Adguard Home + Wireguard (WG Easy)

[nktnet1]

UPDATE 2025

For wireguard v15+, see my comment further below.

---

Original

Here's a working template for adguard home + wireguard (using wg-easy image):

services:
  adguardhome:
    image: adguard/adguardhome
    ports:
      - 53:53/tcp
      - 53:53/udp
      - 784:784/udp
      - 853:853/tcp
      - 20080:80/tcp
      
      # Only needed for initial setup with Admin GUI - you can turn this off afterwards
      - 20300:3000
    volumes:
      - /opt/adguardhome/work:/opt/adguardhome/work
      - /opt/adguardhome/conf:/opt/adguardhome/conf
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    networks:
      private_network:
        ipv4_address: 10.2.0.100

  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:14
    environment:
      # Your public IP address
      - WG_HOST=${WG_HOST}
      # https://github.com/wg-easy/wg-easy/blob/v14.0.0/How_to_generate_an_bcrypt_hash.md
      # i.e. docker run ghcr.io/wg-easy/wg-easy:14 wgpw YOUR_PASSWORD
      - PASSWORD_HASH=<GENERATE YOUR HASH - READ ABOVE INSTRUCTIONS CAREFULLY>
      - LANG=${LANG:-en}
      - WG_PORT=51820
      - PORT=51821
      - WG_DEFAULT_DNS=10.2.0.100
    volumes:
      - wg_easy_data:/etc/wireguard
    ports:
      - 51820:51820/udp
      - 51821:51821/tcp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    networks:
      private_network:
        ipv4_address: 10.2.0.3

volumes:
  wg_easy_data:

networks:
  private_network:
    ipam:
      driver: default
      config:
        - subnet: 10.2.0.0/24

Please look up the respective guides on how to set this up. You will need to open port 51820 for UDP on your router ("port forwarding" section in settings).

This was updated from @walmer26's answer in March 21, 2022.

---

If you run into issues with port 53 being taken (most likely from systemd-resolved), see here:

• Port 53 already in use AdguardTeam/AdGuardHome#4283 (comment)

[nktnet1]

For wg-easy version 15 (released just now):

• https://github.com/wg-easy/wg-easy

First, export your existing config, then replace your compose yaml with:

services:
  adguardhome:
    image: adguard/adguardhome
    ports:
      - 53:53/tcp
      - 53:53/udp
      - 784:784/udp
      - 853:853/tcp
      - 20080:80/tcp
      - 20300:3000
    volumes:
      - /opt/adguardhome/work:/opt/adguardhome/work
      - /opt/adguardhome/conf:/opt/adguardhome/conf
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    networks:
      private_network:
        ipv4_address: 10.2.0.100

  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15
    environment:
      - HOST=0.0.0.0
      - PORT=51821
    volumes:
      - wg_easy_data:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - 3478:3478/udp
      - 51821:51821/tcp
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    networks:
      private_network:
        ipv4_address: 10.2.0.3

volumes:
  wg_easy_data:

networks:
  private_network:
    ipam:
      driver: default
      config:
        - subnet: 10.2.0.0/24

and finally, import your config back.