need help with podman containers on vm with vpn reddit / selfhosted ---------------------------------------------------------------------- Zildjian14 · 2023-10-03 01:43 i have a vm that runs mullvad vpn with ufw that has a killswitch set up that denies all traffic not through the mullvad interface. i also have some podman containers on the vm that have a web interface through certain ports. im having an issue where when ufw is enabled i cant access the webpages of those podman containers from my host machine, they also dont seem to have internet access when the vpn is connected. I dont see anything in the firewall rules that would stop them, i assume it has to do with them using podmans default network interface but i cant seem to fix it. Does anyone have any solutions? Thank you ---------------------------------------------------------------------- NikStalwart · 2023-10-03 03:56 If you are using a killswitch you should not be surprised that your web apps are unreachable outside of your VPN. The solution to this is to allow local network addresses in your killswitch/firewall config. Or, better yet, have separate containers for stuff that should be local network and stuff that shold be VPN- focused insofar as possible. ---------------------------------------------------------------------- Zildjian14 · 2023-10-03 04:50 My web apps are reachable outside of the VPN. I'm using mullvad and it has a built in local network setting which allows me to connect to the vm while it's on the VPN. With the firewall disabled but the vpn enabled everything works fine. The problem seems to be the podman containers using their default network which doesnt use the wireguard interface, which the killswitch will kill. So every time the firewall is enabled the containers lose internet access. Local addresses are allowed in my config, and having separate containers won't solve my issue as what I need to access is what also needs to be on the vpn. ---------------------------------------------------------------------- NikStalwart · 2023-10-03 05:29 The natural question is: what is your firewall config like? > The problem seems to be the podman containers using their default network which doesnt use the wireguard interface, which the killswitch will kill. Have you tried attaching the containers to the proper network? In regular docker, you'd do this by first defining a new network object, binding that network to a physical or virtual interface, and then attaching the container to that network. Given that podman is sopposed to be OCI-compatible, something like this should work bu the exact steps might differ. ---------------------------------------------------------------------- Zildjian14 · 2023-10-03 11:08 The firewall config only has a few rules. Denies all incoming and outgoing traffic except to 1 ip, which is vpn server. And fully allow all traffic through wireguard interface. Theres another to allow ash into the machine, and one to allow incoming traffic from host machine. I've also allowed the ports the services run on but that didn't make a difference so I removed them. I've been trying to change the network of the container but I can't figure out how to do it, I always get some generic error that doesn't tell me whats wrong. The closest I've gotten was creating a macvlan with wg interface as network interface, but when I attach it it just says it can't due to a generic netavark error then nothing works.