Thats great! Overly simplistic explanation, the container is in its own little network and when you connect wireguard inside the container it is punching a hole out to where the wireguard server is located. Without knowing your setup its difficult, but that is probably why your ping is acting as it does. The container doesn’t know how to get to where you’re attempting to ping.

The allowed ips is a list, off the top of my head it accepts single IPs and cidr blocks. 0.0.0.0/0 is the cidr block that essentially means all ipv4 IPs, ::/0 is the same for ipv6. So to answer directly, the , is an or, its for any IP in the list.

Does your wireguard config have ipv6 addresses? If your not using them you can safely remove them.

For example Change AllowedIPs = 0.0.0.0/0, ::/0 To AllowedIPs = 0.0.0.0/0

Also could try adding net.ipv6.conf.all.disable_ipv6=1 in the sysctls section

Multiple edits: I’m terrible with formatting while not on a phone.

More edits: just found out i can expand errors and the compose. Looks like it is the AllowedIPs line in peer1.conf. Just removing , ::/0 as above “should” solve it

Always mullvad for privacy, top tier. Only know you as a number and you can pay physical cash whole os (iirc) & vpn server runs in RAM and is gone on powerloss, the best.

Unless you are trying to get around geo blocks as they publish all their servers, so it’s easier for them to get blocked https://mullvad.net/en/servers.

Or if you are using it constantly, then just go with whoever is cheapest/has the features you like as you are only hiding from your ISP, everyone else still knows.