How to use as a router for my LAN

[zane-shus]

I love the look of the features within this container. I have docker running on my server, but not sure what config is required to make this serve to the LAN?

I assume the last part is to change my DHCP to put the IP of my server as the gateway?

[mazzy89]

In the way how the image is made it is not really easy to be used as a router because it is not the purpose of the image. it includes a lot of iptables rules that make not achieve you what you want. I'm forking the project and I'm going to use it in my router.

[ghost]

Please let us know, when your fork is online. I'm highly interested in using this image in a router-environment as well.

[mazzy89]

I've successfully deployed it and used the container at this state to forward all the traffic of my LAN through it.

In my case I've deployed the NordVPN container in a RPI4 which receives the traffic of my LAN having CIDR block 192.168.72.0/28 to the eth0 interface of my RPI4.

It's important you define for the NordVPN container the NETWORK env variable with your LAN CIDR. In my case the IP above.

Then it is necessary to forward all the traffic coming from the LAN through the container.

In this case I had to play a bit with Linux firewall and routing tools.

Install iproute2 package in your router.

Create a new route table under /etc/iproute2/rf_tables appending 2 nordlynx

Then run the commands:

ip rule add from 192.168.72.0/28 table nordlynx
ip route add default via 172.17.0.4 table nordlynx

where 172.17.0.4 is the IP of the Docker container. In your case might be different.

then it's time to play with iptables rule

iptables -A INPUT -s 192.168.72.0/28 -j ACCEPT
iptables -A FORWARD -d 192.168.72.0/28 -j ACCEPT
iptables -A FORWARD -s 192.168.72.0/28 -j ACCEPT
iptables -A OUTPUT -d 192.168.72.0/28 -j ACCEPT

At this point all the traffic of your LAN will go through the Docker container and it works.

I could have forked the project and automate this stuff inside the container but to be honest they are just small stuff and I prefer to automate on my side and follow the release of the project.

[trablin45]

Im trying to achieve this directly on a lxc ubuntu container running directly nordvpn client (instead of running on docker) use your guide to setup forwarding but Im having the exact opposite effect. When I boot the container (before connecting nordvpn) my connection is shared through the container ip, no killswitch. But then I connect nordvpn, it works inside the container but no longer shares outside using the container's ip. Can you help me?

[mazzy89]

@bubuntux feel free to integrate this instructions to your README so this won't get lost and people wont' open many issues.

[cmcooper1980]

so I currently am using DockSTARTer and with that some customizations with a docker-compose.override.yml file. In my setup I have pihole unbound and this nordvpn docker containers. Everything is working fine before nordvpn container. I spun up the nordvpn container and now am lost as to how to integrate that with unbound and pihole can you show me an example docker-compose file that would have these all working or if there maybe a better solution?