Skip to content

Make WireGuard listen port (51820/udp) configurable #228

Closed
#366
Closed
Make WireGuard listen port (51820/udp) configurable#228
#366
Labels
enhancementNew feature or request

Description

@utrack
utrack
opened on Dec 25, 2025

Describe the bug

After the remote server is set up with uc machine init <addr> --no-dns --no-caddy, the uncloudd service does not start (see logs in the Additional Context).
I suspect it's an IP pool collision, but the only collision I see (from the ip a below in the Additional Context section) is the br-889d6662af23, which is the uncloud network.

> docker network ls |grep uncloud
889d6662af23   uncloud             bridge    local

How to reproduce

Expected behavior

The daemon should start.

Environment:

  • Uncloud versions:
    • Control (client) node (uc --version): 0.15.1
    • Uncloud daemon (from the server) (uncloudd --version): 0.15.1
  • OS version (uname -a):
    • Client (control node): Linux hal 6.18.2-3-cachyos Great work #1 SMP PREEMPT_DYNAMIC Thu, 18 Dec 2025 18:07:28 +0000 x86_64 GNU/Linux
    • Server: Linux debian-reg-8gb-nbg1-1 6.12.48+deb13-cloud-amd64 Great work #1 SMP PREEMPT_DYNAMIC Debian 6.12.48-1 (2025-09-20) x86_64 GNU/Linu

Additional context

uncloudd logs 

Dec 25 15:55:57 debian-reg-8gb-nbg1-1 systemd[1]: Started uncloud.service - Uncloud machine daemon.
Dec 25 15:55:57 debian-reg-8gb-nbg1-1 uncloudd[3830013]: time="2025-12-25T15:55:57Z" level=warning msg="No HTTP secret provided - generated random secret. This may cause problems with uploads if multiple registries are behind a load-balancer. To provide a shared secret, fill in http.secret in the configuration file or set the REGISTRY_HTT>
Dec 25 15:55:57 debian-reg-8gb-nbg1-1 uncloudd[3830013]: time="2025-12-25T15:55:57Z" level=info msg="redis not configured" go.version=go1.25.1
Dec 25 15:55:57 debian-reg-8gb-nbg1-1 uncloudd[3830013]: time="2025-12-25T15:55:57Z" level=warning msg="Registry does not implement RepositoryRemover. Will not be able to delete repos and tags" go.version=go1.25.1
Dec 25 15:55:57 debian-reg-8gb-nbg1-1 uncloudd[3830013]: INFO  Starting WireGuard network.
Dec 25 15:55:57 debian-reg-8gb-nbg1-1 uncloudd[3830013]: INFO  Found existing WireGuard interface. name=uncloud
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 uncloudd[3830013]: INFO  Docker network configured.
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 uncloudd[3830013]: INFO  Configured WireGuard interface. name=uncloud peers=0
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 uncloudd[3830013]: INFO  Updated addresses of the WireGuard interface. name=uncloud addrs=[fdcc:9810:60af:2e4b:f027:53e4:90bd:db6f/128]
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 uncloudd[3830013]: INFO  Stopping local machine API server.
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 uncloudd[3830013]: INFO  Local machine API server stopped.
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 uncloudd[3830013]: INFO  Stopping local API proxy server.
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 uncloudd[3830013]: INFO  Local API proxy server stopped.
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 uncloudd[3830013]: Error: run cluster controller: configure WireGuard network: set WireGuard link "uncloud" up: address already in use
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 systemd[1]: uncloud.service: Main process exited, code=exited, status=1/FAILURE
Dec 25 15:55:58 debian-reg-8gb-nbg1-1 systemd[1]: uncloud.service: Failed with result 'exit-code'.

ip a result on the server side 

root@debian-reg-8gb-nbg1-1:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 xdpgeneric/id:1201 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 92:00:06:c2:72:32 brd ff:ff:ff:ff:ff:ff
    altname enx920006c27232
    altname enp1s0
    inet <public ip>/32 brd <public ip> scope global dynamic eth0
       valid_lft 64583sec preferred_lft 64583sec
    inet6 <public ip>/64 scope global
       valid_lft forever preferred_lft forever
    inet6 <public ip>/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
5: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 22:9e:4b:1b:61:46 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::209e:4bff:fe1b:6146/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
45: br-395a909866b4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 82:91:3b:f6:2e:18 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.1/16 brd 172.18.255.255 scope global br-395a909866b4
       valid_lft forever preferred_lft forever
    inet6 fe80::8091:3bff:fef6:2e18/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
46: veth31907a0@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-395a909866b4 state UP group default
    link/ether 92:f4:b3:e1:15:fa brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::90f4:b3ff:fee1:15fa/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
286: br-c6c82681e965: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 22:be:2b:9a:42:0e brd ff:ff:ff:ff:ff:ff
    inet 172.20.0.1/16 brd 172.20.255.255 scope global br-c6c82681e965
       valid_lft forever preferred_lft forever
    inet6 fe80::20be:2bff:fe9a:420e/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
289: veth1098b31@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-c6c82681e965 state UP group default
    link/ether ee:d8:1d:b7:8a:54 brd ff:ff:ff:ff:ff:ff link-netnsid 7
    inet6 fe80::ecd8:1dff:feb7:8a54/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
290: vethd1609da@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-c6c82681e965 state UP group default
    link/ether 3a:5c:2e:f5:22:3d brd ff:ff:ff:ff:ff:ff link-netnsid 8
    inet6 fe80::385c:2eff:fef5:223d/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
330: wt0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1280 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none
    inet 100.66.11.242/16 brd 100.66.255.255 scope global wt0
       valid_lft forever preferred_lft forever
363: br-2a43512fc3cc: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether ca:ea:ea:61:be:66 brd ff:ff:ff:ff:ff:ff
    inet 172.19.0.1/16 brd 172.19.255.255 scope global br-2a43512fc3cc
       valid_lft forever preferred_lft forever
    inet6 fe80::c8ea:eaff:fe61:be66/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
372: vethb9cbfbd@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-2a43512fc3cc state UP group default
    link/ether 6e:7d:c7:b1:e1:55 brd ff:ff:ff:ff:ff:ff link-netnsid 3
    inet6 fe80::6c7d:c7ff:feb1:e155/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
386: veth15345cf@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-2a43512fc3cc state UP group default
    link/ether e6:60:cb:b7:dc:45 brd ff:ff:ff:ff:ff:ff link-netnsid 2
    inet6 fe80::e460:cbff:feb7:dc45/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
387: vethde685dc@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-2a43512fc3cc state UP group default
    link/ether c2:70:91:82:f8:6f brd ff:ff:ff:ff:ff:ff link-netnsid 4
    inet6 fe80::c070:91ff:fe82:f86f/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
391: veth1b64b57@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-2a43512fc3cc state UP group default
    link/ether aa:83:1a:35:cc:3f brd ff:ff:ff:ff:ff:ff link-netnsid 6
    inet6 fe80::a883:1aff:fe35:cc3f/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
449: vethf7d3e23@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-2a43512fc3cc state UP group default
    link/ether 76:89:cf:03:08:f0 brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::7489:cfff:fe03:8f0/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
450: vethd3966d9@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-395a909866b4 state UP group default
    link/ether 5e:46:ce:4d:d0:ab brd ff:ff:ff:ff:ff:ff link-netnsid 5
    inet6 fe80::5c46:ceff:fe4d:d0ab/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
451: veth867e90f@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-395a909866b4 state UP group default
    link/ether ca:d8:2a:54:46:89 brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::c8d8:2aff:fe54:4689/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
452: vethd2a9ae7@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-2a43512fc3cc state UP group default
    link/ether f2:41:b3:a2:dc:52 brd ff:ff:ff:ff:ff:ff link-netnsid 5
    inet6 fe80::f041:b3ff:fea2:dc52/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever
453: uncloud: <POINTOPOINT,NOARP> mtu 1420 qdisc noop state DOWN group default
    link/none
    inet6 fdcc:9810:60af:2e4b:f027:53e4:90bd:db6f/128 scope global
       valid_lft forever preferred_lft forever
454: br-889d6662af23: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether f6:3d:3a:a0:b4:6b brd ff:ff:ff:ff:ff:ff
    inet 10.210.0.1/24 brd 10.210.0.255 scope global br-889d6662af23
       valid_lft forever preferred_lft forever

Activity

  1. utrack
    added
    bugSomething isn't working
    on Dec 25, 2025

  2. utrack commented on Dec 25, 2025

    @utrack
    utrack
    on Dec 25, 2025
    Author

    Ah! It probably happens because I already have one Wireguard VPN (wt0) enabled. Is there any way to change the uncloud's wg port?

  3. psviderski commented on Dec 29, 2025

    @psviderski
    psviderski
    on Dec 29, 2025
    Owner

    Right, yeah this is likely the case because you cannot have two different WireGuard interfaces listening on the exact same UDP port which seems to be 51820 (the default uncloud uses) in this case.

    It's not configurable at the moment:

    uncloud/internal/machine/network/wireguard.go

    Line 14 in da3634b

    WireGuardPort = 51820
    and used in a few places that assume it's static. However, the machine WG endpoints shared through the distributed cluster state to configure WG peers on other machines include the port so a different port should automatically be handled there.

    It seems pretty reasonable to extract the WG port into a machine config. The problem is we still don't have one and I haven't figure out how to implement one so that the changes are properly handled in the cluster context, e.g. a WG port change is propagated through the cluster so that other machines update their WG configs to use the new port for the appropriate peer configuration.

    At least we can start with a flag (--wireguard-port/wg-port) for the uc machine init/add commands and don't allow to change it after initialising a machine.

  4. psviderski
    added
    enhancementNew feature or request
    and removed
    bugSomething isn't working
    on Dec 29, 2025
  5. psviderski
    changed the title [-][BUG] set WireGuard link "uncloud" up: address already in use[/-] [+]Make WireGuard listen port (51820/udp) configurable[/+] on Dec 29, 2025

  6. dasunsrule32 commented on May 13, 2026

    @dasunsrule32
    dasunsrule32
    on May 13, 2026
    Contributor

    Let me know if this works: #366.

  7. psviderski
    closed this as completedin #366on May 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions