[GH-ISSUE #101] Fix ACCEPT_CLIENTS #2015

Closed
opened 2026-05-03 05:43:03 -05:00 by GiteaMirror · 2 comments
Owner

Originally created by @oschwartz10612 on GitHub (Aug 8, 2025).
Original GitHub issue: https://github.com/fosrl/newt/issues/101

Originally assigned to: @oschwartz10612 on GitHub.

ACCEPT_CLIENTS gets overridden by the cli arg

Originally created by @oschwartz10612 on GitHub (Aug 8, 2025). Original GitHub issue: https://github.com/fosrl/newt/issues/101 Originally assigned to: @oschwartz10612 on GitHub. ACCEPT_CLIENTS gets overridden by the cli arg
Author
Owner

@Lokowitz commented on GitHub (Aug 8, 2025):

I also noticed that --native is not working with docker for me, only with native newt installation.
After adding --cap-add=NET_ADMIN it works.

I am not a pro but i saw in other projects that they also use these commands:

  --cap-add=SYS_MODULE
  --sysctl="net.ipv4.conf.all.src_valid_mark=1"
  --sysctl="net.ipv4.ip_forward=1"

Docker logs without --cap-add=NET_ADMIN

INFO: 2025/08/08 11:54:44 Received WireGuard clients configuration from remote server
FATAL: 2025/08/08 11:54:44 Failed to create WireGuard interface: operation not permitted
<!-- gh-comment-id:3167705571 --> @Lokowitz commented on GitHub (Aug 8, 2025): I also noticed that `--native` is not working with docker for me, only with native newt installation. After adding `--cap-add=NET_ADMIN` it works. I am not a pro but i saw in other projects that they also use these commands: ``` --cap-add=SYS_MODULE --sysctl="net.ipv4.conf.all.src_valid_mark=1" --sysctl="net.ipv4.ip_forward=1" ``` ## Docker logs without --cap-add=NET_ADMIN ``` INFO: 2025/08/08 11:54:44 Received WireGuard clients configuration from remote server FATAL: 2025/08/08 11:54:44 Failed to create WireGuard interface: operation not permitted ```
Author
Owner

@oschwartz10612 commented on GitHub (Aug 9, 2025):

Yeah should add this to the docs. Because its a native WG tunnel the container namespace needs that permission.

<!-- gh-comment-id:3171915197 --> @oschwartz10612 commented on GitHub (Aug 9, 2025): Yeah should add this to the docs. Because its a native WG tunnel the container namespace needs that permission.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/newt#2015