Docker: How to give container access to network bridge on host? VPN-over-VPN

Solution 1:

After trying a bunch of things I finally got it to (mostly) work. Turns out ipvlan is not the correct driver and this can be done with macvlan in passthru mode. Here's the relevant excerpt from my docker-compose.yml:

networks:
  main:
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.8.0/24
  vlan:
    driver: macvlan
    driver_opts:
      parent: eno1.9
      macvlan_mode: passthru
    ipam:
      config:
        - subnet: 172.21.9.0/24

I found that I had to name my main network alphabetically before vlan, otherwise mapping ports to other daemons running in the containers didn't work. Also, specifically for openconnect I had to write a custom script to filter the address ranges pushed for split tunnel to exclude the 172.16.0.0/12 range, which caused connections to daemons running inside the container to be routed over the VPN inadvertently.

Another problem was that I couldn't use the USB-Ethernet dongle because the device name enxAABBCCDDEEFF was too long, preventing me from adding the vlan tag. I couldn't find a separate macvlan driver option to specify the tag. I ended up just using the main network interface eno1 and tagging the traffic that way.