Self-host Lucky
v2.27.2Router toolkit for port forwarding, DDNS, proxying and WOL
docker run -d --name lucky --restart=always --net=host gdy666/lucky- Stars
- 8 270
- Port
- 16601 (Web admin UI (HTTP and HTTPS))
gdy666/luckyWhat is Lucky?
Lucky is an all-in-one networking toolkit aimed at router and homelab users, originally written in Go as a socat replacement for turning public IPv6 into internal IPv4 access. A single binary ships a Vue-based web admin (default port 16601) and bundles TCP/UDP port forwarding, DDNS for dozens of DNS providers, reverse proxying with redirects, STUN-based NAT traversal, Wake-on-LAN with voice-assistant hooks, an internal cron-like scheduler, ACME certificate issuance and renewal, and file services that mount local storage, WebDAV or Aliyun Drive into FTP/WebDAV/FileBrowser endpoints. The full Wanji build (the Docker image is Wanji) adds gRPC reverse proxying, CorazaWAF, rclone, DLNA and a Cloudflare Tunnel client, while the lightweight Lucky build targets resource-poor routers. You install it with a curl/wget one-click script, an OpenWrt IPK package, the gdy666/lucky Docker image (host network recommended), or a tar.gz binary you run with a config-folder flag. Note that source is only published up to v1.4.10 with no plans to continue open-sourcing, and since 2.13.9 external admin access is off by default and the shipped default login must be changed before modules work.
Should you self-host Lucky?
Lucky scores 57/100 on selfhost.directory (how scoring works) and ranks #12 of 20 in Network Utilities. It has 8 270 GitHub stars.
It shipped 5 stable releases in the past year. The latest, v2.27.2, came out on 15 February 2026. New versions land roughly every 3 weeks.
Setup is easy: most people get it running in one sitting. An official Docker image is available. It is MIT-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is MyIP (75/100, 12 239 stars). It scores higher overall, so compare the two before you pick. See Lucky vs MyIP side by side.
Features
- ACME automatic certificates
- Cloudflare Tunnel clientWanji (full) edition only, per the Lucky/Wanji edition comparison.
- Config backup and restore
- Dynamic DNS (DDNS)
- IPv6/IPv4 port forwarding
- Light navigation panelIntroduced as an Alpha/experience version in the v2.27.0 changelog.
- Network storage mounting
- REST API
- Reverse Proxy
- Scheduled Tasks
- Security entrance path
- STUN NAT traversal
- Wake-on-LAN
- Web admin UI
- Web Application FirewallIncluded in the full Wanji edition (the Docker image is Wanji), not the lightweight Lucky build.
Lucky README
FAQ
My config was lost after upgrading OpenWrt.
Back up configs regularly from the bottom of the admin settings page, and prefer the official IPK package to reduce such problems.
I cannot reach the Lucky admin UI, how do I change the admin port?
Change the port on another machine where you can access the admin panel, then copy the modified lucky_base.lkcf file into the target environment.
What is the difference between the Lucky and Wanji (万吉) editions?
Lucky is the lightweight build with the common modules; Wanji is the all-in-one build that adds gRPC reverse proxying, CorazaWAF, rclone, FileBrowser, DLNA and a Cloudflare Tunnel client, and the Docker image is the Wanji build.
What if I forget the admin login password?
Delete the lucky_base.lkcf config file and restart the Lucky process or container; the settings-page data resets while the other modules' data is untouched.
Why does external access to the Lucky admin panel say access from outside the network is forbidden?
Since v2.13.9 the external-access switch is off by default, though external access is allowed for ten minutes after the base config is first created; enable and save the switch within that window, or delete the lucky_base.lkcf file, restart Lucky and enable it within ten minutes.
More in Network Utilities
Maza ad blockingOpen-source, self-hosted local ad blocker written only in Bash: one command rebuilds your hosts file to block ad domains, no browser extensions needed.
MyIPOpen-source, self-hosted IP toolbox: look up IP and geolocation, detect WebRTC and DNS leaks, run speed, MTR, ping and Whois tests, all in one Docker container.
MySpeedSelf-hosted speed test tracking monitors internet connections with configurable retention, cron scheduling, multiple servers, and visualization options.
mystOpen-source GPL-3.0 implementation of a blockchain-based decentralized VPN network: WireGuard transport, provider and consumer modes, plus a browser NodeUI dashboard.
NetProbe_PythonA containerized network monitor that checks connectivity, DNS response times, and bandwidth, then shows results in a dark-themed web dashboard with historical graphs.
netronomeOpen-source, self-hosted network speed testing and monitoring: Speedtest.net, iperf3 and LibreSpeed tests, packet loss and DNS monitors, and server agents.
networking-toolboxSelf-hosted, offline-first toolbox with 100+ networking utilities for IP addressing, subnetting, converting and verifying server configs.
nsupdate.infoSelf-hosted dynamic DNS service using dyndns2 for clients and RFC 2136 for nameservers like BIND and PowerDNS.
OpenSpeedTestSpeedTest by OpenSpeedTest™ is a Free and Open-Source HTML5 Network Performance Estimation Tool Written in Vanilla Javascript and only uses built-in Web APIs like XMLHttpRequest (XHR), HTML, CSS, JS, & SVG. No Third-Party frameworks or libraries are Required. Started in 2011 and moved to OpenSpeedTest.com dedicated Project/Domain Name in 2013.
pia-wireguardSelf-hosted WireGuard VPN client container that routes Docker workloads through a PIA tunnel, with port forwarding, a default-deny kill-switch firewall and healthchecks.
pihole-v6-unboundSelf-hosted Docker image running Pi-hole plus an integrated Unbound recursive resolver in one container, published to Docker Hub and GHCR with weekly rebuilds.
PiVPNSelf-hosted shell-script installer turning a Raspberry Pi or x86_64 Debian/Ubuntu server into a hardened WireGuard or OpenVPN VPN server, managed via the pivpn CLI.
0 comments