- After updating to 1.7.4 the Umbrel apps wouldn’t start. (Raspberrypi 5 8GB)
- Doing an Umbrel factory reset and restoring from a backup all the apps worked but Wireguard is stuck on a spinning circle in the “Clients” section.
The container log shows this crash loop: Error: Command failed: wg show wg0 dump Unable to access interface: No such device
What I’ve already tried:
-
Restored UmbrelOS from earlier backup: Uninstalled + manually wiped the Wireguard app-data folder via SSH to clear any corrupted backup configs, and reinstalled wireguard from appstore.
-
system reboot.
-
Ran lsmod | grep wireguard which confirms the module is successfully loaded and running on the host OS.
Since the config is completely fresh and the host kernel module is definitely loaded, what else could be blocking the container from creating the wg0 network interface?
Many thanks in advance 
Hi, thanks for the detailed post and for already trying a clean reinstall.
I looked through the current WireGuard package and the upstream WireGuard Easy code. The wg show wg0 dump message is actually a follow-on error: the Clients page is trying to read wg0 after an earlier startup step failed to bring the interface up.
This looks more closely related to the recent WireGuard Easy v15 update than to an umbrelOS 1.7.4 networking change. v15 now enables IPv6 support, and we’ve seen this exact behavior on Raspberry Pi when the separate IPv6 NAT module wasn’t available. Checking the wireguard module alone wouldn’t catch that.
Before changing anything else, could you run this once over SSH and paste the complete output here?
sudo docker restart wireguard_app_1 >/dev/null && sleep 10 && sudo docker logs --since 1m wireguard_app_1 2>&1
This won’t delete or reset any configuration. It should capture the original wg-quick up wg0 error that occurs before the repeating No such device messages.
If the output specifically says that it can’t initialize the ip6tables nat table, you can try:
sudo modprobe ip6table_nat && sudo docker restart wireguard_app_1
Then reopen WireGuard and check the Clients page again. If the startup log shows a different error, post it here and we’ll use that exact failure for the next step. There’s no need to delete the app data again.
Thank you for your reply. Please find the output from both commands below for your records.
Wireguard screenshot also attached for reference
Thanks in advance
+++++++++++++++++++++++++++++++++++++++
OUTPUT BELOW
umbrel@umbrel:~$ sudo docker restart wireguard_app_1 >/dev/null && sleep 10 && sudo docker logs --since 1m wireguard_app_1 2>&1
[sudo] password for umbrel:
Shutting down
2026-07-14T13:08:28.793Z CMD $ wg-quick down wg0
2026-07-14T13:08:30.247Z Database Migrating database…
wg-easy - https://github.com/wg-easy/wg-easy
====================================================
| wg-easy: v15.3.0 |
| Node: v24.15.0 |
| Platform: linux |
| Arch: arm64 |
2026-07-14T13:08:30.282Z Database Migration complete
2026-07-14T13:08:30.304Z WireGuard Starting WireGuard…
2026-07-14T13:08:30.305Z WireGuard Starting Wireguard Interface wg0…
2026-07-14T13:08:30.308Z WireGuard Saving Config…
Listening on http://0.0.0.0:51821
2026-07-14T13:08:30.370Z WireGuard Config saved successfully.
2026-07-14T13:08:30.371Z CMD $ wg-quick down wg0
2026-07-14T13:08:30.458Z CMD $ wg-quick up wg0
[unhandledRejection] Error: Command failed: wg-quick up wg0
[#] ip link add dev wg0 type wireguard
[#]
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.1/24 dev wg0
[#] ip -6 address add fdcc:ad94:bacf:61a4::cafe:1/112 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE; iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -s fdcc:ad94:bacf:61a4::cafe:0/112 -o eth0 -j MASQUERADE; ip6tables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -A FORWARD -o wg0 -j ACCEPT;
modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.18.34+rpt-rpi-2712
iptables v1.8.11 (legacy): can’t initialize iptables table `nat’: Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
[#] ip link delete dev wg0
at genericNodeError (node:internal/errors:985:15)
at wrappedFn (node:internal/errors:539:14)
at ChildProcess.exithandler (node:child_process:417:12)
at ChildProcess.emit (node:events:509:28)
at maybeClose (node:internal/child_process:1124:16)
at Socket.<anonymous> (node:internal/child_process:481:11)
at Socket.emit (node:events:509:28)
at Pipe.<anonymous> (node:net:350:12) {
code: 3,
killed: false,
signal: null,
cmd: ‘wg-quick up wg0’
}
umbrel@umbrel:~$ sudo modprobe ip6table_nat && sudo docker restart wireguard_app_1
modprobe: FATAL: Module ip6table_nat not found in directory /lib/modules/6.18.34+rpt-rpi-2712
Thanks, this output confirms the cause, and sorry, my earlier modprobe suggestion doesn’t apply to this kernel.
WireGuard is successfully creating and configuring wg0. It only fails afterward when WireGuard Easy tries to apply its firewall rules using the legacy iptables backend.
Your Raspberry Pi is running kernel 6.18, which has moved from the legacy ip_tables modules to nftables. WireGuard Easy 15.3.0 includes the nftables-compatible commands, but currently selects the legacy versions by default.
As a temporary workaround, please run:
sudo docker exec wireguard_app_1 sh -c 'update-alternatives --install /usr/sbin/iptables iptables /usr/sbin/iptables-nft 20 && update-alternatives --install /usr/sbin/ip6tables ip6tables /usr/sbin/ip6tables-nft 20' && sudo docker restart wireguard_app_1
This only changes the firewall backend inside the current WireGuard container. It won’t delete your clients or configuration, and it doesn’t change the host’s iptables settings.
Give the app about 10 seconds to start, then reopen it and check the Clients page. If it still spins, please share the output from:
sudo docker logs --since 1m wireguard_app_1 2>&1
This workaround may need to be reapplied if the app container is recreated or updated. The permanent fix needs to be made in the WireGuard app package so it selects the nftables backend automatically.
Thank you for the quick response and detailed instructions. I can confirm the first command resolved the issue. Additionally, I successfully created a new client via the WireGuard Easy control panel, and it connects perfectly.
Many thanks 
