r/docker • u/hannes3120 • 4h ago

Multiple VPNs?

Right now I have a docker container with a VPN that provides it's connection to the other services.

I thought about adding a VPN connection on the host system to basically create a multihop over different providers. Would that work?

As far as I understood the one inside the docker should be the "better" one as that's the one that's exposed first and the one on host would only see the VPN-encrypted traffic anyway? How about port forwarding? That should only be necessary on the one inside docker, too - or is there something I'm missing?

What are the disadvantages to do that (other than the lower speed)? Could I actually add risk of exposure if just one of them is compromised?

Or would it be smarter to spin up another docker and route the traffic through that one?

0 Upvotes

33% Upvoted

4 comments sorted by

1

u/christophla 4h ago

Why not just use the host network? But if you need a VPN - especially one that involves other remote hosts - maybe take a look at wireguard (Tailscale makes it easier). You’ll get a CGNAT overlay network that shouldn’t require as much complexity as a traditional vpn.

1

u/hannes3120 3h ago

I already have that. My router enables me to connect to my home network via wireguard.

My main concern for using a VPN on that machine is for anonymity. Right now I have a docker container that routes all traffic through a VPN in country A. I was wondering about the advantages or risks if my whole machine would only connect to the internet through a VPN in country B, so that (in theory) the Server in country B only knows the IP of the Server in country A and the one in Country A that knows my IP has zero idea what IP I'm actually connecting to as that is only known to Server B so that only one of them is compromised it wouldn't be enough to link my IP to whatever content was monitored behind Server B.

1

u/Wojojojo90 2h ago

Just use a multi-hop VPN service then, multi-hop is a supported feature on many VPNs

1

u/WikibearTheReal 4h ago

You can use netbird in the same compose file as the service. Then you have for each service isolated VPN.