This provides a way to connect to a Corporate VPN and expose HTTP(S), SOCKS5, and DNS proxies. It supports two approaches:

1. Proxy Using Host's VPN: The container leverages the host's existing VPN connection.
2. Self-Contained VPN: The container connects to the VPN using openconnect, creating a self-contained setup.

Both approaches provide proxy services (http(s), socks5, dns) with privoxy, microsocks, dnsmasq for clients to reach services within the VPN. Choose an approach based on your requirements and VPN server capabilities.

To help you get started creating a container from this image you can use docker-compose or the docker cli.

---
version: "3.3"
services:
  corpvpn:
    image: tdharris/corpvpn:latest
    container_name: corpvpn
    cap_add:
      - NET_ADMIN
    volumes:
      - /etc/localtime:/etc/localtime:ro
    environment:
      - DEFAULT_PUID=1000
      - DEFAULT_PGID=1000
      - ENABLE_VPN=false # Optional
      - ENABLE_DNS=true # Optional
      - AUTOHEAL_ENABLED=false # Optional
      - LAN_NETWORK=192.168.1.0/24 # Optional
      - VPN_SERVER= # Optional
      - VPN_USER= # Optional
      - VPN_PASS= # Optional
      - VPN_PROTOCOL=pulse # Optional
      - VPN_AUTH_GROUP="Smartphone Push" # Optional
    # env_file:
    #   - .env # Optional alternative to environment (see .env.sample)
    ports:
      - 8118:8118 # PRIVOXY_PORT
      - 9118:9118 # SOCKS_PORT
      - 5354:53/tcp # DNS_PORT
      - 5354:53/udp # DNS_PORT
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.default.disable_ipv6=0
      - net.ipv6.conf.lo.disable_ipv6=0
      - net.ipv4.tcp_keepalive_intvl=1
      - net.ipv4.tcp_keepalive_probes=3
      - net.ipv4.tcp_keepalive_time=30
    logging:
      driver: "json-file"
      options:
        max-size: "10M"
        max-file: "10"
    healthcheck:
      test: /app/healthcheck.sh || exit 1
      timeout: 30s
      interval: 60s
      start_period: 60s
      retries: 3

• See .env.sample⁠ for Environment Variables. Review usage approaches⁠ below for additional information.
• See Docker Hub tdharris/corpvpn for more information on the image. You can also build the image locally with the provided Dockerfile.

In this approach, the Docker container acts as a proxy that leverages the host's network connection to the Corporate VPN. This is a simpler setup where the host machine is already connected to the Corporate VPN, and the Docker container simply provides proxy services (http(s), socks5, dns) to other clients to reach services within the VPN.

To use this approach, you would run the docker-compose setup as usual, without needing to provide VPN connection details. The container will use the host's VPN connection to access the corporate network.

1. Pre-requisites:

   • The host machine is already connected to the Corporate VPN.
   • Docker
   • Docker-Compose

2. Update the following Environment Variables:

   - ENABLE_VPN=false
   - LAN_NETWORK=<lan ipv4 network>/<cidr notation>

3. See Common Steps for Both Approaches below.

In this approach, the Docker container connects to the Corporate VPN using openconnect and with a configurable protocol. This creates a self-contained setup where the VPN connection is managed within the Docker container itself. This approach is more complex and requires the VPN server to support connections from openconnect with the possibility of using MFA methods like Smartphone Push.

To use this approach, you would need to provide the VPN connection details (VPN_SERVER, VPN_USER, VPN_PASS, VPN_PROTOCOL, VPN_AUTH_GROUP). The container will use these details to establish its own VPN connection.

Please note that not all VPN servers support connections from openconnect. Check with your IT department or VPN provider to see if this approach is permitted.

1. Pre-requisites:

   • Smartphone Push MFA Method has been configured for the VPN_USER account. (Configurable with VPN_AUTH_GROUP)
   • Docker
   • Docker-Compose

2. Update the following Environment Variables:

   - ENABLE_VPN=true
   - VPN_SERVER=<vpn server address>
   - VPN_USER=<vpn username>
   - VPN_PASS=<vpn password>
   - LAN_NETWORK=<lan ipv4 network>/<cidr notation>

3. See Common Steps for Both Approaches below.

After setting up the pre-requisites and environment variables above, follow these steps to run the docker-compose setup:

1. Run with docker-compose:

   docker-compose up -d

   • (optional) Approve MFA request via Smartphone Push.

   • To monitor container logs:

     docker logs -f --tail 10 corpvpn

   • To stop the vpn, simply stop the container:

     docker stop corpvpn

2. Setup clients to connect via proxy provided by the container: :8118 for http(s) or :9118 for socks. See Configure Clients for more details.

3. (optional) Validate proxy and vpn connectivity:

   To validate the http(s) :8118 and socks :9118 proxies, the following commands should be successful and return the vpn ip address, not your public ip address:

   curl -sSf --socks5 127.0.0.1:9118 ifconfig.co/ip
   curl -sSf --proxy 127.0.0.1:8118 ifconfig.co/ip

   Note : Replace 127.0.0.1 with the host ip address where the container is running if not localhost.

Configure clients as an opt-in approach to forward requests in through the proxy to the corporate network.

• Chrome, Firefox, Edge, Opera
• Safari
• Windows
• Mac
• Linux Ubuntu

The following are options for other client-based approaches:

• Environment Variables
• SSH
• GIT

For terminal or shell-based environments, most approaches include forwarding into the proxy with a tool like ncat, netcat, nc, or optionally corkscrew on mac OS. There are various versions of these tools, which are similar, but likely have different arguments or syntaxes.

Recommend installing the following with brew which includes ncat, which is referenced in the below examples or install directly as needed:

brew install nmap

ncat --version
Ncat: Version 7.93 ( https://nmap.org/ncat )

The http_proxy and https_proxy environment variables are used to specify proxy settings to various client programs such as curl, wget, etc.

export {http,https}_proxy=http://127.0.0.1:8118

To setup permanently, use /etc/environment:

echo "http_proxy=http://127.0.0.1:8118" >> /etc/environment
echo "https_proxy=http://127.0.0.1:8118" >> /etc/environment

To setup dynamically based on pwd, consider using direnv to create an .envrc file at the base directory where vpn connections should occur by default. This will then load and unload these env vars automatically depending on the working directory.

# .envrc
export {http,https}_proxy=http://127.0.0.1:8118

To verify the configuration is working with these env vars set, the following should return the vpn ip address and not your public ip address:

curl ifconfig.co/ip
<corpvpn ip address>

To ssh through the proxy, or for git operations that may rely on ssh, consider the following manual example:

# via http
ssh -o "ProxyCommand=ncat --proxy 127.0.0.1:8118 --proxy-type http %h %p" user@host

# via socks5
ssh -o "ProxyCommand=ncat --proxy 127.0.0.1:9118 --proxy-type socks5 %h %p" user@host

To automate these connections based on the host or domain, define with ProxyCommand within ~/.ssh/config:

Host <hostname>
  ProxyCommand ncat --proxy 127.0.0.1:8118 --proxy-type http %h %p
  # ProxyCommand ncat --proxy 127.0.0.1:9118 --proxy-type socks5 %h %p

# wildcard
Host *.<hostname>
  ProxyCommand ncat --proxy 127.0.0.1:8118 --proxy-type http %h %p
  # ProxyCommand ncat --proxy 127.0.0.1:9118 --proxy-type socks5 %h %p

To configure connections for git through the proxy:

• For ssh connectivity, see SSH above.

• For http(s) connectivity:

  Global proxy:

  git config --global http.proxy http://127.0.0.1:8118
  git config --global https.proxy https://127.0.0.1:8118

  URL specific proxy:

  git config --global http.http://domain.com.proxy http://127.0.0.1:8118
  git config --global https.https://domain.com.proxy https://127.0.0.1:8118

  Note : The above url-specific syntax is a bit strange, but generates the following in ~/.gitconfig:

  [http]
  [http "http://domain.com"]
      proxy = http://127.0.0.1:8118
  [https "https://domain.com"]
      proxy = https://127.0.0.1:8118

• OpenConnect - Multi-protocol VPN client, for Cisco AnyConnect VPNs and others.
• Privoxy - non-caching web proxy.
• MicroSocks - multithreaded, small, efficient SOCKS5 server.
• Dnsmasq - local dns server.
• direnv - shell extension that can load and unload environment variables.
• ssh_config - linux manual page.