this post was submitted on 20 Jun 2024
4 points (83.3% liked)

Programming

16971 readers
211 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev

founded 1 year ago
MODERATORS
snowe@programming.dev
Ategon@programming.dev
MaungaHikoi@lemmy.nz
4
Solved: How can containers be forced to use a VPN? (programming.dev)
submitted 2 months ago* (last edited 2 months ago) by onlinepersona@programming.dev to c/programming@programming.dev
6 comments fedilink hide all child comments
 

I'd basically like to run some containers within a VPN and some outside of it. The containers running within the VPN should not be able to send or receive any traffic from outside the VPN (except localhost maybe).

The container could be docker, podman, or even a qemu VM or some other solution if need be.

Is that possible? Dunno if this is the right place to ask.

---Resolution-------

Use https://github.com/qdm12/gluetun folks.

Anti Commercial-AI license

you are viewing a single comment's thread
view the rest of the comments
[–] TCB13@lemmy.world 1 points 2 months ago* (last edited 2 months ago)

Gluetun, is overkill if you already have a working setup. Your system is able to handle this in a much simple way with built in tools.

You can use systemd to restrict some daemon to your your VPN IP. For instance here's an example of doing that with transmission: override of the default unit by using the following command:

systemctl edit transmission-daemon.service

Then type what you need to override:

[Service]
IPAddressDeny=any
IPAddressAllow=10.0.0.1 # --> your VPN IP here

Another option, might be to restrict it to a single network interface:

[Service]
RestrictNetworkInterfaces=wg0 # --> your VPN interface

Save the file and run systemctl daemon-reload followed by systemctl restart transmission-daemon.service and it should be applied.

This is a simple and effective solution that doesn't require more stuff.