I need to understand how to make two docker containers work with a scenario like this:

There is a branch office with a router and a client. The network is and the addresses are 1 and 57.

There is somewhere else a VM facing on the internet with public IP X.Y.Z.K and the docker environment installed on top. Inside there are two containers. The first one is a web server facing only on a private network with address The other container has connection on the private network with address and exposes its 1194 port on the other network interface to the public IP.

I need to be able to make open the pages on

The VPN part works fine (the router connects and is pingable from the client) and I don't need help on that.

This is a mockup for my docker-compose file.

version: '2'

    image: mycompany/openvpn
    restart: 'always'
      - NET_ADMIN
      - '1194:1194/udp'
          ipv4_address: ''

    image: 'nginx'
    restart: 'always'
      - openvpn:private_net_vpn
        ipv4_address: ''

    internal: true
        - subnet: ''

Scenario described before

  • What image of openvpn are you using ? Did you tried the web proxy method described here hub.docker.com/r/dperson/openvpn-client
    – vx3r
    Sep 9 '19 at 6:55
  • If you look closely to the scheme in the image you could see that the docker container for the VPN is a server, not a client. I don't think that image would work for me. Sep 9 '19 at 7:25
  • ok, do you have this entry in push 'route' in your openvpn server configuration file ?
    – vx3r
    Sep 9 '19 at 7:51
  • Yes, I do. can ping the VPN server as well. Moreover, the VPN server can ping Sep 9 '19 at 13:11
  • can you traceroute web server from vpn client ? also try to curl, ping may be blocked on container
    – vx3r
    Sep 10 '19 at 1:15

At the end I discovered the issue.

By default if you define a network internal: true it means that some iptables rules will be enacted to block all the containers on the lan segment from getting out of it.

At the beginning I thought it was just the route from, let's say, to (the ip assigned to the host machine for that lan segment) and then to the internet. Reading carefully all the iptables rules I found that the forwarding is also disabled.

Removing the internal: true allowed the container to route through the VPN as expected at the cost of allowing the web server to access directly the public internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.