Show HN: IPsec VPN Server in Docker Container
github.com
github.com
I ask because, in the case where I've only got one VM to bridge into a corporate Intranet, I always want to set that VM up with a network-to-network VPN (instead of just making it a VPN client) in case its network grows from one node to several. But adding a whole extra VPN gateway instance just to serve a "network" of one machine is a pretty high overhead for a small project.
You can run this inside Docker containers with a few extra capabilities (allow tap, allow ioctls) which is probably similar to what you need for other in-container solutions. You can also run it on intranet servers, desktops, phones, etc., and connect everything to a common virtual backplane.
Edit: you can also bridge this to docker0 since it supports Ethernet bridging and run it on a Docker host. We're working on better/cleaner Docker integration but it's all do-able now. Just takes a bit of sysadmin know-how.
One minor comment: while reading through the home page the question I first wanted to see answered was 'how do I control who joins my private network', because the technical FAQ says 'Certificates are used instead of access control lists to permit huge networks. An access control list for a network with millions of devices would become unmanageably large.'
I understand this is the technical implementation, but from a user's perspective it actually is an access control list, as on the web interface it is simply a list of IDs which can be approved or declined.
The VPN space really needed a solution like this, congrats for rocking!
There is also a command line. Try 'sudo zerotier-cli help'.
What is your browser? We have tested on four or five and it works fine on all of them.
It uses the well known open source software SoftEther. I did a Docker image with Wormhole integrated: https://github.com/pjperez/docker-wormhole
[1] https://github.com/hwdsl2/setup-ipsec-vpn#manage-vpn-users
[1] https://github.com/libreswan/libreswan/issues/49#issuecommen...