Swarm-Scoped Macvlan Network Setup for Wyze Bridge

Hey everyone! I just wanted to share a detailed guide on how I set up a swarm-scoped macvlan network (with per-node IP ranges) for running Wyze Bridge in my Docker Swarm. It took a bit of trial and error, but once it all came together, it’s been rock solid, especially with OPNsense handling broadcast relays for Wyze discovery packets.

Note: This guide reflects the approach that worked for me within a Docker Swarm environment. The underlying concepts of macvlan networking, per-node IP management, and broadcast relaying can be distilled down to a single Docker engine setup or adapted to other networking architectures.

Below is an overview that walks through everything from macvlan creation to container deployment, plus a note on how I got broadcasts working across VLANs in OPNsense. Let me know if you have any questions!

Why a Per-Node macvlan Setup?

• Local IP Ranges: Each Docker Swarm node can hand out IPs from its own slice of the subnet. That way, there’s no risk of IP conflicts if containers run on different nodes.
• Broadcast Compatibility: If your router can forward UDP broadcasts (like OPNsense’s UDP Broadcast Relay plugin), you can keep devices on separate VLANs without breaking discovery traffic (for Wyze or other services).

Step 1: Clean Up Old Networks

First, I removed any existing macvlan_local or macvlan_swarm from each node, just to start fresh. You can safely skip this if it’s your first time:

docker network rm macvlan_local 2>/dev/null
docker network rm macvlan_swarm 2>/dev/null

Step 2: Create Local (Config-Only) macvlan Networks on Each Node

On each node, I created a config-only network that defines the unique IP range it should hand out. You can split your subnet by node and role (manager vs. worker). For example:

Manager Node 00 (10.40.0.0/24):

docker network rm macvlan_local 2>/dev/null

docker network create \
  --driver macvlan \
  --subnet=10.40.0.0/21 \
  --ip-range=10.40.0.128/27 \
  --gateway=10.40.0.1 \
  --opt parent=enp6s19 \
  --config-only macvlan_local

Worker Node 00 (10.40.0.0/24):

docker network rm macvlan_local 2>/dev/null

docker network create \
  --driver macvlan \
  --subnet=10.40.0.0/21 \
  --ip-range=10.40.0.160/27 \
  --gateway=10.40.0.1 \
  --opt parent=enp6s19 \
  --config-only macvlan_local

Repeat for every node, adjusting subnet slices as needed.

Step 3: Create the Swarm-Scoped macvlan Network

Once all nodes have their own macvlan_local, I created a single swarm-scoped network (I did this on a manager node):

docker network rm macvlan_swarm 2>/dev/null

docker network create \
  --driver macvlan \
  --scope swarm \
  --config-from macvlan_local \
  --attachable \
  macvlan_swarm

This sets up a global network called macvlan_swarm that references each node’s local IPAM config. Any container that joins macvlan_swarm on a given node automatically gets an IP from that node’s local range.

Example Service: Wyze Bridge

Below is a snippet from my docker-compose.yml (Swarm stack file). I attach the container to macvlan_swarm so it has a VLAN IP, and also to other internal networks for things like Traefik reverse proxying.

wyze-bridge:
  image: mrlt8/wyze-bridge:latest-hw
  ports:
    - 1936:1935
    - 8554:8554
    - 8888:8888
    - 5100:5000
    - 8889:8889
    - 8189:8189/udp
  dns:
    - 10.x.x.x
    - 10.x.x.x
  networks:
    - traefik_net
    - macvlan_swarm
    - net
  environment:
    - WB_IP=10.x.x.x  # Your container IP (or let Docker handle it)
    - WYZE_EMAIL=example@email.com
    - WYZE_PASSWORD=your-password-here
    - API_ID=****
    - API_KEY=****
    - QUALITY=HD120
    - WB_AUTH=False
    - FPS_FIX=true
    - ROTATE_DOOR=True
    - H264_ENC=h264_nvenc
  volumes:
    - /etc/localtime:/etc/localtime:ro
    - type: tmpfs
      target: /dev/shm
      tmpfs:
          size: 4294967296
    - /usr/lib/x86_64-linux-gnu/libnvidia-encode.so.1:/usr/lib/x86_64-linux-gnu/libnvidia-encode.so.1
    - /usr/lib/x86_64-linux-gnu/nvidia:/usr/lib/x86_64-linux-gnu/nvidia
  deploy:
    mode: replicated
    replicas: 1
    placement:
      constraints:
        - node.role == worker
        - node.labels.gpu == true
    labels:
      - "traefik.enable=true"
      # ...plus any other Traefik labels

This setup makes it very easy to scale Wyze Bridge across multiple nodes while keeping each instance on the same VLAN but with distinct IPs.

OPNsense: UDP Broadcast Relay for Wyze Discovery

I’m using OPNsense with the UDP Broadcast Relay plugin to forward Wyze discovery packets (UDP port 32761) between the VLAN that my cameras live on and the VLAN used by the macvlan network. You just need to:

• Install/enable the plugin in OPNsense.
• Add a relay for UDP 32761 (and any other required ports).
• Update firewall rules to allow traffic between the VLANs.

That way, Wyze Bridge can detect and communicate with cameras despite being on a different VLAN.

Verifying

• docker network inspect macvlan_swarm: Confirm "Scope": "swarm" and "ConfigFrom": { "Network": "macvlan_local" }.
• Deploy a test container: It should get an IP from the node’s assigned range.
• Check broadcast: If you’re relaying broadcasts in OPNsense, you should see discovery traffic pass correctly, and Wyze Bridge should detect cameras without issues.

Final Thoughts

This approach has been rock solid for me. Per-node IP management plus a swarm-scoped macvlan network keeps everything tidy and flexible. While this guide is based on my Docker Swarm configuration, the underlying concepts are versatile enough to be applied to a single Docker engine setup or other networking architectures. If anyone runs into snags or has any improvements, please jump in.

Hope this helps someone else as they tackle similar Docker Swarm + VLAN setups with Wyze Bridge. Feel free to fire away with any questions or ideas, and I’m happy to share more about my configuration details if needed.