I created a docker image that connects to my vpn via openvpn. i can confirm that it is working because when i run curl 'https://api.ipify.org?format=json' it returns me the ip address of the vpn.

i want to create a second container that routes external traffic through this vpn container.

What i’ve done:

# create a new network in docker
docker network create vpn-network

# run the vpn container through the network
docker run 
--name vpnc 
--device=/dev/net/tun:/dev/net/tun 
--cap-add=NET_ADMIN 
--net=vpn-network 
-e SYSCTL_NET_IPV4_IP_FORWARD=1 
-d <IMAGE_TAG>

# Connect 2nd container to the network and test it
docker run --net=vpn-network --cap-add=NET_ADMIN -it alpine:latest sh

This is where it doesn’t make sense. the ip route for the vpn container shows me that it is routing all external network traffic via tun0 and internal via docker bridge

# ip route for vpn container
0.0.0.0/1 via 10.100.0.1 dev tun0 
default via 172.20.0.1 dev eth0 
10.100.0.0/24 dev tun0 proto kernel scope link src 10.100.0.2 
128.0.0.0/1 via 10.100.0.1 dev tun0 
172.20.0.0/16 dev eth0 proto kernel scope link src 172.20.0.2 
192.166.246.120 via 172.20.0.1 dev eth0 

but for 2nd container:

default via 172.20.0.1 dev eth0 
172.20.0.0/16 dev eth0 scope link  src 172.20.0.3 

at this point, i’m not sure what i’m missing to get 2nd container to route external traffic to the vpn container, and for internal network to still remain on docker bridge.

Any help is appreciated.