I want to run all services within Docker containers (including RA and site-to-site VPN) such that all containers except the VPN are not exposed on the public IP, but are reachable on the VPN IP. This would mean an attacker would need to gain VPN access to know what was on the network, let alone attack anything. To the outside the server should appear to be running only a VPN server. I know that I can do this by embedding a VPN client inside each container, but I'd like to be able to use off-the-shelf containers and avoid the CPU+MEM overhead that would entail.

2 Answers 2


I think the most straightforward way to do this would be to use container linking. The exact solution depends on whether your containers that you want to access via this VPN are on different VMs / physical servers or not.

  • If the containers are on the same server
    Essentially you would run your VPN server in it's own container, and link all the other service containers to it. You can then only expose the VPN port on the host machine, but once you are inside the VPN container you'll have access to the other services via docker's container linking private network magic.
  • If the containers are on different servers
    Look into Linking docker containers across multiple hosts - this solution is a little more involved / complicated.
  • They are on different hosts, alas. Different locations too. Currently have an almost working site to site bridge using soft ether as the server software. The vms get dhcp and can ping the VPN server, but can't talk to each other. No vlan tagging, but I wager I'll figure that out.
    – Arthur Kay
    Commented Aug 23, 2015 at 3:12

Approach the same concept as cloud servers, all server nodes are in private subnets and just build a NAT/VPN gateway to expose your services.

It's complicated to messing around with VPN and dockers just because you have to manually control the iptables rules on each node.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .