From 7bf35c4863a653cfc1f8b350cb84bd81b7feaeec Mon Sep 17 00:00:00 2001
From: Aykhan Shahsuvarov <aykhan.shahs@gmail.com>
Date: Fri, 17 Jul 2026 19:11:05 +0000
Subject: [PATCH] wg-easy: switch to iptables-nft so wg-quick works on kernel
 6.18+

---
 wg_easy/docker-compose.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/wg_easy/docker-compose.yaml b/wg_easy/docker-compose.yaml
index e0e3020..2f1cbe4 100644
--- a/wg_easy/docker-compose.yaml
+++ b/wg_easy/docker-compose.yaml
@@ -2,6 +2,16 @@ services:
   wg-easy:
     image: ghcr.io/wg-easy/wg-easy:15
     container_name: wg-easy
+    # Kernel 6.18+ dropped the legacy iptables modules; the image defaults to
+    # legacy iptables, so wg-quick's NAT rules fail ("can't initialize iptables
+    # table nat"). Point iptables/ip6tables at the nft backend (which works with
+    # the modern kernel) before running the normal entrypoint.
+    entrypoint:
+      - /bin/sh
+      - -c
+      - ln -sf /usr/sbin/iptables-nft /etc/alternatives/iptables && ln -sf /usr/sbin/ip6tables-nft /etc/alternatives/ip6tables && exec docker-entrypoint.sh "$$@"
+      - --
+    command: ["/usr/bin/dumb-init", "node", "server/index.mjs"]
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
     networks: