565795/amnezia-gateway repository overview

⁠Lightweight multi-arch AmneziaWG tunnel container with 3proxy (SOCKS5+HTTP).

docker run -d --name amnezia-gateway --restart unless-stopped \
  --cap-drop ALL --cap-add NET_ADMIN \
  --device /dev/net/tun:/dev/net/tun \
  --security-opt no-new-privileges:true \
  --sysctl net.ipv4.ip_forward=1 \
  --sysctl net.ipv6.conf.all.forwarding=1 \
  --sysctl net.ipv4.conf.all.src_valid_mark=1 \
  -p 1080:1080 -p 8181:8080 \
  -v $(pwd)/wireguard:/etc/amnezia/amneziawg:ro \
  565795/amnezia-gateway:latest

By default, services inside the container listen on 0.0.0.0 for 1080 (SOCKS5) and 8080 (HTTP, mapped to host 8181). Only published ports are reachable from outside the container.

⁠🛠️ Custom Configuration

Mount your WireGuard/AmneziaWG .conf files:

volumes:
  -v $(pwd)/wireguard:/etc/amnezia/amneziawg:ro

Override the default 3proxy.cfg:

volumes:
  -v $(pwd)/3proxy/3proxy.custom.cfg:/etc/3proxy-ext/3proxy.cfg:ro

⁠⚙️ Environment Variables

⁠⚠️ Security Notice (LAN/WAN)

By default, this container is intended to work as a LAN gateway and listens on 0.0.0.0 for:

• 1080 (SOCKS5)
• 8080 (HTTP proxy, mapped to host 8181)

This is intentional for local‑network usage.

Do not expose these ports to the Internet (WAN).
You must enforce firewall rules to allow access only from trusted LAN subnets and block all WAN access.

Minimum requirement:

• Allow: trusted LAN ranges only
• Deny: all WAN traffic to 1080/tcp and 8181/tcp

If you do not need LAN‑wide access, bind ports to localhost (127.0.0.1) instead.