Container to gluetun connected container communication?

[qdm12]

From @sebtech33

i want something to connect to a container outside the vpn network. i found the variable FIREWALL_OUTBOUND_SUBNETS. i opened this up to my subnet, but as you state in the wiki it would require firewall and routing modifications. what would that be? checked the ip on gluetun and it shows the vpn ip, so what would the reason be for extra routing? i only need local access to containers outside the vpn network and wan access only over the vpn. is there more i need to do or? i only added that variable and have not touched my firewall or routing settings (firewall is pfSense).

i want to have a container (not on the vpn network) connect to a container inside til vpn network. the variable above FIREWALL_OUTBOUND_SUBNETS allowed this to work by putting my internal network in that. by as you state in the wiki

What extra do i need to do "This involves firewall and routing modifications"?

[qdm12]

I'm still not sure what you are trying to do.

What do you mean by vpn network? The gluetun network stack, the gluetun docker network, your LAN or something else?

[sebtech33]

Ok, I'll try my best to explain my setup.

I have gluetun running as a vpn for all my containers (that i want behind the vpn). To get this working I use --network=container:gluetun, and the container connected to that container has network mode set to none. So every container connected like this gets the ip from my vpn provider via gluetun.

So I firstly had a problem with getting the internal containers (the containers in the container:gluetun network aka the vpn network) to talk together, but I found out I needed to use localhost instead of an ip and this worked flawlessly.

So now what I tried to do was connect a container outside of that vpn network to a container inside the vpn container. This did not work.
I found the variable "FIREWALL_OUTBOUND_SUBNETS" and set the value to my local subnet and now a container inside the vpn container could talk to a container outside the vpn network and vice versa.

Now to what I tried to ask.
On your wiki page - https://github.com/qdm12/gluetun/wiki/Environment-variables
under

Firewall and routing > FIREWALL_OUTBOUND_SUBNETS

It says:

Comma separated subnets that Gluetun and the containers sharing its network stack are allowed to access. This involves firewall and routing modifications.

So what I wondering is do I need to setup any routing and/or do any modification on pfsense (my network firewall) since it says "This involves firewall and routing modifications" or is it safe to allow the connection from the vpn network to the internal subnet on my network?

This is the best way i can think of to explain this.

[qdm12]

Ah got it!

So what I wondering is do I need to setup any routing and/or do any modification on pfsense (my network firewall) since it says "This involves firewall and routing modifications" or is it safe to allow the connection from the vpn network to the internal subnet on my network?

No it just means that setting this variable will allow things through the gluetun firewall and do some extra routing configuration for you. No need to do anything. I don't remember exactly why I put this here, I think I will remove it as it can be misleading!

So now what I tried to do was connect a container outside of that vpn network to a container inside the vpn container. This did not work.

There are two situations:

1. You want non-vpn containers to reach containers connected to gluetun. In that case, you can just have gluetun and your non-vpn containers in the same Docker network and access for example gluetun:9876 provided gluetun container name is gluetun
2. You want to reach non-vpn containers from gluetun connected containers. I believe if you run gluetun and non-vpn containers in the same Docker network, you don't need to set FIREWALL_OUTBOUND_SUBNETS and can access them using their Docker ip network. If they're not in the same docker network, then yes, using FIREWALL_OUTBOUND_SUBNETS is the way to add routes to other subnets. Note that for now you have to connect to them using IP addresses and not container names, subscribe to Help: Name resolution from Gluetun or stack sharing container to other containers on network does not work #281 to know when this is possible.

[sebtech33]

No it just means that setting this variable will allow things through the gluetun firewall and do some extra routing configuration for you. No need to do anything. I don't remember exactly why I put this here, I think I will remove it as it can be misleading!

yeah, now i understand more. Just removing the last big about routing and modifications would be fine or adding more description to it would probably be great.
just to ask you cant use just and ip to only have it access one ip or is it the hole subnet?

There are two situations:

You want non-vpn containers to reach containers connected to gluetun. In that case, you can just have gluetun and your non-vpn containers in the same Docker network and access for example gluetun:9876 provided gluetun container name is gluetun
You want to reach non-vpn containers from gluetun connected containers. I believe if you run gluetun and non-vpn containers in the same Docker network, you don't need to set FIREWALL_OUTBOUND_SUBNETS and can access them using their Docker ip network. If they're not in the same docker network, then yes, using FIREWALL_OUTBOUND_SUBNETS is the way to add routes to other subnets. Note that for now you have to connect to them using IP addresses and not container names, subscribe to Help: Name resolution from Gluetun or stack sharing container to other containers on network does not work #281 to know when this is possible.

1. this did not seem to work for me.

2. yeah this is the way that i use now and it works without a problem, was only worried about inbound and outbound traffic on my wan. i use the ip for everything (this is usually how i do tings since i think its easier).

[qdm12]

For 1. I'm quite sure it works I use it all the time, feel free to share your config. you can have a look at https://github.com/qdm12/gluetun/wiki/Port-mapping if that can help you understand how to set it up.

[mattdale77]

I have this same issue I think. I can access vpn containers from non-vpn containers fine. However I cannot access non-vpn containers from vpn ones. In my case prowlarr in the vpn accessing sonarr and radarr. Getting a shell into the container the name resolution seems tempramental but I think that is a different issue as it does not work by IP address. I can work around this by using FIREWALL_OUTBOUND_SUBNETS which solves the problem but do it through a docker network if this were possible.