3 ms·
> [1] For example, popular corporate VPN software products, like AnyConnect and GlobalProtect, are somewhat notorious for blocking things like Docker overlay ne
by happyopossum 4y ago
> [1] For example, popular corporate VPN software products, like AnyConnect and GlobalProtect, are somewhat notorious for blocking things like Docker overlay networks by default.
It’s not that they block them per se, they are just ignorant of them and so they can’t route them. Traditional VPNs rely on routing protocols like OSPF and BGP (with the occasional static route thrown in) to move traffic, and your docker overlays aren’t integrated with the netsec team’s routing infrastructure.
- tyingq 4y agoNo, they actually block them by actively inserting their own routes at a higher priority and inserting firewall rules. You can fool around with LD_PRELOAD to neuter their functions that do this and get everything working end-to-end. They are blocking things that would otherwise be NATed and work just fine. There's also workarounds for Windows using Powershell scripts and "Set-NetIPInterface -InterfaceMetric 6000" to lower the priority of the AnyConnect internal routes that break docker, or using wsl-vpnkit (as DockerDesktop does).
- chrisweekly 4y agoHave you written any of this up in more detail, or have relevant links to share?
- Hikikomori 4y agoOnly if you configure them to do so. I created our Globalprotect solution and we use docker extensively without issues. It just sets a default route (0/1 and 128/1) and users just need to NAT from the docker network for it to work.
- tyingq 4y agoWell, "you" being the entity that controls the head end of the VPN, which controls settings not (always) tweakable by the end user.