I'm kinda new to this Docker thing and I'm interested in getting a biffed up VPS for some containers (websites/data, mysql, nginx, rocket.chat, etc) but I wouldn't like to access them in the wild (even through SSH) and some VPS hosts's console access are plain cumbersome. So, here's my question:

I've got around 3 separate VPS sharing a common network: thru 10. I'd like to know if, in the host ( I can set up a docker server, then, inside I can set up an OpenVPN container (or any other kind of VPN) so I can connect from outside to the other VPSes (,, and so on).

Bear in mind that I'm not looking for a privacy-related VPN, I don't want to route traffic nor go outside with the VPS's IP, I just want to "get inside" the internal network I have shared with my VPS (Vultr in case you're wondering, they have a private IPv4 service only for the VMs in my account so it's safe for them) through a VPN for added security and commodity, so I can access a few hosts naturally (and maybe containers as well?) using SSH/RDP/etc. with a single connection instead of having 10 profiles in PuTTY for each server.

Any pointers would be greatly appreciated. Please also take note I'm a newbie regarding docker, I'm a developer & IT guy so I know my way around, but I don't have much idea about networking so I'm not sure if it's possible - and if it is, then can you please tell me how?


2 Answers 2


I am accessing my home network with a VPN running in a docker container in my home server.

That sounds similar to what you want to do.

Here's how I configured it (using this docker image - note that the documentation of the docker image should be enough)

  1. Use a “convenience” environment variable to store the path to your persistent storage location that will be bind-mounted to the container.

  2. Run an ephemeral instance (–rm) of the image to initialize the data directory of the container (ovpn-host should be the hostname of your openvpn server)

    docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig -u udp://ovpn-host
  3. Run an interactive ephemeral instance of the image to generate the opevnpn CA certificate and server key (you will have to type your passphrase for the private key)

    docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn ovpn_initpki
  4. Run the VPN service: start and detach the container (-d) and map a host port to the UDP container port where the openvpn server process is listening (1194). In this example the host port will be 1195

    docker run -v $OVPN_DATA:/etc/openvpn -d -p 1195:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
  5. Generate client configuration (i.e., add a user to the VPN). If you omit the nopass option, the client key will be encrypted with a passphrase.

    docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn easyrsa build-client-full vince nopass

The client key will be in ${OVPN_DATA}/pki/private and the certificate in ${OVPN_DATA}/pki/issued

  1. Retrieve the client configuration to a local file:

    docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_getclient vince > vince.ovpn

If you need to add more users, just repeat the last two steps to create a user configuration on the server and retrieve the ovpn file.

  • what if I want to keep openvpn on its own bridge network between the containers I want to access to, but I also need ssh access to the host?
    – jtomasrl
    Aug 20, 2019 at 15:00
  • Would connecting the vpn container to multiple networks work? success.docker.com/article/multiple-docker-networks Aug 22, 2019 at 6:55
  • OP stated that he's not looking for a "privacy related" VPN, which means he doesn't want to route all his traffic through the VPN; what he wants is called a Client-to-Site or Remote Access VPN, where his machine essentially gets a route into the remote LAN(s); in my experience the setup you just illustrated does not accomplish this; I've tested it to not work. There is a) host networking required on the container on the server and b) routes that need to be push, based on the CIDR block of the LAN, but idk how to do it yet
    – Life5ign
    Dec 1, 2023 at 15:39

I just want to "get inside" the internal network I have shared with my VPS [...] using SSH/RDP/etc. with a single connection instead of having 10 profiles in PuTTY for each server.

For what it worth you can achieve that pretty simply using your ssh client as a socks server and configuring your clients (RDP/Browse/Ssh client) to use a localhost: as a socks proxy and then access your inner network. A SSH tunnel is a tunnel as secure as a VPN tunnel; main difference with a VPN is there's no routing involved.

through a VPN for added security and commodity

Forget this idea a VPN is for security, you won't add security to your network with a VPN, that's no more security than a SSH tunnel and usually even less when not properly configured. The commodity point is absolutely valid and a good reason to go this way :)

So clearly you can, I wonder why you want the VPN server to run within docker as this add a routing complexity you should avoid if you're not comfortable with the overall routing involved before.

Anyway the generic scheme for a request would be:

client stations --> client station routing table --> client VPN interface --> VPN host server --> target network

The problem involved is understanding a VPN is made of a tunel AND routing configuration, this needs some configuration to avoid breaking your connection to the VPN server once the tunnel is established (usual caveat is the vpn client setting up a new default route and thus breaking your workstation ability to talk with the VPN server through local gateway).

The VPN client job is to establish the tunnel and then configure your client station routing table to route packets for the destination network through the tunnel interface.

Vincenzo's answer to your question give the methodology to start an openVPN server container so I'll let you start from there but I highly encourage you to read more about the subject to avoid a false sense of security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.