Multiple Containers for OpenVPN PIA

[Daviid-P]

Hi, would it be possible to create multiple containers for multiple regions?

Something like this (Done on a VM)

docker run -d --name pia_california --cap-add=NET_ADMIN -p 9001:9001/tcp -e REGION="US California" -v /yourpath:/gluetun qmcgaw/gluetun
docker run -d --name pia_vancouver --cap-add=NET_ADMIN -p 9002:9002/tcp -e REGION="CA Vancouver" -v /yourpath:/gluetun qmcgaw/gluetun
docker run -d --name pia_tokyo --cap-add=NET_ADMIN -p 9003:9003/tcp -e REGION="JP Tokyo" -v /yourpath:/gluetun qmcgaw/gluetun

I already have the env variables VPNSP, OPENVPN_USER and OPENVPN_PASSWORD set.

Then from my host machine I can use the VM's IP and 9001, 9002 or 9003 as proxy to connect to the containers?

Also I'm not 100% sure what to do with the -v /yourpath:/gluetun qmcgaw/gluetun part.
I've done docker pull qmcgaw/gluetun but not sure to where that's saved.

Thanks.

[qdm12]

Hi, would it be possible to create multiple containers for multiple regions?

Definitely, that's what I do and it works without issue.

Note that containers are not VMs though 😉

See https://github.com/qdm12/gluetun/wiki/Connect-to-gluetun to connect other Containers or machines to gluetun.

A small tip, you should have separate directories for each region so for example -v /yourpath/uk/gluetun:/gluetun for the UK region, and a different path on your host for another region otherwise it might conflict.

Finally the Docker pull command downloads the docker image (=the gluetun program with dependencies such as openvpn) which you run as a container with the Docker run command. You can also re-pull the image to get updates or use tagged images such as qmcgaw/gluetun:v3.17.0 for more stability (but less features and no updates).

[Daviid-P]

The volume flag part i don't fully understand, I read it's volume=[host-src:]container-dest[:<options>

host-src means I have to have in my CentOS VM a directory called, for example, /regions/uk/gluetun and /regions/jp/gluetun right?

Are those directories empty? Or do I have to do docker pull inside each one?

Thanks again.

[qdm12]

Yes you need to create each directory (empty) with for example

mkdir -p /regions/california-gluetun
mkdir -p /regions/vancouver-gluetun

When running the container, it will write persistent information to them (server information and port forwarded if you use that feature).

docker pull downloads the image to somewhere in /var/docker/, you can list the images you have with docker image ls. You shouldn't interact with data in /var/docker directly though; if you want for example to remove an image use docker image rm qmcgaw/gluetun.
You only need to pull the image once for as many containers you want to run, as it's the same program for all.

Now I noticed you publish ports 9001, 9002 and 9003 but nothing is listening there.
Depending on what you want to connect through the VPN, check this https://github.com/qdm12/gluetun/wiki/Connect-to-gluetun. For example you can connect your phone/other machines using Shadowsocks which listens on port 8388.

You could then have the two commands:

docker run -d --name pia_california --cap-add=NET_ADMIN -e REGION="US California" -v /regions/california-gluetun:/gluetun -p 8388:8388/tcp -p 8388:8388/udp -e SHADOWSOCKS=on qmcgaw/gluetun
docker run -d --name pia_vancouver --cap-add=NET_ADMIN -e REGION="CA Vancouver" -v /regions/vancouver-gluetun:/gluetun -p 8389:8388/tcp -p 8389:8388/udp -e SHADOWSOCKS=on qmcgaw/gluetun

Where you can connect over Shadowsocks to california on port 8388 and to Vancouver on port 8389.

[Daviid-P]

Ok, so this "should" work, right?
docker run -d --name pia_tokyo --cap-add=NET_ADMIN -p 9003:8388/tcp -p 9003:8388/udp -e OPENVPN_USER=xxxxxxxx -e OPENVPN_PASSWORD=xxxxxxxxxxxxxx -e VPNSP="private internet access" -e REGION="JP Tokyo" -e SHADOWSOCKS=on -v /regions/tokyo/gluetun:/gluetun qmcgaw/gluetun

7cfda582dc38 qmcgaw/gluetun "/entrypoint" 5 minutes ago Up 5 minutes (healthy) 8000/tcp, 8888/tcp, 0.0.0.0:9003->8388/tcp, 0.0.0.0:9003->8388/udp, :::9003->8388/tcp, :::9003->8388/udp pia_tokyo

https://i.imgur.com/olspjmH.png

iptables -A FORWARD -i enp0s3 -o docker0 -j ACCEPT
iptables -A FORWARD -i docker0 -o enp0s3 -m state --state RELATED,ESTABLISHED -j ACCEPT

enp0s3 is my VirtualBox bridged adapter, it's IP is 192.168.1.180.

[qdm12]

Yes but your browser cannot use Shadowsocks directly. You can either use a Shadowsocks client and then make your browser connect to the local socks5 port from that shadowsocks client (port 1080 by default), or you can use the http proxy built-in gluetun directly. Again it's all documented in that Wiki page.