Hello selfhosters,

I have two ip routes on my selfhosted server:

  • The first and default one is routing throught my ISP router.
  • The second one is a Wireguard connection that is imported and managed via Network Manager with the below options so it does not interfere with the default route.
sudo nmcli con modify wg ipv4.never-default true
sudo nmcli con modify wg ipv6.never-default true
sudo nmcli con modify wg ipv6.routes '::/0'
sudo nmcli con modify wg ipv6.route-metric 1000

I could test this setup with

curl ifconfig.me // IP from ISP
curl --interface wg ifconfig.me // IP of the VPN

Right now I would like to tell docker to create a bridge network that routes outgoing traffic from that bridge network throught the second (the VPN) route but I am struggling to do it.

I’ve tried to do this

docker network create vpn-net -o com.docker.network.host_ipv4=10.x.y.z // VPN inet obtained via ip addr show

but it does not work.

Do you have any suggestion about it ? Thank you very much!

Edit to provide more context:

Currently, what I am doing is adding network_mode: gluetun to all the containers that need to access to the internet: linkwarden, my arr stacks, qbit, IRC client, etc. This works great but it makes me paranoid because there is no isolation anymore, i.e qbit could access (or at least ping) to linkwarden’s database since they are all in the same VPN network.

Therefore, I want to have more isolation between services: each service has their own bridge network so no other container could access the resources inside that network. I am thinking about running a VPN for each service but that sounds absurd and also there are limit of 5 devices so it is quite annoying to do this.

That’s why I am asking is there anyway to tell docker bridge network to use specific host interface instead. The reason why I don’t run a machine-wide VPN is because for some services, I prefer that they have the highest network speed and doesn’t have to deal with the VPN overhead (like qbit should have their own gluetun container with its own port forwarding).

Same reason why I don’t use a macvlan or ipvlan network, because there is no isolation. Please correct me if I am wrong on this. Thank you :D

  • d00phy@lemmy.worldEnglish
    4·
    13 hours ago

    So I got back to my server, and here’s what I do:

    gluetun settings:

    services:
  gluetun:
*snip*
    ports:
*snip*
      - 8090:8090 # port for qbittorrent
*snip*

    qbittorrent (in the same compose.yml):

      qbittorrent:
    image: linuxserver/qbittorrent:latest
    container_name: qbittorrent
    environment:
*snip*
      - WEBUI_PORT=8090
*snip*
    network_mode: service:gluetun # run on the vpn network
    depends_on:
      gluetun:
        condition: service_healthy
*snip*

    Also, in qbittorrent settings you can bind it to a network device. In my case it’s “tun0.” This same thing can probably be done w/ a docker network in a gluetun container and separate containers that rely on that network being up, but I haven’t looked into it. Right now, I have 2 other services that require VPN, and I’m looking at possibly 1 or 2 more. That’s pretty manageable as a single stack, I think.