I’d basically like to run some containers within a VPN and some outside of it. The containers running within the VPN should not be able to send or receive any traffic from outside the VPN (except localhost maybe).
The container could be docker, podman, or even a qemu VM or some other solution if need be.
Is that possible? Dunno if this is the right place to ask.
—Resolution-------
Use https://github.com/qdm12/gluetun folks.
Easily doable in docker using the
network_mode: "service:VPN_CONTAINER"
configuration (assuming your VPN is running as a container)That works but sucks when you redeploy the Vpn container iirc. I don’t do this anymore.
(Now I just use lxc containers with docker inside, and I’ll set the default gateway of the lxc to another lxc that is a gateway for a VPN network)
It is very doable.
Take a look at https://github.com/qdm12/gluetun - it’s what I use for this.
Perfect, that’s what I was looking for! Thanks dude.
second gluetun, easy to use and configure.
Gluetun, is overkill if you already have a working setup. Your system is able to handle this in a much simple way with built in tools.
You can use
systemd
to restrict some daemon to your your VPN IP. For instance here’s an example of doing that with transmission: override of the default unit by using the following command:systemctl edit transmission-daemon.service
Then type what you need to override:
[Service] IPAddressDeny=any IPAddressAllow=10.0.0.1 # --> your VPN IP here
Another option, might be to restrict it to a single network interface:
[Service] RestrictNetworkInterfaces=wg0 # --> your VPN interface
Save the file and run
systemctl daemon-reload
followed bysystemctl restart transmission-daemon.service
and it should be applied.This is a simple and effective solution that doesn’t require more stuff.
Thanks, great to know! systemd can really do a lot.
You don’t even need full-fledged containers for that btw.
Learn how to script with
ip netns
andveth
.