I currently run a Docker container that provides a VPN connection to several other services. I'm considering adding a second VPN connection on the host to create a multihop setup using two different providers. In theory, the container VPN would connect to a server in country A, while the host VPN would connect to a server in country B. The host provider would then only see encrypted traffic from the container VPN, and the container provider would not know which sites or services I ultimately access through the second VPN. Would this routing work as expected? How would port forwarding behave, and would it need to be configured only on the inner Docker VPN? What are the practical disadvantages besides reduced speed, and could chaining the VPNs actually create additional exposure if one provider or machine were compromised? Would running the second VPN in another Docker container be a cleaner approach?
2 Answers
A separate VPN container can be used for each service, and tools such as NetBird can be placed in the same Compose setup to keep the networking isolated. That may be easier to manage than changing the host’s default route, while still letting selected containers use a VPN independently.
If your goal is connecting back to your home network, WireGuard or an overlay network such as Tailscale can avoid much of the complexity of traditional VPN routing. That is separate from your anonymity goal, though: a multihop arrangement needs carefully configured routing and leak protection, and port forwarding depends on which hop accepts inbound connections.
I already use WireGuard for remote access to my home network. The separate VPN question is specifically about anonymity: I’m considering having the container connect through a provider in one country and the host through another, so neither provider alone can easily associate my real address with the final destination.