wfg / docker-openvpn-client

OpenVPN client with killswitch and proxy servers; built on Alpine
MIT License
353 stars 107 forks source link

Socks port filtered on external interface. #85

Open Oxyd76 opened 1 year ago

Oxyd76 commented 1 year ago

Hi! I install image by docker pull. Setup, and it is worked but only on localhost 127.0.0.1 interface of base host. ss -4tlpn:

root@vultr:~# ss -4tlpn
State          Recv-Q         Send-Q                 Local Address:Port                  Peer Address:Port         Process
...
LISTEN         0              4096                         0.0.0.0:4059                       0.0.0.0:*             users:(("docker-proxy",pid=283918,fd=4))

docker ps:

root@vultr:~# docker ps
CONTAINER ID   IMAGE                                COMMAND              CREATED        STATUS                 PORTS                                       NAMES
b987860cab38   ghcr.io/wfg/openvpn-client           "scripts/entry.sh"   7 hours ago    Up 7 hours (healthy)   0.0.0.0:4059->1080/tcp, :::4059->1080/tcp   12.xx.xxx.165Test

Command:

docker run --name 12.xx.xxx.165Test --rm --device=/dev/net/tun --cap-add=NET_ADMIN -v /usr/local/lib/openvpn:/data/vpn -e VPN_CONFIG_FILE=12.xx.xxx.165Test.ovpn -e SOCKS_PROXY_USERNAME=user -e SOCKS_PROXY_PASSWORD=password -e SOCKS_PROXY=yes -e KILL_SWITCH=nftables -e USE_VPN_DNS=yes -e SUBNETS=207.xxx.xxx.3/32 -p 4059:1080 ghcr.io/wfg/openvpn-client

Testing:

curl ifconfig.co/json --no-progress-meter --proxy-user socksuser:password -x socks5h://207.xxx.xxx.3:4059|jq ".ip"` No :-(

On local interface all ok:

curl ifconfig.co/json --no-progress-meter --proxy-user socksuser:password -x socks5h://127.1:4059|jq ".ip"
"12.xx.xxx.165"

nmap test:

nmap -Pn -p 4059 xxx.xxx.103.3
Starting Nmap 7.92 ( https://nmap.org ) at 2022-10-18 17:38 MSK
Nmap scan report for 207.xxx.xxx.3
Host is up.

PORT     STATE    SERVICE
4059/tcp filtered dlms-cosem

Nmap done: 1 IP address (1 host up) scanned in 16.51 seconds

How to fix this problem. All other containers normally expose ports and worked.