Attention! Long, but important post!
I got around to spend some more time on this docker image and there are some important - breaking - changes to entrypoint.sh! I changed it to except exactly the same options as the hummingbird client - in fact I am just passing through everything the container is started with (all the parameters behind the image name of the docker run command). Thus there is no need anymore for any environment variables.
That change allows for maximum flexibility for future improvements, of which one is already implemented with this version of the image: the hummingbird client inside the container understands the option
—bypass-vpn
now which can be specified multiple times and must be followed by a full domain name or an IPv4/IPv6 subnet specification of the form <ip address>/<prefix length>
The container will specify a route to the clear net and poke a whole into the netfilter for those addresses.
That allows to make the local network reachable even from inside the VPN container by passing in something like —bypass-vpn 193.168.9.0/24 Check the README.md for more information on how to start the container - especially if you are using IPv6: option—sysctl net.ipv6.conf.all.disable_ipv6=0is required in docker run command to enable tunneling IPv6.
In entrypoint.sh I reset the iptables to all-open before starting the hummingbird client, because I had problems inside the container once the client exited without doing so upfront. Since I personally never used nftables or pf, I have no idea how to do the same with those firewalls. Anybody knowledgeable enough: let me know how and I am amending entrypoint.sh to do so for those as well -
or better, send a merge request! 😉
Generally I recommend using the firewall you are used to and especially the one you are using on the docker host anyway. That produces the least overhead. The firewall-all-open-code in entrypoint.sh is purely optional and there only for my convenience when testing the client by restarting it inside the same container over and over again.
As a side-note: I read through the thread again and found this sentence:
could you elaborate what the problem is you are seeing here? It would probably be easy to add some initial firewall setup for the container allowing for customization even for the input filtering, i.e. doing THAT instead of resetting the firewall in entrypoint.sh to all-open.