[3np]

I'm in the exact same phase - been doing hosting/ops/sysadmin for most of my life but only starting to pay serious attention to the networking since recently.

Something I've yet come up with a good solution for that I feel should be much more common and simple, maybe you can point me to the right direction for (and maybe the answer is iptables, urgh):

(Containerized) P2P software that should be routed through some other endpoint before reaching/beaing reachable from the network.

Example: Bitcoin full node or Bittorrent node running in a Docker container on one of my home servers (where the host runs other software too). For all intents and purposes I want the nodes to route traffic through a VPS in some other DC (in this case bridged via wireguard). Incoming's easy enough with reverse proxies/load balancers, but with all the UDP traffic on random ports, outgoing TCP connections, etc, I haven't figured out a way to make it not leak my IP in some way.

Feels this should be dead easy but I'm stumped. Oh, and assume no support of SOCKS proxies in the software itself.

I'm aware of hidden onion services but talking clearnet here.

[anderspitman]

Yeah sorry, I can't think of anything to solve that. But it does have me thinking that I bet someone out there has made a wrapper program that intercepts network system calls (using LD_PRELOAD hacks) from a target executable and routes them all through a specific interface.

Failing that, you're probably stuck with iptables and maybe Linux namespaces.

[nprateem]

Run it on a lightweight k8s (eg k3s) on your machine then use iptables to forward all traffic from k8s to your VPS

[3np]

I'm using some other orchestration than k8s/k3s (and regardless different deployments should have different entrypoints).

But yeah, maybe the real answer is "iptables" and I just have to step up my game a bit to grok it.

[nprateem]

K8s means you'll have a single source IP for all your application's traffic so you can just forward it all upstream instead of having to hunt for which ports it actually uses

[3np]

Right, but I'm not going to use kubernetes, and I only want this for certain containers. Maybe there's a solution for this with CNI, though?