Gluetun conflicting with other VPN connections

[november781]

I currently have a bit of a odd setup question:

I have 2 sets of containers that both need VPN access but I really don't want both sets of containers going over the same VPN connection.

I have made 2 Gluetun containers with podman, one for each set of containers.

running one Gluetun instance works fine. But the moment I start up the second instance, they start what I can only describe as fighting.

I assume this is because they are both trying to control /dev/net/tun. Is there a way to get this to not happen? like having two different interfaces, one for each container?

below is an example of the quadlet file I'm using to launch one of the containers, the other instance's file is basically the same.

Requires=finscale-caddy.service
After=finscale-caddy.service

[Container]
ContainerName=gluetun
Image=docker.io/qmcgaw/gluetun:latest
Network=media-net.network

AutoUpdate=registry

Environment=VPN_SERVICE_PROVIDER=protonvpn
Environment=VPN_TYPE=wireguard
Environment=WIREGUARD_PRIVATE_KEY={redacted}
Environment=SERVER_COUNTRIES=Canada
Environment=FIREWALL_OUTBOUND_SUBNETS=10.89.0.0/16,100.64.0.0/10

AddCapability=NET_ADMIN NET_RAW
AddDevice=/dev/net/tun:/dev/net/tun

HealthCmd=wget -qO /dev/null --timeout=10 "http://127.0.0.1:9999" || exit 1
HealthInterval=20s
HealthRetries=5
HealthTimeout=10s

# Tells Podman to hold systemd's READY signal until the HealthCmd passes
Notify=healthy

Volume=/mnt/bulk/media-server/config/Gluetun:/gluetun:z

[Service]
Restart=always
# Increases systemd's default 90s timeout to allow time for VPN negotiation and health checks
TimeoutStartSec=180

[Install]
WantedBy=default.target

I'm also interested in getting VPN connectivity working on the host as well. And I see similar behavior to running multiple instances when trying to start a vpn client on the host's desktop.

I have tailscale running on the host machine and that doesn't conflict but trying to start up protonvpn's client on the host machine breaks stuff.

[ghost]

Sorry for not helping at all, but how did you pass other containers/pods through that gluetun? Trying to figure it out with no luck, whereas my docker compose just lists the port on gluetun

[november781]

see #2406 (reply in thread)

Also after you set the Network option, listening ports are registered as belonging to gluetun so my caddyfile looks something like

{
	acme_dns cloudflare {env.CF_API_TOKEN}
}

jellyfin.example.com {
	reverse_proxy jellyfin:8096
}

seerr.example.com {
	reverse_proxy seerr:5055
}

qb.example.com {
	reverse_proxy gluetun:8080
}

prowlarr.example.com {
	reverse_proxy gluetun:9696
}

sonarr.example.com {
	reverse_proxy gluetun:8989
}

radarr.example.com {
	reverse_proxy gluetun:7878
}

Jellyfin and Seer are not networked through gluetun so they can be directly targeted but everything else has Network=container:gluetun set to its all accessed as if it was inside the gluetun container