()

Usage
wgjail-quick [ up | down ] [ CONFIG_FILE | INTERFACE ]
wgjail-quick exec [ CONFIG_FILE | INTERFACE ] USERNAME CMD_LINE
wgjail-quick portforward [ CONFIG_FILE | INTERFACE ] LISTEN_ADDRESS FORWARDED_PORT [ DESTINATION_PORT ]
wgjail-quick generate-jail-service [ CONFIG_FILE | INTERFACE ]
wgjail-quick generate-cmd-service [ CONFIG_FILE | INTERFACE ] CMD_LINE
wgjail-quick generate-portforward-service [ CONFIG_FILE | INTERFACE ] LISTEN_ADDRESS FORWARDED_PORT [ DESTINATION_PORT ]

CONFIG_FILE is a path to a WireGuard configuration file. Using an absolute path is a good idea.

INTERFACE is a WireGuard config file that is in /etc/wireguard, which means you only have to write, for example, “p2p” to use the WireGuard config file /etc/wireguard/p2p.conf.

The portion of the config file’s basename before the .conf is the name that will be given to: 1. the network namespace (the “WireGuard jail”) and 2. the WireGuard interface inside the network namespace.

CMD_LINE is a command with command-line arguments that you want to execute in the namespace.

Commands

  up
Creates a new network namespace with a WireGuard interface defined in the given config file.

  down
Removes the given network namespace.

  exec
Executes a command in the given network namespace.
USERNAME is the username or UID of the user that shall execute the given command.

  portforward
Forwards a port into the network namespace. You have to specify which address to listen on and which port to forward. Use 0.0.0.0 to listen everywhere.
Optionally, you can also define a destination port inside the network namespace that is different from the port on which the host system listens. If not given, the same port is used.

  generate-jail-service
Generates a systemd service that creates a network namespace, like with the up command. Result will be saved to the current directory (./wgjail-NAMESPACE.service).
This service will expect to find the configuration file at the same absolute path on every start. Make sure you generate the service either with the absolute path to where the config file will be permanently, or, if you plan to put the config file into `/etc/wireguard/CONFIG_FILE.conf', it is enough to give the filename before the `.conf' without any path.

  generate-cmd-service
Generates a systemd template service that starts the given command inside the given network namespace, like the exec keyword.
When you start this service, make sure you append the username that shall run the command after the `@' symbol, e.g. `systemctl start wgjail-NAMESPACE-CMD@myuser.service'. Result will be saved to the current directory (./wgjail-NAMESPACE-CMD@.service).
CMD will be substituted by the name of the command. The parameters will not be inserted into the filename. If you want to create multiple services for the same command, you have to rename them manually.
The network namespace this service references must also be started via a systemd service (e.g., with a service generated by the “generate-jail-service” command), so systemd can make sure the jail already exists before it tries to execute this command inside the jail. This cmd service will bind to the jail service and will automatically be stopped if the jail service is stopped.

  generate-portforward-service
Generates a systemd template service that forwards a port into the network namespace (the WireGuard jail).
Result will be saved to the current directory (`wgjail-NAMESPACE-portforward-LISTEN_ADDRESS-FORWARDED_PORT.service').
Optionally, you can also define a destination port inside the network namespace that is different from the port on which the host system listens. If not given, the same port is used.
The network namespace this service references must also be started via a systemd service (e.g., with a service generated by the “generate-jail-service” command), so systemd can make sure the jail already exists before it tries to execute this command inside the jail. This cmd service will bind to the jail service and will automatically be stopped if the jail service is stopped.

Usage Examples

  Temporary
If you want to, for example, just quickly torrent an ISO of Hannah Montana Linux, which is not a metaphor for something else, and you want to make sure your torrent client only uses a VPN connection and under no circumstances your normal internet connection, while the rest of your system continues as normal, you can do it this way:
sudo wgjail-quick up /path/to/<wireguard_config>.conf
sudo wgjail-quick exec /path/to/<wireguard_config>.conf <your_username> qbittorrent
When you’re done, close the qbittorrent window, then:
sudo wgjail-quick down /path/to/<wireguard_config>.conf
Done. Very easy.

  Starting a podman container in the namespace
If you want to start a container inside the network namespace, you can do it (with podman) like this:
sudo podman run --network ns:/var/run/netns/<NAMESPACE> ...
This will also automatically use the correct resolv.conf for the namespace.

If you write a Quadlet, then adding this option is enough:
Network=ns:/var/run/netns/<NAMESPACE>
This also uses the correct resolv.conf automatically.

  Permanently via systemd services
If you now, for example, have set up a dedicated server to seed your Hannah Montana Linux ISO image, you can, with wgjail-quick, create systemd files that automatically, on boot: 1. create the WireGuard jail, then 2. start qbittorrent-nox (nox means webUI, so you can connect to your server via a web browser and use qbittorrent that way), then 3. forward a port into the WireGuard jail so you can access the web interface of qbittorrent:

wgjail-quick generate-jail-service /path/to/<wireguard_config>.conf
wgjail-quick generate-cmd-service /path/to/<wireguard_config>.conf /usr/bin/qbittorrent-nox -d --webui-port=6969
wgjail-quick generate-portforward-service /path/to/<wireguard_config>.conf 0.0.0.0 6969

Now you can copy these systemd files to /etc/systemd/system and enable them. The filenames are different depending on how you named your WireGuard conf file (just like wg-quick sets the name of the interface it creates according to the filename of the .conf file). If, for example, your WireGuard config file was named “my-wg.conf” and the username with which you want to start the qbittorrent server is “myuser”, then you can copy and start the services, for example, like this:
sudo cp wgjail-my-wg.service wgjail-my-wg-qbittorrent-nox@.service wgjail-my-wg-portforward-0.0.0.0-6969.service /etc/systemd/system
sudo systemctl enable --now wgjail-my-wg.service wgjail-my-wg-qbittorrent-nox@myuser.service wgjail-my-wg-portforward-0.0.0.0-6969.service