From 3cb9374b82f053b030afecf371cb5a17eed32757 Mon Sep 17 00:00:00 2001 From: tiyn Date: Tue, 14 Jul 2026 04:21:58 +0200 Subject: [PATCH] VPN/VNC: Linked Up and Expanded wayvnc Entry --- wiki/docker/dyonr_-_qbittorrentvpn.md | 4 +- wiki/docker/qmcgaw_-_gluetun.md | 66 +++++++++++++++++++++++++++ wiki/firefox.md | 1 + wiki/gluetun.md | 21 +++++++++ wiki/linux/openssh.md | 3 ++ wiki/linux/wayvnc.md | 26 ++++++++++- wiki/vnc.md | 28 ++++++++++-- wiki/vpn.md | 8 +++- 8 files changed, 148 insertions(+), 9 deletions(-) create mode 100644 wiki/docker/qmcgaw_-_gluetun.md create mode 100644 wiki/gluetun.md diff --git a/wiki/docker/dyonr_-_qbittorrentvpn.md b/wiki/docker/dyonr_-_qbittorrentvpn.md index 110a0ed..a0c0294 100644 --- a/wiki/docker/dyonr_-_qbittorrentvpn.md +++ b/wiki/docker/dyonr_-_qbittorrentvpn.md @@ -76,8 +76,8 @@ docker run --name qbittorrentvpn \ -v qbittorrentvpn_data:/downloads \ -e "VPN_ENABLED=yes" \ -e "VPN_TYPE=openvpn" \ - -e "VPN_USERNAME=username" \ - -e "VPN_PASSWORD=password" \ + -e "VPN_USERNAME=" \ + -e "VPN_PASSWORD=" \ -e "LAN_NETWORK=192.168.0.0/16" \ --cap-add NET_ADMIN \ --device /dev/net/tun \ diff --git a/wiki/docker/qmcgaw_-_gluetun.md b/wiki/docker/qmcgaw_-_gluetun.md new file mode 100644 index 0000000..40324e4 --- /dev/null +++ b/wiki/docker/qmcgaw_-_gluetun.md @@ -0,0 +1,66 @@ +# qmcgaw – gluetun + +This is a [Docker](/wiki/docker.md) container for a [Gluetun](/wiki/gluetun.md) [VPN](/wiki/vpn.md) +client. +The official container and documentation was made by [qmcgaw](https://github.com/qdm12/gluetun). + +## Setup + +Create the file `rebuild.sh`. +Change the settings according to your needs and run `./rebuild.sh` afterward. + +## Environment-variables + +Set the following variables with the `-e` tag. + +| Name | Usage | Default | +| ------------------------ | -------------------------------------------- | ------- | +| `VPN_SERVICE_PROVIDER` | VPN provider | | +| `VPN_TYPE` | VPN type (`wireguard` or `openvpn`) | | +| `VPN_ENDPOINT_IP` | VPN server IP address | | +| `VPN_ENDPOINT_PORT` | VPN server port | | +| `WIREGUARD_PUBLIC_KEY` | WireGuard server public key | | +| `WIREGUARD_PRIVATE_KEY` | WireGuard client private key | | +| `WIREGUARD_ADDRESSES` | WireGuard client IP address | | +| `HTTPPROXY` | Enable HTTP proxy | `false` | +| `HTTPPROXY_STEALTH` | Hide proxy-related headers | `false` | + +## Ports + +Set the following ports with the `-p` tag. + +| Container Port | Recommended outside port | Protocol | Description | +| -------------- | ------------------------ | -------- | ----------- | +| `8888` | `9050` | TCP | HTTP proxy | + +## Capabilities + +The following Linux capabilities have to be added. + +| Capability | +| ---------- | +| `NET_ADMIN` | + +## rebuild.sh + +```sh +#!/bin/sh +docker stop gluetun +docker rm gluetun +docker pull qmcgaw/gluetun + +docker run --name gluetun \ + --restart unless-stopped \ + --cap-add=NET_ADMIN \ + -e VPN_SERVICE_PROVIDER=custom \ + -e VPN_TYPE=wireguard \ + -e VPN_ENDPOINT_IP="" \ + -e VPN_ENDPOINT_PORT="" \ + -e WIREGUARD_PUBLIC_KEY="" \ + -e WIREGUARD_PRIVATE_KEY="" \ + -e WIREGUARD_ADDRESSES="/32" \ + -e HTTPPROXY=true \ + -e HTTPPROXY_STEALTH=true \ + -p 9050:8888 \ + -d qmcgaw/gluetun +``` diff --git a/wiki/firefox.md b/wiki/firefox.md index 8b9dddf..dc83de6 100644 --- a/wiki/firefox.md +++ b/wiki/firefox.md @@ -37,6 +37,7 @@ The following add-ons increase the security or privacy. lets you separate cookies in different containers on a per site base. With this add-on a proxy can be selected for each container which enables usage of a [VPN](/wiki/vpn.md) that acts as a Proxy like a [OpenVPN Proxy](/wiki/openvpn.md#proxy). + For this software like [Gluetun](/wiki/gluetun.md) can be used. - [I don't care about cookies](https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about-cookies/) is an even faster alternative to Consent-O-Matic. - [Temporary Containers](https://addons.mozilla.org/en-GB/firefox/addon/temporary-containers) opens diff --git a/wiki/gluetun.md b/wiki/gluetun.md new file mode 100644 index 0000000..c1db45f --- /dev/null +++ b/wiki/gluetun.md @@ -0,0 +1,21 @@ +# Gluetun + +[Gluetun](https://github.com/qdm12/gluetun) is a free and open-source Docker-based VPN client. +It supports multiple VPN providers and protocols including [WireGuard](/wiki/wireguard.md) and +[OpenVPN](/wiki/openvpn.md). + +## Setup + +Gluetun can be set up via [Docker](/wiki/docker.md) with the +[qmcgaw image](/wiki/docker/qmcgaw_-_gluetun.md). + +## Usage + +This section addresses the usage of Gluetun. + +### Routing Traffic of Firefox' Containers + +Gluetun routes the network traffic of Docker containers through a VPN tunnel. +It can be used as a gateway for other containers or in combination with [Firefox'](/wiki/firefox.md) +Multi-Account Containers to access selected websites through a VPN without routing all system +traffic through the tunnel. diff --git a/wiki/linux/openssh.md b/wiki/linux/openssh.md index d16a59e..099d5b7 100644 --- a/wiki/linux/openssh.md +++ b/wiki/linux/openssh.md @@ -176,6 +176,9 @@ kill Files that are based on a remote server can be mounted as described in [the corresponding section](#mount-directory-with-sshfs) to set up complete remote development. +This can also be used for tunneling [VNC](/wiki/vnc.md) which is then called +[VNC over SSH](/wiki/vnc.md#vnc-over-ssh). + ### Specify Key Exchange Algorithms It can be useful to specify the key exchange algorithms in the OpenSSH config file `~/.ssh/config`. diff --git a/wiki/linux/wayvnc.md b/wiki/linux/wayvnc.md index 2730114..8ffb043 100644 --- a/wiki/linux/wayvnc.md +++ b/wiki/linux/wayvnc.md @@ -2,8 +2,10 @@ [wayvnc](https://github.com/any1/wayvnc) is a VNC server for [Linux](/wiki/linux.md) systems using [Waylands](/wiki/linux/wayland.md) compositors using wlroots. -To use wayvnc the system with the server has to be on the same network as the client. -This is also explained in the [screen sharing entry](/wiki/screen-sharing.md). +To use wayvnc the client has to be able to reach the server either directly or through an +[SSH tunnel](/wiki/linux/openssh.md#port-tunneling). +It is the default VNC server used on modern [Raspberry Pi OS](/wiki/linux/raspberry_pi.md) +installations. ## Setup @@ -25,3 +27,23 @@ The name of the screen can be retrieved by using ```sh wayvnc --output= --render-cursor ``` + +### Binding to an IP Address + +By default, wayvnc is reachable on the IP address it is bound to. +Usually this is `0.0.0.0` and makes the VNC server on all network interfaces. + +However, binding to `127.0.0.1` exposes the VNC server only on the loopback interface of +[SSH tunnels](/wiki/linux/openssh.md). +This may be useful when using [VNC over SSH](/wiki/vnc.md#vnc-over-ssh). + +When using a systemd user service (for example +`~/.config/systemd/user/wayvnc.service`), the same can be achieved by changing +the `ExecStart` line to + +```ini +ExecStart=/usr/bin/wayvnc 127.0.0.1 +``` + +The server can then be accessed remotely using +[VNC over SSH](/wiki/vnc.md#vnc-over-ssh). diff --git a/wiki/vnc.md b/wiki/vnc.md index 5c94eeb..f773352 100644 --- a/wiki/vnc.md +++ b/wiki/vnc.md @@ -15,12 +15,34 @@ The following is a list of VNC clients. - [AVNC](https://github.com/gujjwal00/avnc) is a VNC client for [Android](/wiki/android.md) devices. -- bvnc is a VNC client for [Linux](/wiki/linux.md). +- TigerVNC is a VNC client for [Linux](/wiki/linux.md). + It is generally started using `vncviewer`. - Vinagre is a VNC client for [Linux](/wiki/linux.md). -- gvnc is a VNC client for [Linux](/wiki/linux.md). + It is, however, a bit older, not well maintained and does not support password authentication. + Therefor, it is not recommended. ## VNC Server The following is a list of VNC server. -- [wayvnc](https://github.com/any1/wayvnc) is a VNC server for [Linux](/wiki/linux.md) systems. +- [wayvnc](/wiki/linux/wayvnc.md) is a VNC server for [Linux](/wiki/linux.md) systems and the + standard VNC program that is used by new [Raspberry Pis](/wiki/linux/raspberry_pi.md). + It is generally started via [systemd](/wiki/linux/systemd.md). + +## VNC over SSH + +Instead of exposing a VNC server to the network it can be accessed through an +[SSH tunnel](/wiki/linux/openssh.md#port-tunneling). + +It is recommended to bind the VNC server only to `127.0.0.1` (for example as explained in the +[wayvnc article](/wiki/linux/wayvnc.md#binding-to-an-ip-address)). +This ensures that the VNC server is only accessible through the SSH tunnel. + +Assuming now the VNC server is bound to `127.0.0.1:5900`, a tunnel can be created from the local +machine to the remote host, making the VNC server available on a local port such as +`localhost:5901`. + +This setup keeps the VNC server inaccessible from the network while all VNC traffic is encrypted by +SSH. +It may also be useful to avoid program-specific VNC authentication, which may limit the +compatibility of [VNC clients](#vnc-clients). diff --git a/wiki/vpn.md b/wiki/vpn.md index 99348c1..049ca3f 100644 --- a/wiki/vpn.md +++ b/wiki/vpn.md @@ -14,6 +14,10 @@ This section lists various VPN implementations. - [OpenVPN](/wiki/openvpn.md) is probably the most well known VPN implementation. - [WireGuard](/wiki/wireguard.md) is a modern, fast and secure implementation of the VPN protocol. - It is free and open-source. + It is free and open-source. - [Global Protect](/wiki/globalprotect.md) is a proprietary VPN that is mostly used by corporation - and learning facilities. + and learning facilities. +- [Gluetun](/wiki/gluetun.md) is a Docker-based VPN client supporting multiple VPN + providers and protocols such as WireGuard and OpenVPN. + It can be combined with [Firefox'](/wiki/firefox.md) Multi-Account Containers to route only + selected browser containers through a VPN while leaving the rest of the traffic unaffected.