WireGuard plus a browser admin panel in one container
wg-easy packs a WireGuard server and its web admin panel into a single container on a Linux host. Clients are created, edited, disabled and deleted in the browser, and each one comes with a QR code and a downloadable .conf file. The reference compose file exposes UDP 51820 for the tunnel and TCP 51821 for the panel. All state lives in one SQLite file inside the /etc/wireguard volume, so there is no database server to run, and a cli command shipped in the container resets the admin password.
Server-enforced firewall rules and five-minute config links
- Per-client firewall: the "Firewall Allowed IPs" field limits where a client can go (address, subnet, port, TCP or UDP), and the server enforces it with iptables. The regular Allowed IPs field only sets routing, which the user can edit on their own device.
- One-time links:
/cnf/<code>serves a client's.conffile for five minutes and is wiped after the first download. A separate expiry date disables the client itself on a given day. - Sign-in: password with optional TOTP, or OAuth through Google, GitHub or any OIDC provider. The docs include setup steps for Authelia and VoidAuth, and password login can be switched off entirely.
- Metrics: a
/metrics/prometheusendpoint, turned on from the admin panel, with an optional Bearer token. The panel also draws upload and download charts for every connected client. - Hands-off setup:
INIT_*variables (account, host, port, DNS, IPv4 and IPv6 ranges) replace the first-run wizard, which suits Ansible-style provisioning. - AmneziaWG:
EXPERIMENTAL_AWG=trueswitches to this WireGuard variant built to get past deep packet inspection, provided its kernel module is installed on the host. Every client then needs a compatible app.
Kernel capabilities, an HTTPS proxy and no user roles
wg-easy only installs as a container. The docs page on running without Docker says it is not yet supported. The compose file grants the NET_ADMIN and SYS_MODULE capabilities, mounts /lib/modules read-only and turns on IP forwarding through sysctl. Only x86_64 and arm64 hosts are supported, and the migration guide warns that armv6 and armv7 machines cannot move to v15.
The panel expects an HTTPS reverse proxy. Plain HTTP requires INSECURE=true, a mode the docs call insecure and limit to local-network access. wg-easy has no rate limiting either: the Caddy tutorial hands that job to the proxy or to CrowdSec for /api/auth/password, /api/auth/verify-2fa and /cnf/*. A comment in the source code concedes that one-time link codes can be brute-forced, and relies on the five-minute window and single use to contain the risk.
Every account is an admin. The OAuth docs warn that accounts created on first login get admin rights, because there is no permission system yet. No restricted account exists for a user who only needs to fetch their own config.
wg-easy is not an official WireGuard project. The README states it has no affiliation with Jason A. Donenfeld, who holds the WireGuard trademark, or with ZX2C4 or Edge Security.
Version 15.5.0 shipped on October 24, 2026. It patches Node.js vulnerabilities and moves to AmneziaWG 3.1. The 15 line, first released on May 28, 2025, is a full rewrite: environment variables changed and most settings moved into the admin panel. The latest Docker tag still points to v14, and the docs say to pin 15 instead. Per-client firewalling is still labelled experimental and should be tested before it guards anything in production. The /api endpoints are neither stable nor documented, and they stop working on any account with two-factor authentication turned on.