Howto allow/block VPN traffic in defguard docker to other subnets ?

[tlamik]

Hello,

I succesfuly installed defguard in docker on one VM computer. That computer has special VLAN (192.168.233.2/24) and its separated from other subnets by firewall.
In defguard deployment I setup a subnet for my location 10.0.60.0/24, so the wg0 interface has 10.0.60.1 and defguard client letsay 10.0.60.2. I am able to ping from client to wg0, but when I want to ping to another subnet/internet I have to masquerade all traffic from wg0 to eth0. Ok, it's working, BUT all clients are then masked by eth0 IP address. So I am unable to manage access by client VPN address. All connections from defguard VPN is prezented as goes from 192.168.233.2 (ssh logins for example)

[teon]

@tlamik this is normal network behaviour, either there is properly routing configured - if not, there is possibility to MASQ the network that is not routed. So if you don’t want to masq you need to configure routing.

[tlamik]

I know, I was curious about best practise scenario using defguard in docker in that case, cos I can't see any easy solution for that.

[teon]

You can use docker network mode ,host’ then you have access to host networking.