I have two VPSs, first machine (proxy from now) is for proxy and second machine (dock from now) is docker host. I want to redirect all traffic generated inside a docker container itself over proxy, to not exposure dock machines public IP.
As connection between VPSs is over internet, no local connection, created a tunnel between them by ip tunnel as follows:
ip tunnel add tun10 mode ipip remote x.x.x.x local y.y.y.y dev eth0 ip addr add 192.168.10.1/24 peer 192.168.10.2 dev tun10 ip link set dev tun10 mtu 1492 ip link set dev tun10 up
ip tunnel add tun10 mode ipip remote y.y.y.y local x.x.x.x dev eth0 ip addr add 192.168.10.2/24 peer 192.168.10.1 dev tun10 ip link set dev tun10 mtu 1492 ip link set dev tun10 up
After, added SNAT rules to iptables on both VPSs and some routing rules as follows:
iptables -t nat -A POSTROUTING -s 192.168.10.2/32 -j SNAT --to-source y.y.y.y
iptables -t nat -A POSTROUTING -s 172.27.10.0/24 -j SNAT --to-source 192.168.10.2 ip route add default via 192.168.10.1 dev tun10 table rt2 ip rule add from 192.168.10.2 table rt2
And last but not least created a docker network with one test container attached to it as follows:
docker network create --attachable --opt com.docker.network.bridge.name=br-test --opt com.docker.network.bridge.enable_ip_masquerade=false --subnet=172.27.10.0/24 testnet docker run --network testnet alpine:latest /bin/sh
Unfortunately all these ended with no success. So the question is how to debug that? Is it correct way? How would you do the redirection over proxy?
Some words about theory: Traffic coming from 172.27.10.0/24 subnet hits iptables SNAT rule, source IP changes to 192.168.10.2. By routing rule it routes over tun10 device, it is the tunnel. And hits another iptables SNAT rule that changes IP to y.y.y.y and finally goes to destination.