Docker Desktop for Mac provides several networking features to make it easier to use. Features VPN Passthrough. Docker Desktop for Mac’s networking can work when attached to a VPN. To do this, Docker Desktop for Mac intercepts traffic from the containers and injects it into Mac as if it originated from the Docker application.
Once you've signed up and signed in to Docker Hub, get Docker Desktop for Mac. It's got everything you'll need to run Docker in one Mac-friendly installer. Your Mac needs to be running Mac OS Sierra or later, and have at least 4GB of RAM.

A docker setup can be very helpful when trying to separate services if they are not packaged otherwise.We don’t only want to separate configuration in this post, but also the network configuration.

Many restricted environments make people need to use VPN servers. There are some VPN providers available for free or paid use but there are also many people who don’t trust these providers.

As docker has its own network stack we can route the traffic from containers. Usually it is difficult to tell a specific process to use only a specific interface. Most of the time a proxy within the Virtual Private Network is used to achieve this. This has also the benefit that, if the network interface does down and the routing rules are reset, then the traffic is not sent though some other default interface.

In this post we take the “proxy idea” to the next level. We will route the traffic of a whole docker container though a specific interface. If the interface goes down then the docker container is not allowed to communicate through any other interface. What is the best auto clicker for mac.

First configure docker such that it does not get into our way in /etc/docker/daemon.json:

Depending on your docker setup you may not need this.

First we create a new docker network such that we can use proper interface names in our configuration and previously installed containers are not affected.

The network create action creates a new interface on the host with 172.18.0.1/16 as subnet. It will be called vpn within docker and Linux.You can validate the settings by checking ip a:

The docker host gets the IP 172.18.0.1.

Next we will create docker contains within the created subnet.

Now lets chroot into the container:

Docker for mac vpn passthrough windows 10

and look at the configuration:

We can also test the connection to the internet with curl -4 ifconfig.co.

The next step is to setup the routes which traffic from 172.18.0.0/16 through a vpn. We use OpenVPN here as it is wildly used. OpenVPN offers a way to setup routes with a --up and --down script. First we tell OpenVPN not to mess with the routing in any way with pull-filter ignore redirect-gateway. Here is a sample OpenVPN config to use with this setup:

The vpn-up.sh script has several parameters.

Pararmeter	Description	Example
`docker_net`	The vpn docker subnet	`172.18.0.0/16`
`local_net`	Some local network you want to route over eth0	`192.168.178.0/24`
`local_gateway`	The gateway of the local network	`192.168.178.1`
`trusted_ip`	Set by OpenVPN to the IP of the OpenVPN endpoint	`11.11.11.11`
`dev`	Set by OpenVPN to OpenVPN interface	`tun0`

Note that eth0 is used here as interface over which OpenVPN makes a connection. Furthermore in my setup a private LAN is behind eth0.

Credits go to 0xacab

Here is the explanation for the rules:

Lines	Explanation
8	Creates a tables for packets coming from the docker `vpn` network
14-15	Resets all the rules coming below by flushing the table
18-19	Route packets to the OpenVPN endpoint over `eth0`
21-22	Route packets coming from the docker `vpn` to the vpn table
27-29	This is a trick by OpenVPN to get highest priority. ¹
34-35	Route packets going to docker network to the docker network

By leaving line 25 commented we only routing traffic from the docker vpn network over the OpenVPN.

The down.sh script removes the $trusted_ip which was added during setup.

Finally, we want to avoid that packets go over over the eth0 interface if the OpenVPN on tun0 is down.

Basically what this script says is that if traffic is coming from vpn and is routed through tun0 then reject it. Traffic between vpn and vpn is allowed. Traffic to and from the local network is also allowed. The last line is needed such that existing connections are accepted.

These rules usually live at /etc/iptables/rules.v4.

Running curl -4 ifconfig.co inside the container should now show the IP you have when tunneling your traffic through the VPN. If the OpenVPN process is stopped then the curl should timeout.

What is DOCKER-USER?

IPtables rules are a bit of a pain with docker. Docker overwrites the iptables configuration when it starts. So if you want to add rules to the FORWARD chain you have to add the rules to DOCKER-USER instead such that they are not overwritten. You can read more about this in the manual. Basically we are acting here like a router. A IPtables rule like iptables -I DOCKER-USER -i src_if -o dst_if -j REJECT describes how packets are allowed to flow. We are restricting this to a flow between vpn ↔ tun0.

Docker For Mac Vpn Passthrough Online

If you want to have a network configuration which does not change you should set 'iptables': false in /etc/docker/daemon.json. That way docker does not touch the IPtables rules. Before doing this I first copied the rules from IPtables when all containers are running. After stopping docker and setting the option to false I started the container again and applied the copied rules manually again.

When researching how to do this I sometimes has to lookup how routing and filtering actually works on Linux. Some tries by myself were based on marking packets coming from a specific process and then rejecting them if they are not flowing where they should. A further naive idea is to use the IPtables owner module with --uid-owner (iptables -m owner --help). This does not work with docker though because packets from docker never go though the INPUT, Routing Decision and OUTPUT chain as seen in the figure below.

Docker For Mac Vpn Passthrough Download

Source: https://askubuntu.com/questions/579231/whats-the-difference-between-prerouting-and-forward-in-iptables

Docker For Mac Vpn Passthrough Extension

The packets from docker only go through PREROUTING, Routing Decision, FORWARD, Routing Decision, POSTROUTING. The best point to filter packets is at the FORWARD/DOCKER-USER chain as we can see from where the packet is coming and where it is going. Filtering by processes only works in the left part of the figure where the concept of Local Processes exists.

Docker For Mac Vpn Passthrough Software

If you are interested in WireGuard yo