error: Unknown device type.
2026-03-21 05:49:37.818423+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 05:49:37.818445+00:00[#] amneziawg-go de
2026-03-21 05:49:37.820132+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 05:49:37.820183+00:00│                                                              │
2026-03-21 05:49:37.820192+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 05:49:37.820200+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 05:49:37.820215+00:00│       information on installing the kernel module,           │
2026-03-21 05:49:37.820221+00:00│       please visit:                                          │
2026-03-21 05:49:37.820228+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 05:49:37.820234+00:00│                                                              │
2026-03-21 05:49:37.820247+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 05:49:37.821986+00:00[#] iptables-save
2026-03-21 05:49:37.824067+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:37 2026
2026-03-21 05:49:37.825262+00:00*nat
2026-03-21 05:49:37.825311+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 05:49:37.825330+00:00:INPUT ACCEPT [0:0]
2026-03-21 05:49:37.825340+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 05:49:37.825350+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 05:49:37.825359+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 05:49:37.825389+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 05:49:37.825400+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 05:49:37.825409+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 05:49:37.825483+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:43165
2026-03-21 05:49:37.825506+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:60337
2026-03-21 05:49:37.825515+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 43165 -j SNAT --to-source :53
2026-03-21 05:49:37.825525+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 60337 -j SNAT --to-source :53
2026-03-21 05:49:37.825645+00:00COMMIT
2026-03-21 05:49:37.825660+00:00# Completed on Sat Mar 21 05:49:37 2026
2026-03-21 05:49:37.825680+00:00[#] ip rule show
2026-03-21 05:49:37.827686+00:000:	from all lookup local
2026-03-21 05:49:37.827734+00:0032766:	from all lookup main
2026-03-21 05:49:37.827761+00:0032767:	from all lookup default
2026-03-21 05:49:37.828170+00:00[#] ip route show table all
2026-03-21 05:49:37.829235+00:00default via 192.168.10.1 dev eth0 
2026-03-21 05:49:37.829255+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:37.829289+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:37.829319+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:37.829328+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 05:49:37.829335+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 05:49:37.829346+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:37.829355+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 05:49:37.829875+00:00[#] awg setconf de /dev/fd/63
2026-03-21 05:49:37.833124+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 05:49:37.835358+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 05:49:37.847937+00:00[#] awg set de fwmark 51820
2026-03-21 05:49:37.849228+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 05:49:37.850859+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 05:49:37.852543+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 05:49:37.858427+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 05:49:37.860668+00:00[#] iptables-restore -n
2026-03-21 05:49:37.866096+00:00[#] sleep 5
2026-03-21 05:49:42.869115+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 05:49:42.870147+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 05:49:42.873815+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw
2026-03-21 05:49:42.876888+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table)
2026-03-21 05:49:42.880670+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table)
2026-03-21 05:49:42.885268+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE
2026-03-21 05:49:47.950229+00:00>>> Tunnel is DOWN <<<
2026-03-21 05:49:49.729503+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 05:49:49.751490+00:00[#] ip link add de type amneziawg
2026-03-21 05:49:49.755089+00:00Error: Unknown device type.
2026-03-21 05:49:49.755429+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 05:49:49.755456+00:00[#] amneziawg-go de
2026-03-21 05:49:49.757199+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 05:49:49.757247+00:00│                                                              │
2026-03-21 05:49:49.757257+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 05:49:49.757272+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 05:49:49.757280+00:00│       information on installing the kernel module,           │
2026-03-21 05:49:49.757289+00:00│       please visit:                                          │
2026-03-21 05:49:49.757297+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 05:49:49.757314+00:00│                                                              │
2026-03-21 05:49:49.757322+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 05:49:49.759338+00:00[#] iptables-save
2026-03-21 05:49:49.761346+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:49 2026
2026-03-21 05:49:49.762117+00:00*nat
2026-03-21 05:49:49.762158+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 05:49:49.762169+00:00:INPUT ACCEPT [0:0]
2026-03-21 05:49:49.762178+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 05:49:49.762216+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 05:49:49.762226+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 05:49:49.762234+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 05:49:49.762244+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 05:49:49.762253+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 05:49:49.762269+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:41985
2026-03-21 05:49:49.762279+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:41519
2026-03-21 05:49:49.762288+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 41985 -j SNAT --to-source :53
2026-03-21 05:49:49.762303+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 41519 -j SNAT --to-source :53
2026-03-21 05:49:49.762312+00:00COMMIT
2026-03-21 05:49:49.762321+00:00# Completed on Sat Mar 21 05:49:49 2026
2026-03-21 05:49:49.762818+00:00[#] ip rule show
2026-03-21 05:49:49.764936+00:000:	from all lookup local
2026-03-21 05:49:49.765119+00:0032766:	from all lookup main
2026-03-21 05:49:49.765159+00:0032767:	from all lookup default
2026-03-21 05:49:49.765665+00:00[#] ip route show table all
2026-03-21 05:49:49.767345+00:00default via 192.168.10.1 dev eth0 
2026-03-21 05:49:49.767372+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:49.767404+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:49.767414+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:49:49.767430+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 05:49:49.767445+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 05:49:49.767453+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 05:49:49.767469+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 05:49:49.768223+00:00[#] awg setconf de /dev/fd/63
2026-03-21 05:49:49.771533+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 05:49:49.773340+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 05:49:49.783974+00:00[#] awg set de fwmark 51820
2026-03-21 05:49:49.785019+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 05:49:49.786728+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 05:49:49.788359+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 05:49:49.792500+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 05:49:49.793986+00:00[#] iptables-restore -n
2026-03-21 05:49:49.797148+00:00[#] sleep 5
2026-03-21 05:49:54.799829+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 05:49:54.802515+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 05:49:54.806143+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw
2026-03-21 05:49:54.809008+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table)
2026-03-21 05:49:54.812622+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table)
2026-03-21 05:49:54.816844+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE
2026-03-21 05:49:59.881502+00:00>>> Tunnel is DOWN <<<
2026-03-21 05:50:00.898716+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible
2026-03-21 05:50:00.918291+00:00[#] ip link add de type amneziawg
2026-03-21 05:50:00.921050+00:00Error: Unknown device type.
2026-03-21 05:50:00.921278+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation.
2026-03-21 05:50:00.921301+00:00[#] amneziawg-go de
2026-03-21 05:50:00.922728+00:00┌──────────────────────────────────────────────────────────────┐
2026-03-21 05:50:00.922756+00:00│                                                              │
2026-03-21 05:50:00.922763+00:00│       Running amneziawg-go is not required because this      │
2026-03-21 05:50:00.922787+00:00│       kernel has first class support for AmneziaWG. For      │
2026-03-21 05:50:00.922793+00:00│       information on installing the kernel module,           │
2026-03-21 05:50:00.922800+00:00│       please visit:                                          │
2026-03-21 05:50:00.922814+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │
2026-03-21 05:50:00.922820+00:00│                                                              │
2026-03-21 05:50:00.922825+00:00└──────────────────────────────────────────────────────────────┘
2026-03-21 05:50:00.924404+00:00[#] iptables-save
2026-03-21 05:50:00.926393+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:50:00 2026
2026-03-21 05:50:00.926773+00:00*nat
2026-03-21 05:50:00.926825+00:00:PREROUTING ACCEPT [0:0]
2026-03-21 05:50:00.926837+00:00:INPUT ACCEPT [0:0]
2026-03-21 05:50:00.926868+00:00:OUTPUT ACCEPT [0:0]
2026-03-21 05:50:00.926879+00:00:POSTROUTING ACCEPT [0:0]
2026-03-21 05:50:00.926900+00:00:DOCKER_OUTPUT - [0:0]
2026-03-21 05:50:00.926909+00:00:DOCKER_POSTROUTING - [0:0]
2026-03-21 05:50:00.926918+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
2026-03-21 05:50:00.926926+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
2026-03-21 05:50:00.926941+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:33517
2026-03-21 05:50:00.926950+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:44454
2026-03-21 05:50:00.926969+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 33517 -j SNAT --to-source :53
2026-03-21 05:50:00.926984+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 44454 -j SNAT --to-source :53
2026-03-21 05:50:00.926993+00:00COMMIT
2026-03-21 05:50:00.927002+00:00# Completed on Sat Mar 21 05:50:00 2026
2026-03-21 05:50:00.927591+00:00[#] ip rule show
2026-03-21 05:50:00.929435+00:000:	from all lookup local
2026-03-21 05:50:00.929619+00:0032766:	from all lookup main
2026-03-21 05:50:00.929662+00:0032767:	from all lookup default
2026-03-21 05:50:00.930021+00:00[#] ip route show table all
2026-03-21 05:50:00.932693+00:00default via 192.168.10.1 dev eth0 
2026-03-21 05:50:00.932747+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 
2026-03-21 05:50:00.932759+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:50:00.932766+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
2026-03-21 05:50:00.932773+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
2026-03-21 05:50:00.932787+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 
2026-03-21 05:50:00.932794+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 
2026-03-21 05:50:00.932801+00:00local ::1 dev lo table local proto kernel metric 0 pref medium
2026-03-21 05:50:00.933434+00:00[#] awg setconf de /dev/fd/63
2026-03-21 05:50:00.935367+00:00[#] ip -4 address add 100.79.187.228/32 dev de
2026-03-21 05:50:00.936429+00:00[#] ip link set mtu 1280 up dev de
2026-03-21 05:50:00.943265+00:00[#] awg set de fwmark 51820
2026-03-21 05:50:00.944252+00:00[#] ip -4 rule add not fwmark 51820 table 51820
2026-03-21 05:50:00.945721+00:00[#] ip -4 rule add table main suppress_prefixlength 0
2026-03-21 05:50:00.947138+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820
2026-03-21 05:50:00.950701+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
2026-03-21 05:50:00.952172+00:00[#] iptables-restore -n
2026-03-21 05:50:00.958065+00:00[#] sleep 5
2026-03-21 05:50:05.959922+00:00[#] sysctl -qw net.ipv4.ip_forward=1
2026-03-21 05:50:05.961010+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table
2026-03-21 05:50:05.962926+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw
2026-03-21 05:50:05.964467+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table)
2026-03-21 05:50:05.966497+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table)
2026-03-21 05:50:05.969173+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE
2026-03-21 05:50:11.032138+00:00>>> Tunnel is DOWN <<<
<!-- gh-comment-id:4102394141 --> @nike38rus commented on GitHub (Mar 21, 2026): Update: I've removed IPv6 from AllowedIPs option and the problem dissapeared (`AllowedIPs = 0.0.0.0/0`). Now container is crasing only due wget check failures. I don't need IPv6 inside amnezia tunnel, so I guess I've fixed my problem. But the root cause of the problem is still somewhere there so I'll keep this issue open. Startup log: ``` 2026-03-21 05:49:03.838982+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 05:49:03.867685+00:00[#] ip link add de type amneziawg 2026-03-21 05:49:03.873452+00:00Error: Unknown device type. 2026-03-21 05:49:03.873882+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 05:49:03.873927+00:00[#] amneziawg-go de 2026-03-21 05:49:03.881468+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 05:49:03.881529+00:00│ │ 2026-03-21 05:49:03.881546+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 05:49:03.881575+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 05:49:03.881588+00:00│ information on installing the kernel module, │ 2026-03-21 05:49:03.881599+00:00│ please visit: │ 2026-03-21 05:49:03.881617+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 05:49:03.881628+00:00│ │ 2026-03-21 05:49:03.881639+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 05:49:03.893267+00:00[#] iptables-save 2026-03-21 05:49:03.895691+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:03 2026 2026-03-21 05:49:03.896786+00:00*nat 2026-03-21 05:49:03.896841+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 05:49:03.896856+00:00:INPUT ACCEPT [0:0] 2026-03-21 05:49:03.896883+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 05:49:03.896894+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 05:49:03.896904+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 05:49:03.896915+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 05:49:03.896925+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 05:49:03.896935+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 05:49:03.896950+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:43537 2026-03-21 05:49:03.896961+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:44485 2026-03-21 05:49:03.896971+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 43537 -j SNAT --to-source :53 2026-03-21 05:49:03.896986+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 44485 -j SNAT --to-source :53 2026-03-21 05:49:03.896997+00:00COMMIT 2026-03-21 05:49:03.897007+00:00# Completed on Sat Mar 21 05:49:03 2026 2026-03-21 05:49:03.897876+00:00[#] ip rule show 2026-03-21 05:49:03.902742+00:000: from all lookup local 2026-03-21 05:49:03.902807+00:0032766: from all lookup main 2026-03-21 05:49:03.902822+00:0032767: from all lookup default 2026-03-21 05:49:03.903773+00:00[#] ip route show table all 2026-03-21 05:49:03.906400+00:00default via 192.168.10.1 dev eth0 2026-03-21 05:49:03.906443+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 05:49:03.906478+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:03.906487+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:03.906493+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 05:49:03.906502+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 05:49:03.906508+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 05:49:03.906514+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 05:49:03.909718+00:00[#] awg setconf de /dev/fd/63 2026-03-21 05:49:03.914601+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 05:49:03.919989+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 05:49:03.938024+00:00[#] awg set de fwmark 51820 2026-03-21 05:49:03.939746+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 05:49:03.941312+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 05:49:03.942410+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 05:49:03.946425+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 05:49:03.948074+00:00[#] iptables-restore -n 2026-03-21 05:49:03.951946+00:00[#] sleep 5 2026-03-21 05:49:08.954657+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 05:49:08.956780+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 05:49:08.995835+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw 2026-03-21 05:49:09.000010+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table) 2026-03-21 05:49:09.003901+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table) 2026-03-21 05:49:09.008335+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE 2026-03-21 05:49:14.072960+00:00>>> Tunnel is DOWN <<< 2026-03-21 05:49:15.350580+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 05:49:15.371262+00:00[#] ip link add de type amneziawg 2026-03-21 05:49:15.374184+00:00Error: Unknown device type. 2026-03-21 05:49:15.374458+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 05:49:15.374495+00:00[#] amneziawg-go de 2026-03-21 05:49:15.376032+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 05:49:15.376078+00:00│ │ 2026-03-21 05:49:15.376097+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 05:49:15.376103+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 05:49:15.376109+00:00│ information on installing the kernel module, │ 2026-03-21 05:49:15.376115+00:00│ please visit: │ 2026-03-21 05:49:15.376125+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 05:49:15.376134+00:00│ │ 2026-03-21 05:49:15.376140+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 05:49:15.377963+00:00[#] iptables-save 2026-03-21 05:49:15.380023+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:15 2026 2026-03-21 05:49:15.381229+00:00*nat 2026-03-21 05:49:15.381261+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 05:49:15.381280+00:00:INPUT ACCEPT [0:0] 2026-03-21 05:49:15.381287+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 05:49:15.381292+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 05:49:15.381299+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 05:49:15.381305+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 05:49:15.381310+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 05:49:15.381321+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 05:49:15.381327+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:46607 2026-03-21 05:49:15.381333+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:42248 2026-03-21 05:49:15.381342+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 46607 -j SNAT --to-source :53 2026-03-21 05:49:15.381348+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 42248 -j SNAT --to-source :53 2026-03-21 05:49:15.381354+00:00COMMIT 2026-03-21 05:49:15.381359+00:00# Completed on Sat Mar 21 05:49:15 2026 2026-03-21 05:49:15.381822+00:00[#] ip rule show 2026-03-21 05:49:15.383565+00:000: from all lookup local 2026-03-21 05:49:15.383596+00:0032766: from all lookup main 2026-03-21 05:49:15.383603+00:0032767: from all lookup default 2026-03-21 05:49:15.384407+00:00[#] ip route show table all 2026-03-21 05:49:15.385909+00:00default via 192.168.10.1 dev eth0 2026-03-21 05:49:15.385935+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 05:49:15.385946+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:15.385979+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:15.386006+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 05:49:15.386014+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 05:49:15.386019+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 05:49:15.386051+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 05:49:15.386546+00:00[#] awg setconf de /dev/fd/63 2026-03-21 05:49:15.388498+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 05:49:15.389741+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 05:49:15.396828+00:00[#] awg set de fwmark 51820 2026-03-21 05:49:15.397545+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 05:49:15.398585+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 05:49:15.399716+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 05:49:15.402492+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 05:49:15.403610+00:00[#] iptables-restore -n 2026-03-21 05:49:15.406551+00:00[#] sleep 5 2026-03-21 05:49:20.409595+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 05:49:20.412288+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 05:49:20.416267+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw 2026-03-21 05:49:20.418779+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table) 2026-03-21 05:49:20.422258+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table) 2026-03-21 05:49:20.426451+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE 2026-03-21 05:49:25.490664+00:00>>> Tunnel is DOWN <<< 2026-03-21 05:49:26.393249+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 05:49:26.412941+00:00[#] ip link add de type amneziawg 2026-03-21 05:49:26.416021+00:00Error: Unknown device type. 2026-03-21 05:49:26.416273+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 05:49:26.416311+00:00[#] amneziawg-go de 2026-03-21 05:49:26.417737+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 05:49:26.417780+00:00│ │ 2026-03-21 05:49:26.417788+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 05:49:26.417794+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 05:49:26.417800+00:00│ information on installing the kernel module, │ 2026-03-21 05:49:26.417810+00:00│ please visit: │ 2026-03-21 05:49:26.417816+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 05:49:26.417822+00:00│ │ 2026-03-21 05:49:26.417827+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 05:49:26.420578+00:00[#] iptables-save 2026-03-21 05:49:26.422864+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:26 2026 2026-03-21 05:49:26.423618+00:00*nat 2026-03-21 05:49:26.423702+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 05:49:26.423719+00:00:INPUT ACCEPT [0:0] 2026-03-21 05:49:26.423736+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 05:49:26.423746+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 05:49:26.423757+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 05:49:26.423768+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 05:49:26.423790+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 05:49:26.423801+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 05:49:26.423812+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:46067 2026-03-21 05:49:26.423823+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:58748 2026-03-21 05:49:26.423839+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 46067 -j SNAT --to-source :53 2026-03-21 05:49:26.423850+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 58748 -j SNAT --to-source :53 2026-03-21 05:49:26.423860+00:00COMMIT 2026-03-21 05:49:26.423877+00:00# Completed on Sat Mar 21 05:49:26 2026 2026-03-21 05:49:26.424346+00:00[#] ip rule show 2026-03-21 05:49:26.426771+00:000: from all lookup local 2026-03-21 05:49:26.426861+00:0032766: from all lookup main 2026-03-21 05:49:26.426880+00:0032767: from all lookup default 2026-03-21 05:49:26.427290+00:00[#] ip route show table all 2026-03-21 05:49:26.428616+00:00default via 192.168.10.1 dev eth0 2026-03-21 05:49:26.428643+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 05:49:26.428654+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:26.428674+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:26.428691+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 05:49:26.428713+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 05:49:26.428722+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 05:49:26.428740+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 05:49:26.429842+00:00[#] awg setconf de /dev/fd/63 2026-03-21 05:49:26.433450+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 05:49:26.435397+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 05:49:26.451891+00:00[#] awg set de fwmark 51820 2026-03-21 05:49:26.452953+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 05:49:26.454826+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 05:49:26.456193+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 05:49:26.460393+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 05:49:26.463458+00:00[#] iptables-restore -n 2026-03-21 05:49:26.472419+00:00[#] sleep 5 2026-03-21 05:49:31.475126+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 05:49:31.477382+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 05:49:31.481106+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw 2026-03-21 05:49:31.484156+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table) 2026-03-21 05:49:31.488385+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table) 2026-03-21 05:49:31.493503+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE 2026-03-21 05:49:36.557887+00:00>>> Tunnel is DOWN <<< 2026-03-21 05:49:37.794731+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 05:49:37.815470+00:00[#] ip link add de type amneziawg 2026-03-21 05:49:37.818188+00:00Error: Unknown device type. 2026-03-21 05:49:37.818423+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 05:49:37.818445+00:00[#] amneziawg-go de 2026-03-21 05:49:37.820132+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 05:49:37.820183+00:00│ │ 2026-03-21 05:49:37.820192+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 05:49:37.820200+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 05:49:37.820215+00:00│ information on installing the kernel module, │ 2026-03-21 05:49:37.820221+00:00│ please visit: │ 2026-03-21 05:49:37.820228+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 05:49:37.820234+00:00│ │ 2026-03-21 05:49:37.820247+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 05:49:37.821986+00:00[#] iptables-save 2026-03-21 05:49:37.824067+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:37 2026 2026-03-21 05:49:37.825262+00:00*nat 2026-03-21 05:49:37.825311+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 05:49:37.825330+00:00:INPUT ACCEPT [0:0] 2026-03-21 05:49:37.825340+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 05:49:37.825350+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 05:49:37.825359+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 05:49:37.825389+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 05:49:37.825400+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 05:49:37.825409+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 05:49:37.825483+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:43165 2026-03-21 05:49:37.825506+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:60337 2026-03-21 05:49:37.825515+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 43165 -j SNAT --to-source :53 2026-03-21 05:49:37.825525+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 60337 -j SNAT --to-source :53 2026-03-21 05:49:37.825645+00:00COMMIT 2026-03-21 05:49:37.825660+00:00# Completed on Sat Mar 21 05:49:37 2026 2026-03-21 05:49:37.825680+00:00[#] ip rule show 2026-03-21 05:49:37.827686+00:000: from all lookup local 2026-03-21 05:49:37.827734+00:0032766: from all lookup main 2026-03-21 05:49:37.827761+00:0032767: from all lookup default 2026-03-21 05:49:37.828170+00:00[#] ip route show table all 2026-03-21 05:49:37.829235+00:00default via 192.168.10.1 dev eth0 2026-03-21 05:49:37.829255+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 05:49:37.829289+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:37.829319+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:37.829328+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 05:49:37.829335+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 05:49:37.829346+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 05:49:37.829355+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 05:49:37.829875+00:00[#] awg setconf de /dev/fd/63 2026-03-21 05:49:37.833124+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 05:49:37.835358+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 05:49:37.847937+00:00[#] awg set de fwmark 51820 2026-03-21 05:49:37.849228+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 05:49:37.850859+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 05:49:37.852543+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 05:49:37.858427+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 05:49:37.860668+00:00[#] iptables-restore -n 2026-03-21 05:49:37.866096+00:00[#] sleep 5 2026-03-21 05:49:42.869115+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 05:49:42.870147+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 05:49:42.873815+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw 2026-03-21 05:49:42.876888+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table) 2026-03-21 05:49:42.880670+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table) 2026-03-21 05:49:42.885268+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE 2026-03-21 05:49:47.950229+00:00>>> Tunnel is DOWN <<< 2026-03-21 05:49:49.729503+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 05:49:49.751490+00:00[#] ip link add de type amneziawg 2026-03-21 05:49:49.755089+00:00Error: Unknown device type. 2026-03-21 05:49:49.755429+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 05:49:49.755456+00:00[#] amneziawg-go de 2026-03-21 05:49:49.757199+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 05:49:49.757247+00:00│ │ 2026-03-21 05:49:49.757257+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 05:49:49.757272+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 05:49:49.757280+00:00│ information on installing the kernel module, │ 2026-03-21 05:49:49.757289+00:00│ please visit: │ 2026-03-21 05:49:49.757297+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 05:49:49.757314+00:00│ │ 2026-03-21 05:49:49.757322+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 05:49:49.759338+00:00[#] iptables-save 2026-03-21 05:49:49.761346+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:49:49 2026 2026-03-21 05:49:49.762117+00:00*nat 2026-03-21 05:49:49.762158+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 05:49:49.762169+00:00:INPUT ACCEPT [0:0] 2026-03-21 05:49:49.762178+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 05:49:49.762216+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 05:49:49.762226+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 05:49:49.762234+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 05:49:49.762244+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 05:49:49.762253+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 05:49:49.762269+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:41985 2026-03-21 05:49:49.762279+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:41519 2026-03-21 05:49:49.762288+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 41985 -j SNAT --to-source :53 2026-03-21 05:49:49.762303+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 41519 -j SNAT --to-source :53 2026-03-21 05:49:49.762312+00:00COMMIT 2026-03-21 05:49:49.762321+00:00# Completed on Sat Mar 21 05:49:49 2026 2026-03-21 05:49:49.762818+00:00[#] ip rule show 2026-03-21 05:49:49.764936+00:000: from all lookup local 2026-03-21 05:49:49.765119+00:0032766: from all lookup main 2026-03-21 05:49:49.765159+00:0032767: from all lookup default 2026-03-21 05:49:49.765665+00:00[#] ip route show table all 2026-03-21 05:49:49.767345+00:00default via 192.168.10.1 dev eth0 2026-03-21 05:49:49.767372+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 05:49:49.767404+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:49.767414+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:49:49.767430+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 05:49:49.767445+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 05:49:49.767453+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 05:49:49.767469+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 05:49:49.768223+00:00[#] awg setconf de /dev/fd/63 2026-03-21 05:49:49.771533+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 05:49:49.773340+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 05:49:49.783974+00:00[#] awg set de fwmark 51820 2026-03-21 05:49:49.785019+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 05:49:49.786728+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 05:49:49.788359+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 05:49:49.792500+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 05:49:49.793986+00:00[#] iptables-restore -n 2026-03-21 05:49:49.797148+00:00[#] sleep 5 2026-03-21 05:49:54.799829+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 05:49:54.802515+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 05:49:54.806143+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw 2026-03-21 05:49:54.809008+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table) 2026-03-21 05:49:54.812622+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table) 2026-03-21 05:49:54.816844+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE 2026-03-21 05:49:59.881502+00:00>>> Tunnel is DOWN <<< 2026-03-21 05:50:00.898716+00:00Warning: `/etc/amnezia/amneziawg/de.conf' is world accessible 2026-03-21 05:50:00.918291+00:00[#] ip link add de type amneziawg 2026-03-21 05:50:00.921050+00:00Error: Unknown device type. 2026-03-21 05:50:00.921278+00:00[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation. 2026-03-21 05:50:00.921301+00:00[#] amneziawg-go de 2026-03-21 05:50:00.922728+00:00┌──────────────────────────────────────────────────────────────┐ 2026-03-21 05:50:00.922756+00:00│ │ 2026-03-21 05:50:00.922763+00:00│ Running amneziawg-go is not required because this │ 2026-03-21 05:50:00.922787+00:00│ kernel has first class support for AmneziaWG. For │ 2026-03-21 05:50:00.922793+00:00│ information on installing the kernel module, │ 2026-03-21 05:50:00.922800+00:00│ please visit: │ 2026-03-21 05:50:00.922814+00:00| https://github.com/amnezia-vpn/amneziawg-linux-kernel-module │ 2026-03-21 05:50:00.922820+00:00│ │ 2026-03-21 05:50:00.922825+00:00└──────────────────────────────────────────────────────────────┘ 2026-03-21 05:50:00.924404+00:00[#] iptables-save 2026-03-21 05:50:00.926393+00:00# Generated by iptables-save v1.8.10 (nf_tables) on Sat Mar 21 05:50:00 2026 2026-03-21 05:50:00.926773+00:00*nat 2026-03-21 05:50:00.926825+00:00:PREROUTING ACCEPT [0:0] 2026-03-21 05:50:00.926837+00:00:INPUT ACCEPT [0:0] 2026-03-21 05:50:00.926868+00:00:OUTPUT ACCEPT [0:0] 2026-03-21 05:50:00.926879+00:00:POSTROUTING ACCEPT [0:0] 2026-03-21 05:50:00.926900+00:00:DOCKER_OUTPUT - [0:0] 2026-03-21 05:50:00.926909+00:00:DOCKER_POSTROUTING - [0:0] 2026-03-21 05:50:00.926918+00:00-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT 2026-03-21 05:50:00.926926+00:00-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING 2026-03-21 05:50:00.926941+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:33517 2026-03-21 05:50:00.926950+00:00-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:44454 2026-03-21 05:50:00.926969+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 33517 -j SNAT --to-source :53 2026-03-21 05:50:00.926984+00:00-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 44454 -j SNAT --to-source :53 2026-03-21 05:50:00.926993+00:00COMMIT 2026-03-21 05:50:00.927002+00:00# Completed on Sat Mar 21 05:50:00 2026 2026-03-21 05:50:00.927591+00:00[#] ip rule show 2026-03-21 05:50:00.929435+00:000: from all lookup local 2026-03-21 05:50:00.929619+00:0032766: from all lookup main 2026-03-21 05:50:00.929662+00:0032767: from all lookup default 2026-03-21 05:50:00.930021+00:00[#] ip route show table all 2026-03-21 05:50:00.932693+00:00default via 192.168.10.1 dev eth0 2026-03-21 05:50:00.932747+00:00192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.11 2026-03-21 05:50:00.932759+00:00local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:50:00.932766+00:00local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 2026-03-21 05:50:00.932773+00:00broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 2026-03-21 05:50:00.932787+00:00local 192.168.10.11 dev eth0 table local proto kernel scope host src 192.168.10.11 2026-03-21 05:50:00.932794+00:00broadcast 192.168.10.255 dev eth0 table local proto kernel scope link src 192.168.10.11 2026-03-21 05:50:00.932801+00:00local ::1 dev lo table local proto kernel metric 0 pref medium 2026-03-21 05:50:00.933434+00:00[#] awg setconf de /dev/fd/63 2026-03-21 05:50:00.935367+00:00[#] ip -4 address add 100.79.187.228/32 dev de 2026-03-21 05:50:00.936429+00:00[#] ip link set mtu 1280 up dev de 2026-03-21 05:50:00.943265+00:00[#] awg set de fwmark 51820 2026-03-21 05:50:00.944252+00:00[#] ip -4 rule add not fwmark 51820 table 51820 2026-03-21 05:50:00.945721+00:00[#] ip -4 rule add table main suppress_prefixlength 0 2026-03-21 05:50:00.947138+00:00[#] ip -4 route add 0.0.0.0/0 dev de table 51820 2026-03-21 05:50:00.950701+00:00[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1 2026-03-21 05:50:00.952172+00:00[#] iptables-restore -n 2026-03-21 05:50:00.958065+00:00[#] sleep 5 2026-03-21 05:50:05.959922+00:00[#] sysctl -qw net.ipv4.ip_forward=1 2026-03-21 05:50:05.961010+00:00[#] ip route show table all | grep "default dev de" | awk '{print $5}' | head -n1 > /tmp/pbr_table 2026-03-21 05:50:05.962926+00:00[#] ip route show default | awk '{print $3}' > /tmp/default_gw 2026-03-21 05:50:05.964467+00:00[#] ip rule add iif eth0 lookup $(cat /tmp/pbr_table) 2026-03-21 05:50:05.966497+00:00[#] ip route add 192.168.0.0/16 via $(cat /tmp/default_gw) dev eth0 table $(cat /tmp/pbr_table) 2026-03-21 05:50:05.969173+00:00[#] iptables -t nat -C POSTROUTING -o de -j MASQUERADE &> /dev/null || iptables -t nat -A POSTROUTING -o de -j MASQUERADE 2026-03-21 05:50:11.032138+00:00>>> Tunnel is DOWN <<< ```
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
experimental
feature/awg4
new_fields_to_config
build/deb
v3.1.20260812
v3.0.20260805
v3.0.20260730
v1.0.20260618-2
v1.0.20260618
v1.0.20260223
v1.0.20250903
v1.0.20250901
v1.0.20250706
v1.0.20250704
v1.0.20241018
v1.0.20240213
v1.0.20240202
v1.0.20240201
v1.0.20240102
v1.0.20240120
v0.0.1-kmod
v1.0.20231215
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
amnezia-vpn/amneziawg-tools#16
No description provided.