This approach uses Docker containers based on Linux kernel. Due to this fact we use one shared Linux server with multiple VPN containers. Then everyone in the company can access the remote system using the shared instances.
I haven`t tested this concept on my Win10 machine, running Linux containers (switching Docker to Linux containers mode). I suppose in the near future will be possible run containers on both platforms simultaneously. Even then I am not sure if the networking stack of Docker on Windows will allow us to run these VPN client containers correctly. I will test it in the future or if anyone else will do I`ll be happy to know the results.
I have created and published the following images:
Each image (VPN) has its own specific configurations related to VPN characteristics. The details can be found on the Docker Hub. There is a description how to configure and run container for each Docker image.
Here, I would like to describe the overall process from the higher perspective. This means my goal is to give you an overview applicable to every single image and omit the image proprietary specifics.
We will use the following schema as a practical example. I hope it will be easier to understand the concept and how to configure the containers.
On the schema we can see the following elements:
- 129.168.0.11 in the central part of the drawing. This is our Docker host. All vpn-client containers will be running here. The host publishes ports in the range between 51121 and 51125. End users will be accessing the IP of the host in combination with a port number. Each port will be linked with a specific container using docker port mapping.
- 172.17.0.2 - 172.17.0.6 are our VPN containers. The VPN client software is running inside these containers. Each container uses its own network adapter. You can see there is a port 3380 mentioned next to the IP inside each container. Every container is listening RDP protocol communication on this port (this is being predetermined inside the provided docker images). And again, docker port mapping wires each container (IP:3380) with a specific docker host port (mentioned in the previous point).
- 81.127.54.46 and 89.101.12.119 are VPN gateways. These are the VPN endpoints where the VPN client containers try to connect to. This can be an IP address or a domain name. And eventually paired with a specific port.
- 192.168.1.25 and 172.16.201.17 are the target remote terminals. These are the destination PCs behind the VPN gateways where the end-users will be redirected. You will access RDP of these elements. This can be seen as a limitation as you can access only one target IP and port. But this limitation is given by design. If you need to access another PCs, you have to enter them from the original endpoint (multihop).
Let`s say you are working on a notebook/workstation with IP 192.168.0.151. You have to enter your customer Customer1 whose VPN gateway has IP address 81.127.54.46 and the VPN gateway is listening on the port 443. The customer is operating Forti VPN so you will use koubek/docker-forticlient docker image. You also know that there is a terminal server 192.168.1.25 within the remote LAN and this will be your RDP target.
And now the magic. You will spin up the container that will do all necessary. This is the basic command you can use to make it work:
docker run `
--name vpn-customer1 `
--privileged `
-p 51121:3380 `
-e "VPNADDR=81.127.54.46:443" `
-e "VPNUSER=[vpn-user-id]" `
-e "VPNPASS=[vpn-pwd]" `
-e "VPNRDPIP=192.168.1.25" `
koubek/docker-forticlientLet`s describe the parameters. We will start with those that are practically common for all images.
- --name is just a container name. You can omit this parameter but I can recommend using it to specify the customer name to identify the container.
- --privileged is mandatory here. VPN containers need some specific (higher) privileges. Probably would be possible to use one the capabilities as well and specify so the minimum required privileges but this is out of the scope of this document (especially because this can vary for each VPN client type).
- -p 51121:3380 is the port mapping mentioned before. This is how we wire the docker host port with the container internal port (which is expecting RDP communication). On the left side, we have the Docker host`s port, on the ride side is the internal port of the container (this is given by each image, I set for all images the same port - 3380). Maybe it worths to say that you need to set up the left part only ;)
The following env parameters (or their names) can vary for each docker image and many of them will be defined by your customers:
- -e "VPNADDR=81.127.54.46:443" is the address of the remote VPN gateway. This information will be given by your customer.
- -e "VPNUSER=[vpn-user-id]" is VPN username. This information will be given by your customer.
- -e "VPNPASS=[vpn-pwd]" is VPN user password. This information will be given by your customer.
- -e "VPNRDPIP=192.168.1.25" is the remote terminal server. You will be redirected right there when running an RDP client. This information will be given by your customer.
Once the container is running you just run your favorite RDP client. There you have to introduce the IP of your Linux docker host, combined with the port that will redirect your RDP communication into the specfic container. In our case is the following information: 129.168.0.11:51121. Then you have to specify the credentials of the remote terminal and you are there :)
Hi,
Can you explain what you did in the VPN images in order to be able to create new containers using forticlient 7 or other VPN software like openvpn and using last version of Ubuntu in windows 11?