2

I want to run all services within Docker containers (including RA and site-to-site VPN) such that all containers except the VPN are not exposed on the public IP, but are reachable on the VPN IP. This would mean an attacker would need to gain VPN access to know what was on the network, let alone attack anything. To the outside the server should appear to be running only a VPN server. I know that I can do this by embedding a VPN client inside each container, but I'd like to be able to use off-the-shelf containers and avoid the CPU+MEM overhead that would entail.

1

I think the most straightforward way to do this would be to use container linking. The exact solution depends on whether your containers that you want to access via this VPN are on different VMs / physical servers or not.

  • If the containers are on the same server
    Essentially you would run your VPN server in it's own container, and link all the other service containers to it. You can then only expose the VPN port on the host machine, but once you are inside the VPN container you'll have access to the other services via docker's container linking private network magic.
  • If the containers are on different servers
    Look into Linking docker containers across multiple hosts - this solution is a little more involved / complicated.
  • They are on different hosts, alas. Different locations too. Currently have an almost working site to site bridge using soft ether as the server software. The vms get dhcp and can ping the VPN server, but can't talk to each other. No vlan tagging, but I wager I'll figure that out. – Arthur Kay Aug 23 '15 at 3:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.