0

I created the following setup:

  • Docker host: machine at home network that runs the docker containers.
    • openvpn - A container that uses openvpn to establish a VPN connection to my vpn provider.
    • nzbget - A container that runs nzbget with a webinterface on port: 6789

The goal here was to let all the traffic of the nzbget container go through the openvpn container. I succeeded doing to by configuring the nzbget container into container mode, see line below

network_mode: "container:openvpn"

While running the two containers without an active VPN session the nzbget webinterface is reachable by <docker-host-ip>:6789. But as soon as the VPN session is established by the openvpn container I cannot reach the nzbget container behind the openvpn container anymore.

I suspect the that routing rules that openvpn adds to the routing table is causing this issue. Below you can see the rules openvpn applies when establishing the vpn connection.

2021-11-18 21:12:08 ROUTE_GATEWAY 172.18.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:12:00:01
2021-11-18 21:12:08 TUN/TAP device tun0 opened
2021-11-18 21:12:08 /sbin/ip link set dev tun0 up mtu 1500
2021-11-18 21:12:08 /sbin/ip link set dev tun0 up
2021-11-18 21:12:08 /sbin/ip addr add dev tun0 10.8.2.2/24
2021-11-18 21:12:08 /sbin/ip route add <vpn-ip-address>/32 via 172.18.0.1
2021-11-18 21:12:08 /sbin/ip route add 0.0.0.0/1 via 10.8.2.1
2021-11-18 21:12:08 /sbin/ip route add 128.0.0.0/1 via 10.8.2.1

I was wondering how to deal with the problem. How to make the nzbget container accessible while its traffic is routed through the openvpn container. I think there might be a way of creating special routing rules that would exclude the traffic for port 6789 from the VPN routing, but because of very limited experience with configuring ip routes I don't know how.

Another solution I thought of was creating an extra docker network for the nzbget container an only use this network to connect to the web interface. But this would require me to publish port 6789 on the nzbget machine again, and this is not allowed when running the nzbget container in network_mode: container.

Do you guys know a way how to solve this issue? Any advise would be appreciated!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.