Can anybody give me pointers on setting up this scenario? I would like to run my IRC bouncer inside a container. I want to make sure that this bouncer only mak

Can anybody give me pointers on setting up this scenario? I would like to run my IRC bouncer inside a container. I want to make sure that this bouncer only makes outbound connections using an OpenVPN instance running outside the container. I think I need to wire up a tun/tap device to the container. The container also needs to somehow accept connections from my IRC client (directly, not through the VPN) while still concealing the connecting IP. Basically, I don't want my ZNC container or the IRC servers that it connects to to have access to sensitive Ip addresses.