Chain gluetun docker images

[Foolish1337]

How do you setup two gluetun docker images.

• The first one runs a VPN.
• The second one uses the first one as a network container.

(So what I mean by this is I want to use two VPN connections at the same time, I tried to do it myself but I could not configure the pprof port, which gave me a port binding error on the second container)

How would I accomplish this?

[bnhf]

@Foolish1337

Running one Gluetun VPN inside another Gluetun VPN wouldn't work to my knowledge. Every container based VPN client I've looked at uses NET_ADMIN, which means it has (and needs) special privileges to control portions of the host OS.

If you're actually wanting to run two separate instances of Gluetun, each with their own individual VPN connection, that should be possible. I haven't tried it myself using Gluetun, but I've had multiple OpenVPN servers and clients running concurrently on the same host, each using its own TUN and/or TAP interface.

[tcj-one]

I am also interested in chaining multiple VPNs together. Separate instances of Gluetun work fine, but attempting to route Gluetun 1 through Gluetun 2 results in this error:

2023-08-27T01:49:39Z ERROR [openvpn] Cannot ioctl TUNSETIFF tun0: Resource busy (errno=16)

I assume the problem is more than skin deep. If this problem isn't solvable via docker, it would be great to see it implemented where a single instance of Gluetun will multi-hop internally, with separate configs for VPN 1, VPN 2, etc.

[thueske]

Any news here?

[rodyo]

I am trying to chain together two separate VPNs using Docker Compose. What I've tried so far:

• setup vpn1 as per the docs (works fine), then use network: service:vpn1 for the second one. If both are using Wireguard, you'll first run into conflicting settings (like, both are trying to set up tun0, both will serve the HTTP proxy on the same port, etc.). After dealing with all of that, you'll still get an error along the lines of table 51820: file exists due to conflicting ip rules that I could not easily work around. I'm not sure what happens when one is OpenVPN and the other is WireGuard, but I do remember that it didn't work, either. This route feels like a dead end.

• setup both vpn1 and vpn2 in a separate bridge network with static IPs:

networks:
  vpn-network:
    enable_ipv6: false
    driver: bridge
    ipam:
      config:
        - subnet: 10.0.0.0/24
        
services:
  vpn1:
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    devices:
      - /dev/net/tun:/dev/net/tun
    networks:
      vpn-network:
        ipv4_address: 10.0.0.2
    ...
    
  vpn2:
    image: qmcgaw/gluetun
    container_name: vpn2
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    devices:
      - /dev/net/tun:/dev/net/tun
    networks:
      vpn-network:
        ipv4_address: 10.0.0.3
     ...

Then, use a startup script in vpn2 to set the default route for vpn2 to the IP of vpn1, like so:

ip route del default
ip route add default via 10.0.0.2

which did do something, but not quite enough - the VPN could not initialise itself correctly. Turns out that all traffic from vpn2 seems to be blocked by vpn1: no URLs resolved to IPs, things like ping 8.8.8.8 failed, etc. So, then I tried adjusting iptables in vpn1 like so:

iptables -t nat -A POSTROUTING -s 10.0.0.3 -o tun0 -j MASQUERADE
iptables -A FORWARD -s 10.0.0.3 -o tun0 -j ACCEPT
iptables -A FORWARD -d 10.0.0.3 -i tun0 -j ACCEPT

which allowed me to connect to the VPN provider, and everything worked! 🎉 However, a simple traceroute quickly revealed that traffic wasn't going through both VPNs, and that vpn2 was simply leaking traffic straight to the internet.

I may have misunderstood something (networking is definitely not my forte), but I'm out of ideas for this one.

Either way, my attempts do point in the direction of a deeper issue with how gluetun configures things. It'd be awesome to have some way in supported config to facilitate this kind of setup.

[thueske]

Maybe try https://hub.docker.com/r/linuxserver/wireguard as the second vpn? In my case, I managed to start at least 2x Wireguard without errors. But then I lost out when it came to routing...