VPN/VNC: Linked Up and Expanded wayvnc Entry

2026-07-26 04:21:34 +02:00 · 2026-07-14 04:21:58 +02:00
parent bf323fa75c
commit 3cb9374b82
8 changed files with 148 additions and 9 deletions
--- a/wiki/docker/dyonr_-_qbittorrentvpn.md
+++ b/wiki/docker/dyonr_-_qbittorrentvpn.md
@@ -76,8 +76,8 @@ docker run --name qbittorrentvpn \
        -v qbittorrentvpn_data:/downloads \
        -e "VPN_ENABLED=yes" \
        -e "VPN_TYPE=openvpn" \
-        -e "VPN_USERNAME=username" \
-        -e "VPN_PASSWORD=password" \
+        -e "VPN_USERNAME=<username>" \
+        -e "VPN_PASSWORD=<password>" \
        -e "LAN_NETWORK=192.168.0.0/16" \
        --cap-add NET_ADMIN \
        --device /dev/net/tun \
--- a/wiki/docker/qmcgaw_-_gluetun.md
+++ b/wiki/docker/qmcgaw_-_gluetun.md
@@ -0,0 +1,66 @@
+# qmcgaw – gluetun
+
+This is a [Docker](/wiki/docker.md) container for a [Gluetun](/wiki/gluetun.md) [VPN](/wiki/vpn.md)
+client.
+The official container and documentation was made by [qmcgaw](https://github.com/qdm12/gluetun).
+
+## Setup
+
+Create the file `rebuild.sh`.
+Change the settings according to your needs and run `./rebuild.sh` afterward.
+
+## Environment-variables
+
+Set the following variables with the `-e` tag.
+
+| Name                     | Usage                                        | Default |
+| ------------------------ | -------------------------------------------- | ------- |
+| `VPN_SERVICE_PROVIDER`   | VPN provider                                 |         |
+| `VPN_TYPE`               | VPN type (`wireguard` or `openvpn`)          |         |
+| `VPN_ENDPOINT_IP`        | VPN server IP address                        |         |
+| `VPN_ENDPOINT_PORT`      | VPN server port                              |         |
+| `WIREGUARD_PUBLIC_KEY`   | WireGuard server public key                  |         |
+| `WIREGUARD_PRIVATE_KEY`  | WireGuard client private key                 |         |
+| `WIREGUARD_ADDRESSES`    | WireGuard client IP address                  |         |
+| `HTTPPROXY`              | Enable HTTP proxy                            | `false` |
+| `HTTPPROXY_STEALTH`      | Hide proxy-related headers                   | `false` |
+
+## Ports
+
+Set the following ports with the `-p` tag.
+
+| Container Port | Recommended outside port | Protocol | Description |
+| -------------- | ------------------------ | -------- | ----------- |
+| `8888`         | `9050`                   | TCP      | HTTP proxy  |
+
+## Capabilities
+
+The following Linux capabilities have to be added.
+
+| Capability |
+| ---------- |
+| `NET_ADMIN` |
+
+## rebuild.sh
+
+```sh
+#!/bin/sh
+docker stop gluetun
+docker rm gluetun
+docker pull qmcgaw/gluetun
+
+docker run --name gluetun \
+    --restart unless-stopped \
+    --cap-add=NET_ADMIN \
+    -e VPN_SERVICE_PROVIDER=custom \
+    -e VPN_TYPE=wireguard \
+    -e VPN_ENDPOINT_IP="<server-ip>" \
+    -e VPN_ENDPOINT_PORT="<server-port>" \
+    -e WIREGUARD_PUBLIC_KEY="<public-key>" \
+    -e WIREGUARD_PRIVATE_KEY="<private-key>" \
+    -e WIREGUARD_ADDRESSES="<client-address>/32" \
+    -e HTTPPROXY=true \
+    -e HTTPPROXY_STEALTH=true \
+    -p 9050:8888 \
+    -d qmcgaw/gluetun
+```
--- a/wiki/firefox.md
+++ b/wiki/firefox.md
@@ -37,6 +37,7 @@ The following add-ons increase the security or privacy.
  lets you separate cookies in different containers on a per site base.
  With this add-on a proxy can be selected for each container which enables usage of a 
  [VPN](/wiki/vpn.md) that acts as a Proxy like a [OpenVPN Proxy](/wiki/openvpn.md#proxy).
+  For this software like [Gluetun](/wiki/gluetun.md) can be used.
 - [I don't care about cookies](https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-about-cookies/)
  is an even faster alternative to Consent-O-Matic.
 - [Temporary Containers](https://addons.mozilla.org/en-GB/firefox/addon/temporary-containers) opens 
--- a/wiki/gluetun.md
+++ b/wiki/gluetun.md
@@ -0,0 +1,21 @@
+# Gluetun
+
+[Gluetun](https://github.com/qdm12/gluetun) is a free and open-source Docker-based VPN client.
+It supports multiple VPN providers and protocols including [WireGuard](/wiki/wireguard.md) and
+[OpenVPN](/wiki/openvpn.md).
+
+## Setup
+
+Gluetun can be set up via [Docker](/wiki/docker.md) with the
+[qmcgaw image](/wiki/docker/qmcgaw_-_gluetun.md).
+
+## Usage
+
+This section addresses the usage of Gluetun.
+
+### Routing Traffic of Firefox' Containers
+
+Gluetun routes the network traffic of Docker containers through a VPN tunnel.
+It can be used as a gateway for other containers or in combination with [Firefox'](/wiki/firefox.md)
+Multi-Account Containers to access selected websites through a VPN without routing all system
+traffic through the tunnel.
--- a/wiki/linux/openssh.md
+++ b/wiki/linux/openssh.md
@@ -176,6 +176,9 @@ kill <process-id>
 Files that are based on a remote server can be mounted as described in
 [the corresponding section](#mount-directory-with-sshfs) to set up complete remote development.

+This can also be used for tunneling [VNC](/wiki/vnc.md) which is then called
+[VNC over SSH](/wiki/vnc.md#vnc-over-ssh).
+
 ### Specify Key Exchange Algorithms

 It can be useful to specify the key exchange algorithms in the OpenSSH config file `~/.ssh/config`.
--- a/wiki/linux/wayvnc.md
+++ b/wiki/linux/wayvnc.md
@@ -2,8 +2,10 @@

 [wayvnc](https://github.com/any1/wayvnc) is a VNC server for [Linux](/wiki/linux.md) systems using
 [Waylands](/wiki/linux/wayland.md) compositors using wlroots.
-To use wayvnc the system with the server has to be on the same network as the client.
-This is also explained in the [screen sharing entry](/wiki/screen-sharing.md).
+To use wayvnc the client has to be able to reach the server either directly or through an 
+[SSH tunnel](/wiki/linux/openssh.md#port-tunneling).
+It is the default VNC server used on modern [Raspberry Pi OS](/wiki/linux/raspberry_pi.md)
+installations.

 ## Setup

@@ -25,3 +27,23 @@ The name of the screen can be retrieved by using
 ```sh
 wayvnc <ip> --output=<screen> --render-cursor
 ```
+
+### Binding to an IP Address
+
+By default, wayvnc is reachable on the IP address it is bound to.
+Usually this is `0.0.0.0` and makes the VNC server on all network interfaces.
+
+However, binding to `127.0.0.1` exposes the VNC server only on the loopback interface of
+[SSH tunnels](/wiki/linux/openssh.md).
+This may be useful when using [VNC over SSH](/wiki/vnc.md#vnc-over-ssh).
+
+When using a systemd user service (for example
+`~/.config/systemd/user/wayvnc.service`), the same can be achieved by changing
+the `ExecStart` line to
+
+```ini
+ExecStart=/usr/bin/wayvnc 127.0.0.1
+```
+
+The server can then be accessed remotely using
+[VNC over SSH](/wiki/vnc.md#vnc-over-ssh).
--- a/wiki/vnc.md
+++ b/wiki/vnc.md
@@ -15,12 +15,34 @@ The following is a list of VNC clients.

 - [AVNC](https://github.com/gujjwal00/avnc) is a VNC client for [Android](/wiki/android.md)
  devices.
- bvnc is a VNC client for [Linux](/wiki/linux.md).
+- TigerVNC is a VNC client for [Linux](/wiki/linux.md).
+    It is generally started using `vncviewer`.
 - Vinagre is a VNC client for [Linux](/wiki/linux.md).
- gvnc is a VNC client for [Linux](/wiki/linux.md).
+    It is, however, a bit older, not well maintained and does not support password authentication.
+    Therefor, it is not recommended.

 ## VNC Server

 The following is a list of VNC server.

- [wayvnc](https://github.com/any1/wayvnc) is a VNC server for [Linux](/wiki/linux.md) systems.
+- [wayvnc](/wiki/linux/wayvnc.md) is a VNC server for [Linux](/wiki/linux.md) systems and the
+    standard VNC program that is used by new [Raspberry Pis](/wiki/linux/raspberry_pi.md).
+    It is generally started via [systemd](/wiki/linux/systemd.md).
+
+## VNC over SSH
+
+Instead of exposing a VNC server to the network it can be accessed through an
+[SSH tunnel](/wiki/linux/openssh.md#port-tunneling).
+
+It is recommended to bind the VNC server only to `127.0.0.1` (for example as explained in the
+[wayvnc article](/wiki/linux/wayvnc.md#binding-to-an-ip-address)).
+This ensures that the VNC server is only accessible through the SSH tunnel.
+
+Assuming now the VNC server is bound to `127.0.0.1:5900`, a tunnel can be created from the local
+machine to the remote host, making the VNC server available on a local port such as
+`localhost:5901`.
+
+This setup keeps the VNC server inaccessible from the network while all VNC traffic is encrypted by
+SSH.
+It may also be useful to avoid program-specific VNC authentication, which may limit the
+compatibility of [VNC clients](#vnc-clients).
--- a/wiki/vpn.md
+++ b/wiki/vpn.md
@@ -14,6 +14,10 @@ This section lists various VPN implementations.

 - [OpenVPN](/wiki/openvpn.md) is probably the most well known VPN implementation.
 - [WireGuard](/wiki/wireguard.md) is a modern, fast and secure implementation of the VPN protocol.
-  It is free and open-source.
+    It is free and open-source.
 - [Global Protect](/wiki/globalprotect.md) is a proprietary VPN that is mostly used by corporation
-  and learning facilities.
+    and learning facilities.
+- [Gluetun](/wiki/gluetun.md) is a Docker-based VPN client supporting multiple VPN
+    providers and protocols such as WireGuard and OpenVPN.
+    It can be combined with [Firefox'](/wiki/firefox.md) Multi-Account Containers to route only
+    selected browser containers through a VPN while leaving the rest of the traffic unaffected.