If my Linux host machine is connected to a VPN, does this mean the containers are also connecting through the VPN? reddit / selfhosted ---------------------------------------------------------------------- Blue-Paws · 2023-12-20 04:20 I would like a docker container running on my Linux server to utilize the VPN connection that the server is already connected to. Does this happen automatically, if not, what needs to be done? ---------------------------------------------------------------------- SparkyGears · 2023-12-20 05:10 Good question, not 100% certsin... I want to say by default "yes" because the docker container's network uses default bridge unless you specify otherwise. In that case the containers don't have any other networking than though their host, so if the host has a full tunnel through the VPN, then your containers would too. There are other docker network types you can set up where this isn't the case. NetworkChuck has a good video on this: https://m.youtube.com/watch?v=bKFMS5C4CG0 ---------------------------------------------------------------------- Famous_Relative2500 · 2023-12-20 05:11 Yes as you only have one physical port out of the machine. The host as an IP address and all your traffic is travelling through that. I'm sure there's a better way to explain that but you're container can't bypass the host address ---------------------------------------------------------------------- tomistruth · 2023-12-20 06:44 Just bind the container to the IP of the vpn interface. Without ip binding your docker container is broadcasting at 0.0.0.0 and accessable via other IPs your server might process. ---------------------------------------------------------------------- Blue-Paws · 2023-12-20 07:59 Thank you ---------------------------------------------------------------------- Blue-Paws · 2023-12-20 08:03 If my container has a public website, would I still be able to reverse proxy the VPN ip address? I'm assuming this won't work because there's no way to port forward. I'm using a VPN client like express or nord. ---------------------------------------------------------------------- Famous_Relative2500 · 2023-12-20 08:17 I do not know. I had to redo my server and on prior one I was using one container with a torrent client and VPN.(can't seem to get it to work now) ​ With Nord, can you do the mesh network? would that be helpful or do others need to access the website? ---------------------------------------------------------------------- joelseph25 · 2023-12-20 08:27 Simple answer is yes. However, if you want to route certain containers over a VPN then I'd recommend having a look at Gluetun ---------------------------------------------------------------------- wplinge1 · 2023-12-20 08:28 > Yes as you only have one physical port out of the machine. The host has an IP address and all your traffic is travelling through that. This isn't always the case. Docker's macvlan network type makes the container a peer to your host instead of subordinate, I'm no VPN expert but I'd expect it to be unaffected unless you explicitly went in and changed its parent. And even outside that a VPN doesn't replace the main IP address AFAIK (it'd break local access, and ultimately that is how you need to send a packet to get it outside your LAN), it just adds more and sets the routing tables to mostly use the secure one instead. I'd expect the defaults to respect a VPN here (certainly if it was up firsst), but would definitely double check. ---------------------------------------------------------------------- cookiengineer · 2023-12-20 08:51 No. It's not 100% certain. Things that might go wrong along the way: - Programs with their own resolv/network stack ignore OS-provided settings, e.g. libnss (Firefox) - DNS resolution might bypass VPN connections, you need to verify avahi daemon not requesting anything as a fallback, and enable DNS over TLS to be sure (which in return should respect the VPN settings as it's TCP). See `/etc/nsswitch.conf` or [the arch wiki entry](https://wiki.archlinux.org/title/avahi) - UDP based protocols might break out, due to how UDP works. This includes QUIC / HTTP/2 and HTTP/3 traffic, so even a "curl" could be at risk. I'd recommend to block UDP, but this might brick torrents (in case you're torrenting). - Multicast DNS is something that a lot of malware utilizes these days, for both DNS exfil operations as well as discovery and lateral movements. Make sure that your avahi daemon is correctly configured. - Even iptables can be avoided if the network protocol doesn't match what the kernel recognizes. From the Docker's guest perspective though, you should be able to maintain the iptables and NAT forwardings on the host and be fine. My recommendation would be to use an eBPF-based tunneling daemon/program, but the available open tools aren't there yet. So next best thing is to use iptables from a non-code perspective. In your specific case, you want to know about [iptables](https://wiki.archlinux.org/title/iptables) and I'd recommend to make shell scripts for connect/disconnect because upon reboot, iptables usually are lost if you haven't integrated them into the systemd service / upstart workflow. As others have already noted, the way I'd recommend to do this for Docker is by using [gluetun](https://github.com/qdm12/gluetun). There's also lots of tutorials on how to do this on medium like [this example](https://medium.com/linux-shots/put-a-docker-container-behind- vpn-fdc0e32c9ca5) ---------------------------------------------------------------------- tubbana · 2023-12-20 09:28 They need to be bound to the TUN interface that the VPN client creates ---------------------------------------------------------------------- bobowhat · 2023-12-20 09:33 This depends. If your VPN does total isolation then no. This is the minority. Most of the time, your system still has a local IP and that is where your reverse proxy is pointing at. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-20 11:50 TLDR, just transparently route all your DNS traffic to your preferred provider, with iptables its pretty simple if you know the ports (port 53 udp) is regular DNS traffic ---------------------------------------------------------------------- DudaDay · 2023-12-20 14:16 >eBPF-based tunneling Phenomenal answer. I've been investigating implementing eBPF via [Cilium](https://cilium.io/use-cases/egress-gateway/) ---------------------------------------------------------------------- Blue-Paws · 2023-12-20 15:14 Thank you so much for the information! ---------------------------------------------------------------------- cookiengineer · 2023-12-20 15:27 Exactly this. For me Cilium was the only way to guarantee that the traffic was routed through. Sadly though, for most network protocol related parsing, you still have to either process everything completely in userspace - or deal with `__always_inline` and pointer- free refactors in eBPF module code. The Linux kernel in particular is very painful when it comes to network protocol APIs and headers. The byte order is 50% of the time in network-byte order or host byte order for whatever reasons :D ---------------------------------------------------------------------- AnalNuts · 2023-12-20 15:34 Lots of answers here already but I’ll suggest a different angle. Ideally you handle all the networking details on your router/switch. Pfsense or Opnsense is my preferred tool. You could just have a rule that routes all traffic for a VM through your VPN. This way you can create policies for various assets on your network and not have to screw around with individual ip table rules or other tweaks on every machine on your network and then worry about keeping them up. ---------------------------------------------------------------------- viscous_continuity · 2023-12-20 16:30 Really love this super technical break down. Thank you man ---------------------------------------------------------------------- glotzerhotze · 2023-12-20 17:09 You should look into routing and how to manipulate your local routing table. Things might be different if you NAT traffic along the way though. ---------------------------------------------------------------------- lilolalu · 2023-12-20 18:05 You want to make sure that your firewall rules are properly set up. Assuming your VPN is your defined gateway, often firewalls have a fallback gateway, which might be your WAN gateway. So in case your VPN fails everything might go through wan. Also it's usually beneficial to do split routing, as you normally don't want everything to go through the VPN but only the necessary services. To remedy this it's useful to give the relevant containers their own fixed IP via MacVLAN and create a rule in your firewall that routes the segment you chose the IPS from through VPN only with no fallback interface. As an imaginary example, choose ip's for the macvlan interfaces of your containers in the segment of 192.168.1.128/28, so from 192.168.1.129 to 192.168.1.142 and create a firewall rule that routes 192.168.1.128/28 over your VPN. If the VPN fails, your containers cannot connect. If you are using wireguard you could take a look at network namespaces, which I THINK could be another solution to the routing problem but I must admit that I haven't had time yet to fully read and understand the documentation https://www.wireguard.com/netns/ ---------------------------------------------------------------------- 5T3V3-0H · 2023-12-20 19:15 If you want your containers to connect through a vpn, try using gluetun. Configure it to use your vpn and any containers that you want to put behind it you would just change the network from bridge/host to container: /gluetun. ---------------------------------------------------------------------- 5T3V3-0H · 2023-12-20 19:16 And you want your reverse proxy to point at gluetun:port number ---------------------------------------------------------------------- Blue-Paws · 2023-12-24 19:59 Thank you! ---------------------------------------------------------------------- Hoopae · 2023-12-26 15:14 Seconding Gluetun and Docker Networks - it's the same containerization idea whether it's an application or a network. I'm using Private Internet Access as my VPN and it works perfectly.