docker container cant reach internet attached to vpn

Question

Hi I have a docker compose file with a vpn and a container attached to it I have a external network set up but the container attached to the vpn cant reach the internet.

docker-compose.yml

version: '3.9'
services:
  vpn:
    container_name: vpn
    image: qmcgaw/gluetun:v3.37.0
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=nordvpn # Valid values: nordvpn, expressvpn, protonvpn, surfshark or custom
      - OPENVPN_USER=
      - OPENVPN_PASSWORD=

      ## For list of server countries, visit https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json
      ## When VPN_SERVICE_PROVIDER is custom. Comment the below line
      - SERVER_COUNTRIES=Switzerland
    
      # - FREE_ONLY=on  # Valid with protonvpn only. Value willbe set "on" if using free subscription provided by protonvpn

      ## Enable below if VPN_SERVICE_PROVIDER=custom
      - VPN_TYPE=openvpn # or wireguard. 

      ## If VPN_TYPE is openvpn
      - OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
    
    # Uncomment/enable below ports if VPN is used/enabled
    ports:
    #   # qbittorrent ports
    #   - 5080:5080
    #   - 6881:6881
    #   - 6881:6881/udp
    #   # prowlarr ports
    #   - 9696:9696
      - 8123:8123
    restart: "unless-stopped"
    networks:
      - mynetwork

  homeassistant:
    container_name: hass
    image: homeassistant/home-assistant
    network_mode: 'service:vpn'
    volumes:
      - ./config:/config
      - /etc/localtime:/etc/localtime:ro
    restart: unless-stopped
    depends_on:
      - vpn

networks:
  mynetwork: 
    driver: bridge                                
    external: true

From my understanding the hass container should be able to reach the internet but will have an ip address of switzerland where the vpn is set?

Currently I cant reach the internet at all from hass container.

Answer 1

I tried your docker compose with my own NordVPN account :

version: '3.9'
services:
  vpn:
    container_name: vpn
    image: qmcgaw/gluetun:v3.37.0
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=nordvpn # Valid values: nordvpn, expressvpn, protonvpn, surfshark or custom
      - OPENVPN_USER=
      - OPENVPN_PASSWORD=

      ## For list of server countries, visit https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json
      ## When VPN_SERVICE_PROVIDER is custom. Comment the below line
      - SERVER_COUNTRIES=Switzerland
    
      # - FREE_ONLY=on  # Valid with protonvpn only. Value willbe set "on" if using free subscription provided by protonvpn

      ## Enable below if VPN_SERVICE_PROVIDER=custom
      - VPN_TYPE=openvpn # or wireguard. 

      ## If VPN_TYPE is openvpn
      #- OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
    
    # Uncomment/enable below ports if VPN is used/enabled
    ports:
    #   # qbittorrent ports
    #   - 5080:5080
    #   - 6881:6881
    #   - 6881:6881/udp
    #   # prowlarr ports
    #   - 9696:9696
      - 8123:8123
    restart: "unless-stopped"
    networks:
      - mynetwork

  homeassistant:
    container_name: hass
    image: homeassistant/home-assistant
    network_mode: 'service:vpn'
    depends_on:
      - vpn

networks:
  mynetwork: 
    driver: bridge                                
    external: false

note : I have changed the my network to internal one, and remove the #- OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf

then I have tested connecting to internet from both container and I can access without any problem :

docker container exec -it 3b639f665c78 sh
/ # ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: seq=0 ttl=56 time=32.644 ms

❯ docker container exec -it 8fc7b37dab2c sh
/config # ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: seq=0 ttl=56 time=32.100 ms

Try use ping our curl -v from inside your container please

Answer 2

In my specific case the custom config for ovpn was causing the issue but failing silently, thanks for your response I tried removing the customer conf and using your seetings it also worked this way thank you.