Help with specifying interface for docker stack

[WA2FAST]

Currently I'm utilizing gluetun to accomplish this however there's a lot of VPN encryption overhead that inherently slows everything way down utilizing this method. I'd much rather utilize an established VPN I have setup on a separate VLAN on my gateway and simply setup one of the unused interfaces on my Synology on that specific VLAN so all outbound connections from that stack go out via my existing VPN. I just don't know how to cleanly do this, I've read a ton about macvlan and iptables and I feel like everyone has a slightly different approach or need than I do, or perhaps I haven't found the right post yet that "clicks" in my brain with what I'm trying to do. Please help . Thank you in advance!

So it would go something like this:
VLAN1 - 172.16.1.0/24 - Connected to ETH0 on the Synology - This is the "normal" trust VLAN that Synology currently utilizes for everything and is the default gateway for it. This VLAN also goes out through my normal ISP as it's gateway.
VLAN2 - 172.16.2.0/24 - Connected to ETH1 on the Synology - This would be the VLAN that has an established VPN tunnel (via my gateway to VPN provider) that I would simply present to this interface.

I would like to continue to access everything as I do today utilizing VLAN1/ETH0 on the Synology and have my Docker stacks utilize ETH1 which would go outbound using my gateway's established VPN connection over that VLAN (VLAN2).

There has to be an elegant way of doing this... if someone could please just guide me, that would be great. Thank you in advance.

 

[one-eyed-king]

Docker's bridge networks do not allow configuring parent interfaces. They will most likely use the ip of the interface that points to the default gateway.

Sound like Docker's macvlan networks might be the right fit in your situation: Macvlan network driver

You can either create a mavlan network in bridge mode, and bridge it to one of the host interfaces. It would require the switch port to be untagged and configured to the PWID of the vlan.

Or you could create a mavlan network in 802.1Q trunk bridge mode, and bridge it to one of the host interfaces using the vlan id. It would require the switch port to be tagged.

In both cases, I would specify the ip-range argument as cidr range within the vlan subnet. Make sure it is outside the networks dhcp server's range of the subnet, as docker will provide it's own ipam.

Note: in either scenario, the macvlan parent interface (=the host interface) is not allowed to directly communicate with the child interfaces (=the container interfaces) and vice versa. This restriction is enforced by a Linux kernel security restriction.

Some people create additional macvlan child interfaces on their host to at least allow the host to directly communicate with the container. Though, the container must use the introduced macvlan child interfaces ip to communicate with the host. If you google for "macvlan-shim" you will get plenty of blog posts that show how it's done.

Usually there is no need to tinker with iptables.

 

[one-eyed-king]

Any updates?

I am curious if you tried. In case you try, and get stuck, just post it here.