@selfhosted Have a commerical @wireguard vpn on my server. The problem i have is that if i use a docker, it does use the vpn interface with iptables, but if that goes down, the docker still goes through without the vpn interface. I have looked at iptables, but docker makes it own, and bit of a minefield. Any ideas? Thanks
Maybe somebody else will provide more info, but by default docker usually creates a bridge for your containers called docker0 and uses the local system’s routing tables.
You need to figure out how to either create a new docket network that only routes via the VPN or do that for your host as well.
Docker on its own won’t think to look at that interface unless you tie it to it. Assuming you want to listen to both interfaces an external watchdog would be the call. You’d set the watchdog to look for iptables issues and then run commands if it went down (ie to restart iptables and then restart your containers).
IMO the best way to ensure that traffic always goes through a VPN is to use network namespaces. The wireguard website has an article describing the process. In a nutshell, you create a dedicated namespace to put the physical interface in, create the wireguard interface in that namespace, then move the wireguard interface to the root (“normal”) namespace. That way the only way to get traffic out without the VPN is to run a program in that dedicated namespace.
Same here, idc about some of my containers going through VPN (tandoor, gitea, Plex, etc) but my whole arr suite, qbittorrent, and sabnzbd are routed through a gluetun container that uses my protonvpn credentials. Never have to worry about turning my VPN off for gaming or something since the… totally legal research papager aquirerer apps… are all routes through the VPN which changes it’s connection every 4 hours (changes my public IP but also just to make sure none of the containers run into any issues that they can’t figure out without a restart)
Just FYI for anyone else, you don’t need to run the *arrs through a VPN only your torrent client as that’s where your IP gets exposed to the outside world.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
What’s a commercial VPN?
Something like Proton or Mullvad?
@MaggiWuerze @possiblylinux127 yeah.
Maybe somebody else will provide more info, but by default docker usually creates a bridge for your containers called docker0 and uses the local system’s routing tables.
You need to figure out how to either create a new docket network that only routes via the VPN or do that for your host as well.
Docker on its own won’t think to look at that interface unless you tie it to it. Assuming you want to listen to both interfaces an external watchdog would be the call. You’d set the watchdog to look for iptables issues and then run commands if it went down (ie to restart iptables and then restart your containers).
IMO the best way to ensure that traffic always goes through a VPN is to use network namespaces. The wireguard website has an article describing the process. In a nutshell, you create a dedicated namespace to put the physical interface in, create the wireguard interface in that namespace, then move the wireguard interface to the root (“normal”) namespace. That way the only way to get traffic out without the VPN is to run a program in that dedicated namespace.
Check out gluetun, I use this on my server to ensure that all traffic for certain Docker containers goes through a Wireguard VPN.
@unkn0wn can you use this for a gateway for other devices to connect to the servers vpn in my lan?
Kind of?
I’m not sure if this satisfies your use case, and I haven’t personally used this functionality.
This is the way to go.
Same here, idc about some of my containers going through VPN (tandoor, gitea, Plex, etc) but my whole arr suite, qbittorrent, and sabnzbd are routed through a gluetun container that uses my protonvpn credentials. Never have to worry about turning my VPN off for gaming or something since the… totally legal research papager aquirerer apps… are all routes through the VPN which changes it’s connection every 4 hours (changes my public IP but also just to make sure none of the containers run into any issues that they can’t figure out without a restart)
Just FYI for anyone else, you don’t need to run the *arrs through a VPN only your torrent client as that’s where your IP gets exposed to the outside world.
It depends on where you are. In my county, the most popular trackers are blocked.
@selfhosted @wireguard i am surpised this is not mentioned more.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
3 acronyms in this thread; the most compressed thread commented on today has 11 acronyms.
[Thread #482 for this sub, first seen 4th Feb 2024, 17:15] [FAQ] [Full list] [Contact] [Source code]