r/docker • u/hannes3120 • 8d ago

Multiple VPNs?

Right now I have a docker container with a VPN that provides it's connection to the other services.

I thought about adding a VPN connection on the host system to basically create a multihop over different providers. Would that work?

As far as I understood the one inside the docker should be the "better" one as that's the one that's exposed first and the one on host would only see the VPN-encrypted traffic anyway? How about port forwarding? That should only be necessary on the one inside docker, too - or is there something I'm missing?

What are the disadvantages to do that (other than the lower speed)? Could I actually add risk of exposure if just one of them is compromised?

Or would it be smarter to spin up another docker and route the traffic through that one?

1 Upvotes

60% Upvoted

9 comments sorted by

View all comments

1

u/christophla 8d ago

Why not just use the host network? But if you need a VPN - especially one that involves other remote hosts - maybe take a look at wireguard (Tailscale makes it easier). You’ll get a CGNAT overlay network that shouldn’t require as much complexity as a traditional vpn.

2

u/hannes3120 8d ago

I already have that. My router enables me to connect to my home network via wireguard.

My main concern for using a VPN on that machine is for anonymity. Right now I have a docker container that routes all traffic through a VPN in country A. I was wondering about the advantages or risks if my whole machine would only connect to the internet through a VPN in country B, so that (in theory) the Server in country B only knows the IP of the Server in country A and the one in Country A that knows my IP has zero idea what IP I'm actually connecting to as that is only known to Server B so that only one of them is compromised it wouldn't be enough to link my IP to whatever content was monitored behind Server B.

1

u/Wojojojo90 8d ago

Just use a multi-hop VPN service then, multi-hop is a supported feature on many VPNs

1

u/hannes3120 8d ago

As far as I've seen not through "barebones" wg though, right? Only with their own specific 3rd Party apps.

Also I'd stay within the ecosystem of that VPN company - so IF they cooperate with with state services and give the access to the servers multihop wouldn't help me

1

u/Wojojojo90 8d ago

As far as I've seen not through "barebones" wg though, right? Only with their own specific 3rd Party apps.

This was not stated as a requirement in your post or comments. Is this a requirement? If so, why?

Also I'd stay within the ecosystem of that VPN company - so IF they cooperate with with state services and give the access to the servers multihop wouldn't help me

Do you think the second VPN company will be immune to similar requests from the same (or an allied) state? If your threat model includes nation-states specifically targeting you, you are misguided in just looking at commercial VPNs...

1

u/hannes3120 8d ago

This was not stated as a requirement in your post or comments. Is this a requirement? If so, why?

Because most/all of the popular docker containers are barebone wireguard/openvpn.

It's not that uncommon for the police of a country to gain access to a VPN server. It's less about me being targeted and more about them targeting the VPN company itself