Using NGINX reverse-proxy to make certain Docker-containers only reachable over WireGuard

That godlike feeling after fixing an issue that’s been bugging you is so glorious! That feeling of total obliviousness when you can’t explain how you did it, is quite the opposite…

So, in my previous post you can see how I had the WireGuard container on a user-defined network named “wireguard” together with the NGINX container.

Now, if you instead connect both to the default bridge network docker automatically creates, it just works…
Everything works, NGINX is reachable through IPv6, the private parts get a 403 from the internet while getting served as expected over WireGuard.

What’s so special about the default bridge network that makes this possible and how do I configure my own network to do the same?

3 Likes