Is it possible to have one docker container which is able to use different interfaces of the host to communicate with the rest of the world?
Let’s say I have 5 public reachable ip’s on a docker host.
“50.1.1.1”, “50.1.1.2”, “50.1.1.3”, “50.1.1.4”, “50.1.1.5”
Now I want to run a proxy server in a docker container which is able to reach the internet with each of the host ips.
My plan is now to create multiple networks ( one for each exit ):
network create 50.1.1.1 --subnet 192.168.0.0/30
network create 50.1.1.2 --subnet 192.168.0.4/30
network create 50.1.1.3 --subnet 192.168.0.8/30
network create 50.1.1.4 --subnet 192.168.0.12/30
network create 50.1.1.5 --subnet 192.168.0.16/30
Then add all networks to the container. And then use iptables rules on the host to route them appropriately:
iptables -t nat -I POSTROUTING -s 192.168.0.0/30 -j SNAT --to-source 50.1.1.1
iptables -t nat -I POSTROUTING -s 192.168.0.4/30 -j SNAT --to-source 50.1.1.2
iptables -t nat -I POSTROUTING -s 192.168.0.8/30 -j SNAT --to-source 50.1.1.3
iptables -t nat -I POSTROUTING -s 192.168.0.12/30 -j SNAT --to-source 50.1.1.4
iptables -t nat -I POSTROUTING -s 192.168.0.16/30 -j SNAT --to-source 50.1.1.5
I most likely miss some network creation parameters, just an idea. Havn’t tried it yet.
a) Is there a way to specifiy a host exit interface for a docker network?
b) Any other ideas to achieve the above without iptables / network creation?
c) Is it possible to specify an interface of the docker container while creating the port mapping, eg.
-p IP:host_port: 'DOCKER_INTERFACE' :container_port
For some specific use cases it’s required to have the incoming network traffic one the same interface as the outgoing.
Thanks!