VPNs and docker containers reddit / selfhosted ---------------------------------------------------------------------- Laziness2945 · 2023-11-14 18:24 Hello. Im a newbie when it comes to docker, self-hosting and networking. Im setting up a media server. So far i managed to set up all the docker containers i need without issues. What im missing now is only a VPN. As far as i managed to understand, there are two ways i can run a VPN: as a docker container or as a normal system applications. I still havent chosen a VPN, but for the sake of it lets assume it has either a CLI native application (.deb, .rpm etc) and/or the possibility of exporting OpenVPN/WG profiles. At first i tried, just to test, to run via a wireguard config file with Proton VPN. It worked, but now it came the problem: since the network was on the machine and not on docker, i couldnt bind my qbittorent container to it and that is a must. The second issue was that i wasnt using the VPN's DNS service, but my ISP's. Probably all i need is to add a line of text or two in the .conf and thats it, but it is still something i need to figure out. My idea is to run a standalone application outside docker, dont run qbittorent as a docker container but as a .deb and then make it talk to the containers via common folders. Now comes the second problem: directories. Since i have the \*arr suite setup, it needs to manage folders. As long as qbit was a container, all i had to do was set up the correct paths in the compose file, but now i had qbit talking to the actual path (/home/...../media/....) while the containers where seeing another thing (/media/....) so i had to recreate the complete path in its entirety for the containers. It should work, but i have no way of testing it. I know you can run wireguard containers and then route all the containers that need a VPN through that, but it is something i would need to look up and frankly i cant see the benefits of doing it via docker instead of the system's wireguard manager. How do you suggest i go forward? I dont need the absolute best solution, just one that works and is safe (i must bind qbit to the VPN connection, kill switch is not enough) keeping in mind my very limited knowledge so easier is better. If one day i decide to go for something better but for sophisticated, there is always time. ---------------------------------------------------------------------- gh057k33p3r · 2023-11-14 18:36 I run wireguard on my openwrt router, thats also an option, and using the routers dns server. ---------------------------------------------------------------------- Laziness2945 · 2023-11-14 18:39 While i would like to start tweaking things like router DNS and such, i dont have such option. All i can do is locally on the machine. ---------------------------------------------------------------------- Deathmeter · 2023-11-14 18:46 This seems like a needlessly complicated setup. I think running https://github.com/binhex/arch-qbittorrentvpn would be a much better alternative. Is there a reason why you want your BitTorrent client outside docker? ---------------------------------------------------------------------- thekrautboy · 2023-11-14 18:48 Why not ask /r/Wireguard? You probably want to use gluetun to bind your torrent container to the VPN without much effort. ---------------------------------------------------------------------- Powerstream · 2023-11-14 19:40 >I know you can run wireguard containers and then route all the containers that need a VPN through that, but it is something i would need to look up and frankly i cant see the benefits of doing it via docker instead of the system's wireguard manager. This is what I do and the biggest benefit is that if anything happens to the VPN container, then qbittorrent loses any ability to connect. Which prevents it from exposing your actual IP. You can setup a kill switch, but I just find this as a more elegant and full prof way of doing it. Plus if you try to use qbittorrent and can't connect, then you know your VPN is down and you need to look into it. ---------------------------------------------------------------------- Laziness2945 · 2023-11-14 20:05 The main reason would be that by running it as a standalone app it can actually see the VPN connection so i can bind it to it. If i run the VPN outside docker and qbit via docker, all i can bind it to is the docker network which would be up regardless of the VPN's status. ---------------------------------------------------------------------- Laziness2945 · 2023-11-14 20:06 Gluetun is something i have on my radar as an alternative. I asked here, but this post would easily fit at least r/docker and r/wireguard as well. ---------------------------------------------------------------------- Heas_Heartfire · 2023-11-14 20:07 I'm not sure I'm understanding what you are trying to achieve. If it's only qbittorent you want behind a VPN, try qbittorrentvpn, it's crazy easy. If you also want to access your server from outside your lan, try tailscale alongside it. It's pretty easy to setup. ---------------------------------------------------------------------- Laziness2945 · 2023-11-14 20:07 Wouldnt that work just as well if i ran both the VPN and qbit outside docker? ---------------------------------------------------------------------- sarkyscouser · 2023-11-14 20:34 Once you've chosen a VPN take a look at gluetun as a dockerised VPN gateway ---------------------------------------------------------------------- Simplixt · 2023-11-14 20:34 Create 2 virtual machines. One Virtual Machine with OpnSense Firewall, where you setup the ProtonVPN WireGuard connection. One Virtual Machine with your Docker-VM. Connect both machines via a virtual network, and setup the OpnSense- Firewall so that only internet-traffic through the WireGuard-Gateway is allowed. That's the most bullet proofed solution, and so difficult to setup. ---------------------------------------------------------------------- Powerstream · 2023-11-14 21:00 There are ways of doing it, but relies on something else. Like a kill switch or settings that could be mis-configured and not work correctly. If the system can make a connection to the internet in any way, then qbitorrent could find a way to connect. Having the qbitorrent container dependent on the VPN container just makes it impossible for qbitorrent to connect unless the VPN is up and working. I just like this way because there is just no doubt that it works every time. It's also really simple to set up in a docker compose file. Example: networks: vpn_network: services: vpn: (image name, container name, settings etc..) ports: (all the ports used by all containers using VPN) (for example) - 8080:8080 #qbittorent - 9696:9696 #prowlarr networks: - vpn_network torrent: (or any other services like sonarr, etc) (image name, container name, settings etc..) (no ports list) network_mode: service:vpn depends_on: - vpn Just need to have the vpn network made, adding all ports to the VPN service, and adding the "network\_mode" and " depends\_on" into the other services. ---------------------------------------------------------------------- yogi_en · 2023-11-14 22:28 Give qbit container a separate IP ( Mac vlan ) and route that ip through WireGuard ---------------------------------------------------------------------- Buurgess · 2023-11-15 04:18 Are you able to post your Wireguard docker container compose? I had trouble getting it setup to work with the config file I exported from Mullvad. I’m using gluetun for now. ---------------------------------------------------------------------- Powerstream · 2023-11-15 22:06 I use bubuntux/nordvpn with a Nordvpn account, so my setup probably wouldn't be much help. ---------------------------------------------------------------------- Buurgess · 2023-11-16 01:40 I know the one, that’s fair enough. Thank you anyway mate!