Hello all
I’m trying to establish a user service which has to create a wireguard tunnel to get access to company network. The service is created through a derivation of proprietary software using the offical deb-file. The derivation is straight forward:
{
pkgs,
...
}:
pkgs.stdenv.mkDerivation rec {
pname = "banyan-wireguard-service";
version = "3.28.0";
src = pkgs.fetchurl {
url = "https://www.banyanops.com/app/releases/banyanapp_3.28.0_amd64.deb";
hash = "sha256-CZQHeagMFYTPsdsF4QkQ8zlvXIO8AyezxCs1yMz9+l4=";
};
nativeBuildInputs = [
pkgs.dpkg
];
installPhase = ''
mkdir $out
cp -r . $out
'';
}
The service registration in my nix-file looks like this:
systemd.user.services.bwgs = {
enable = true;
wantedBy = [ "multi-user.target" ];
unitConfig = {
Description = "bwgs";
After = [
"network.target"
"network-online.target"
];
};
serviceConfig = {
WorkingDirectory = "${banyan-wireguard-service}/opt/Banyan";
LimitNOFILE = 65536;
Type = "simple";
Restart = "on-failure";
ExecStart = "${banyan-wireguard-service}/opt/Banyan/resources/bin/banyanwgs";
ExecStopPost = "${banyan-wireguard-service}/opt/Banyan/resources/bin/banyanwgs stop-service";
StandardOutput = "journal";
StandardError = "journal";
LogLevelMax = "debug";
Nice = 10;
Environment = [
"BANYAN_DIR=/var/log/banyan"
"com_banyanops_app=banyan-platform"
"com_banyanops_servicename=bwgs"
"com_banyanops_servicetype=visibility"
];
};
};
Other relevant lines in my nix-file are the following:
networking.wireguard.enable = true;
networking.firewall.enable = false; # be sure the firewall is not blocking
environment.systemPackages = with pkgs; [
...
wireguard-tools
...
];
After the service is started the following lines are written to the log:
[2025/12/16 23:11:36 CET] [INFO] (main.StartTunnel:80) BanyanWGS version:3.28.0, StartTunnel interface:wg0 port:8119
[2025/12/16 23:11:36 CET] [INFO] (main.(*excludeDomainStore).RestoreExcDomains:77) config file not present
[2025/12/16 23:11:36 CET] [INFO] (main.(*provider).CreateWg:185) Creating WireGuard device
[2025/12/16 23:11:36 CET] [EROR] (main.createUSWGTun:227) Attempt to create userspace tunnel interface failed, sleep for 5 secs: device name wg0, err operation not permitted
[2025/12/16 23:11:41 CET] [EROR] (main.createUSWGTun:227) Attempt to create userspace tunnel interface failed, sleep for 5 secs: device name wg0, err operation not permitted
[2025/12/16 23:11:46 CET] [EROR] (main.createUSWGTun:227) Attempt to create userspace tunnel interface failed, sleep for 5 secs: device name wg0, err operation not permitted
[2025/12/16 23:11:51 CET] [EROR] (main.createUSWGTun:227) Attempt to create userspace tunnel interface failed, sleep for 5 secs: device name wg0, err operation not permitted
[2025/12/16 23:11:56 CET] [EROR] (main.createUSWGTun:227) Attempt to create userspace tunnel interface failed, sleep for 5 secs: device name wg0, err operation not permitted
[2025/12/16 23:12:01 CET] [INFO] (main.(*provider).lockedCreateWg:239) Tunnel interface creation failed, deviceName wg0, err operation not permitted
[2025/12/16 23:12:01 CET] [EROR] (main.(*provider).CreateWg:189) Failed to create wg0: operation not permitted
My user is member of the following groups:
users
wheel
Does anybody has a hint or knows what’s missing?
Any help is highly appreciated!
cheers,
daprodigy