I currently run a Docker container that provides a VPN connection to several other services. I'm considering adding a second VPN on the host so the setup would become a multihop connection through two different providers. Would the container VPN connect first, with the host VPN only seeing already-encrypted traffic? How would port forwarding work in that arrangement, and would it only be needed for the inner VPN? I'm mainly interested in anonymity rather than remote access. Are there disadvantages beyond reduced speed, and could chaining VPNs actually increase the risk of exposure if one provider is compromised? Would a second Docker container used as another VPN hop be a better design?
2 Answers
If you want each service to have its own isolated VPN path, you can run an overlay VPN client such as NetBird in the same Compose setup as the service. That lets you define which containers use the VPN rather than forcing the entire host through it. Just keep the routing and kill-switch rules explicit so traffic cannot silently fall back to the host’s normal connection.
For remote access between your own devices, an overlay based on WireGuard can be much simpler than stacking traditional VPN clients. Tools such as NetBird or Tailscale create a private network and usually avoid the port-forwarding and routing complexity of a manually chained setup. This is more about connectivity than anonymity, though, so it does not automatically provide the privacy properties you’re looking for.
I already use WireGuard through my router for access to my home network. My concern here is anonymity: I’d like one VPN provider in country A to know my originating IP but not the destination, while a second provider in country B sees the first VPN’s IP instead of mine.