This is a NordVPN client docker container that use the recommended NordVPN servers. It makes routing containers' traffic through OpenVPN easy.

Supported Architectures

This image use docker manifest for multi-platform awareness, simply pulling bubuntux/nordvpn should retrieve the correct image for your arch, but you can also pull specific arch images via tags.

Architecture	Tag
Linux x86-64	amd64-latest
ARMv7 32-bit	armv7hf-latest
ARMv8 64-bit	aarch64-latest
Linux x86/i686	i386-latest

How to use this image

This container was designed to be started first to provide a connection to other containers (using --net=container:vpn, see below Starting an NordVPN client instance).

NOTE: More than the basic privileges are needed for NordVPN. With docker 1.2 or newer you can use the --cap-add=NET_ADMIN and --device /dev/net/tun options. Earlier versions, or with fig, and you'll have to run it in privileged mode.

Starting an NordVPN instance

docker run -ti --cap-add=NET_ADMIN --device /dev/net/tun --name vpn \
            -e [email protected] -e PASS=password
            -e COUNRTY=country -e CATEGORY=category \
            -e PROTOCOL=protocol -d bubuntux/nordvpn

Once it's up other containers can be started using it's network connection:

docker run -it --net=container:vpn -d some/docker-container

Local Network access to services connecting to the internet through the VPN.

The environment variable NETWORK must be your local network that you would connect to the server running the docker containers on. Running the following on your docker host should give you the correct network: ip route | awk '!/ (docker0|br-)/ && /src/ {print $1}'

docker run -ti --cap-add=NET_ADMIN --device /dev/net/tun --name vpn \
            -p 8080:80 -e NETWORK=192.168.1.0/24 \ 
            -e [email protected] -e PASS=password -d bubuntux/nordvpn                

Now just create the second container without the -p parameter, only inlcude the --net=container:vpn, the port should be declare in the vpn container.

docker run -ti --rm --net=container:vpn -d bubuntux/riot-web

now the service provided by the second container would be available from the host machine (http://localhost:8080) or anywhere inside the local network (http://192.168.1.xxx:8080).

docker-compose

version: "3"
services:
  vpn:
    image: bubuntux/nordvpn
    container_name: nordvpn
    cap_add:
      - net_admin
    devices:
      - /dev/net/tun
    environment:
      - [email protected]
      - PASS=password
      - COUNRTY=United_States
      - PROTOCOL=UDP
      - CATEGORY=P2P
      - NETWORK=192.168.1.0/24
      - TZ=America/Mexico_City
    ports:
      - 8080:80
    restart: unless-stopped
  
  web:
    image: nginx
    network_mode: service:vpn

ENVIRONMENT VARIABLES

• USER - User for NordVPN account.
• PASS - Password for NordVPN account.
• COUNTRY - Use servers from an specific country (IE United_States, Australia, NZ, Hong Kong, MX, full list).
• CATEGORY - Use servers from an specific category (IE Double_VPN, Standard VPN servers). Allowed categories are:
  • Standard VPN servers Get connected to ultra-fast VPN servers anywhere around the globe to change your IP address and protect your browsing activities.
  • P2P Choose from hundreds of servers optimized for P2P sharing. NordVPN has no bandwidth limits and doesn’t log any of your activity.
  • Dedicated IP servers Order a dedicated IP address, which can only be used by you and will not be shared with any other NordVPN users.
  • Double VPN Send your Internet traffic through two different VPN servers for double encryption. Recommended for the most security-focused.
  • Onion Over VPN For maximum online security and privacy, combine the benefits of NordVPN with the anonymizing powers of the Onion Router.
• PROTOCOL - Specify OpenVPN protocol. Allowed protocols are:
  • UDP
  • TCP
• NETWORK - CIDR networks (IE 192.168.1.0/24), add a route to allows replies once the VPN is up.
• NETWORK6 - CIDR IPv6 networks (IE fe00:d34d:b33f::/64), add a route to allows replies once the VPN is up.
• TZ - Set a timezone (IE EST5EDT, America/Denver, full list)
• GROUPID - Set the GID for the vpn

Issues

If you have any problems with or questions about this image, please contact me through a GitHub issue.