{"id":16442298,"url":"https://github.com/nolar/vpn-in-docker-compose","last_synced_at":"2025-03-21T05:30:28.267Z","repository":{"id":44696570,"uuid":"297172305","full_name":"nolar/vpn-in-docker-compose","owner":"nolar","description":"Running VPN with a network lock in Docker Compose","archived":false,"fork":false,"pushed_at":"2022-08-22T17:26:27.000Z","size":302,"stargazers_count":45,"open_issues_count":4,"forks_count":10,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-17T21:42:17.944Z","etag":null,"topics":["docker","docker-compose","firewall","iptables","network-lock","openvpn","openvpn-client","torrent","torrent-client","torrents","transmission","transmission-daemon","vpn","vpn-client"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nolar.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-09-20T22:08:42.000Z","updated_at":"2025-01-03T11:34:04.000Z","dependencies_parsed_at":"2022-09-12T13:40:59.168Z","dependency_job_id":null,"html_url":"https://github.com/nolar/vpn-in-docker-compose","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nolar%2Fvpn-in-docker-compose","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nolar%2Fvpn-in-docker-compose/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nolar%2Fvpn-in-docker-compose/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nolar%2Fvpn-in-docker-compose/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nolar","download_url":"https://codeload.github.com/nolar/vpn-in-docker-compose/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244745615,"owners_count":20503042,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","docker-compose","firewall","iptables","network-lock","openvpn","openvpn-client","torrent","torrent-client","torrents","transmission","transmission-daemon","vpn","vpn-client"],"created_at":"2024-10-11T09:16:55.089Z","updated_at":"2025-03-21T05:30:27.791Z","avatar_url":"https://github.com/nolar.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# VPN-in-Docker with a network lock\n\nIt is organized as a collection of containers, each doing its job:\n\n* **Network** — a shared networking/firewalling namespace for all containers. \n* **OpenVPN** — tunnels the traffic through VPN (openvpn-client).\n* **Firewall** — blocks the untunnelled traffic with a firewall (iptables).\n* **RuleMaker** — generates the firewall rules to be applied atomically.\n* **Status** — monitors the status of the setup and prints it to stdout.\n* **WebView** — publishes the monitor's status via HTTP (static nginx).\n\nAny amount of other containers can be added to run arbitrary application:\n\n* **Transmission** — run securely as a sample application.\n\nAll components are optional and can be disabled. Though, without some of them, the solution makes no sense and will not function (the traffic will be blocked, or the apps will never start).\n\nThe setup does not affect other containers or applications running in the same Docker.\n\nOnly IPv4 addresses and traffic are currently supported. IPv6 is disabled and blocked.\n\n[AirVPN](https://airvpn.org/) is used as a VPN provider, but any other OpenVPN-compatible one can be used (if you have a config file for OpenVPN and know their IP ranges for monitoring/alerting).\n\n\n## Usage\n\nTo start:\n\n```shell script\ndocker-compose build\ndocker-compose up\n```\n\nThen, open:\n\n* http://localhost:9090/\n* http://localhost:9091/\n\nOr download and install [transmission-remote-gui](https://github.com/transmission-remote-gui/transgui) and configure a connection with `localhost` as the hostname.\n\nDownload [Ubuntu via BitTorrent](https://ubuntu.com/download/alternative-downloads) (either server or desktop, any version).\n\nStop with Ctrl+C (docker-compose will stop the containers).\n\nTo clean it up:\n\n```shell script\ndocker-compose down --volumes --remove-orphans\n```\n\n\n## Monitoring\n\nWhen the network is fully secured, you will see this status:\n\n* The VPN's detected country is in green (acceptable).\n* The default next-hop IP address is in green (acceptable).\n* `eth*` interfaces show \"Operation not permitted\".\n* `tun*` interfaces show some pinging and timing.\n\n![](screenshots/protected.png)\n\n---\n\nWhen VPN is down, but the traffic is still secured:\n\n* The VPN's detected country is absent (acceptable).\n* The default next-hop IP address is absent (acceptable).\n* `eth*` interfaces show \"Operation not permitted\".\n* `tun*` interfaces are absent.\n\n![](screenshots/disconnected.png)\n\nTo simulate:\n\n```shell script\ndocker-compose stop openvpn\n```\n\nTo restore:\n\n```shell script\ndocker-compose start openvpn \n```\n\n---\n\nWhen the network is exposed, the status reporting looks like this:\n \n* The VPN's detected country is in red and flashing (compromised).\n* The default next-hop IP address is in red (compromised).\n* `eth*` interfaces show some pinging and timing (they must not).\n* `tun*` interfaces are either absent or show something.\n\n![](screenshots/exposed.png)\n\nTo simulate:\n\n```shell script\ndocker-compose stop openvpn firewall\ndocker-compose exec network iptables -F\ndocker-compose exec network iptables -P INPUT ACCEPT\ndocker-compose exec network iptables -P OUTPUT ACCEPT\n```\n\nTo restore:\n\n```shell script\ndocker-compose start openvpn firewall\n```\n\nPlease note that to expose yourself, you need to do both: configure the firewall to pass the traffic **AND** shut down the VPN connection. As long as the VPN connection is alive, the traffic goes through it even if the firewall is in the permissive mode.\n\n\n## Implementation details\n\n### Shared network container\n\nAll of the containers use the shared network space of a special pseudo-container: it sleeps forever, and is only used as a shared network namespace with iptables.\n\n**Why not Docker networks?** In that case, each container has its own iptables namespace, and so the firewall rules do not apply to all of them equally. With the shared container's network, they all run in the same networking context.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnolar%2Fvpn-in-docker-compose","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnolar%2Fvpn-in-docker-compose","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnolar%2Fvpn-in-docker-compose/lists"}