[SOLVED] Docker exposed port stops working when connected to a VPN

Docker exposed port stops working when connected to a VPN

I'm trying to create a Docker image which will forward a port through a VPN. I've created a simple image which exposes port 5144, and tested that it works properly:

sudo docker run -t -d -p 5144:5144 \
                --name le-bridge \
                --cap-add=NET_ADMIN \
                --device=/dev/net/tun \
                bridge
sudo docker exec -it le-bridge /bin/bash

I check that the port is exposed correctly like this:

[CONTAINER] root@6116787b1c1e:~# nc -lvvp 5144
[HOST] user$ nc -vv 127.0.0.1 5144

Then, whatever I type is correctly echoed in the container's terminal. However, as soon as I start the openvpn daemon, this doesn't work anymore:

[CONTAINER] root@6116787b1c1e:~# openvpn logger.ovpn &
[1] 33
Sun Apr  5 22:52:54 2020 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019
Sun Apr  5 22:52:54 2020 library versions: OpenSSL 1.1.1  11 Sep 2018, LZO 2.08
Sun Apr  5 22:52:54 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]
Sun Apr  5 22:52:54 2020 UDPv4 link local (bound): [AF_INET][undef]:1194
Sun Apr  5 22:52:54 2020 UDPv4 link remote: 
Sun Apr  5 22:52:54 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Apr  5 22:52:55 2020 [] Peer Connection Initiated with [AF_INET]
Sun Apr  5 22:53:21 2020 TUN/TAP device tun0 opened
Sun Apr  5 22:53:21 2020 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sun Apr  5 22:53:21 2020 /sbin/ip link set dev tun0 up mtu 1500
Sun Apr  5 22:53:21 2020 /sbin/ip addr add dev tun0 10.X.0.2/24 broadcast 10.X.0.255
Sun Apr  5 22:53:21 2020 Initialization Sequence Completed

root@6116787b1c1e:~#
root@6116787b1c1e:~# nc -lvvp 5144
listening on [any] 5144 ...

From here, using the exact same netcat command, I cannot reach the exposed port anymore from the host. What am I missing?

EDIT: It's maybe worth mentioning that after the VPN is started, the connexion still succeeds from the host ; it just never reaches the netcat process inside the container.

Solution

I'm not exactly sure why, but it turns out that routes need to be fixed inside the container. In my case, the following command solves the issue:

ip route add 192.168.0.0/24 via 172.17.42.1 dev eth0

...where 172.17.42.1 is the IP of the docker0 interface on my host. Hopefully this is helpful to someone one day.