[{"_1":2,"_152":-5,"_153":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_131":132},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.r.$namespace.$reponame",{"_22":23,"_24":-5,"_25":11,"_26":11,"_27":28,"_29":30,"_31":-5,"_32":11,"_33":34,"_83":-5,"_84":85,"_124":-5,"_125":11,"_126":17,"_127":11,"_128":-5,"_129":130},"canonicalUrl","https://hub.docker.com/r/boggart/private-internet-access-portforward/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","boggart","reponame","private-internet-access-portforward","cloudBuildSource","isAutobuildsAvailable","repo",{"_35":36,"_37":38,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":50,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":28,"_68":69,"_74":11,"_75":76,"_80":28,"_81":82},"categories",[],"content_types",[39],"image","date_registered","2019-04-30T11:05:31.924755Z","description","Just for testing, if it works I'll be making a pull request so don't rely on this existing for long.","is_private","last_updated","2019-07-22T08:16:26.128925Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[51],"application/vnd.docker.container.image.v1+json","name","pull_count",478,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Private Internet Access Client (OpenVPN+Iptables+DNS over TLS on Alpine Linux)\n\n*Lightweight VPN client to tunnel to private internet access servers*\n\n[![PIA Docker OpenVPN](https://github.com/qdm12/private-internet-access-docker/raw/master/readme/title.png)](https://hub.docker.com/r/qmcgaw/private-internet-access/)\n\n[![Build Status](https://travis-ci.org/qdm12/private-internet-access-docker.svg?branch=master)](https://travis-ci.org/qdm12/private-internet-access-docker)\n[![Docker Build Status](https://img.shields.io/docker/build/qmcgaw/private-internet-access.svg)](https://hub.docker.com/r/qmcgaw/private-internet-access)\n\n[![GitHub last commit](https://img.shields.io/github/last-commit/qdm12/private-internet-access-docker.svg)](https://github.com/qdm12/private-internet-access-docker/issues)\n[![GitHub commit activity](https://img.shields.io/github/commit-activity/y/qdm12/private-internet-access-docker.svg)](https://github.com/qdm12/private-internet-access-docker/issues)\n[![GitHub issues](https://img.shields.io/github/issues/qdm12/private-internet-access-docker.svg)](https://github.com/qdm12/private-internet-access-docker/issues)\n\n[![Docker Pulls](https://img.shields.io/docker/pulls/qmcgaw/private-internet-access.svg)](https://hub.docker.com/r/qmcgaw/private-internet-access)\n[![Docker Stars](https://img.shields.io/docker/stars/qmcgaw/private-internet-access.svg)](https://hub.docker.com/r/qmcgaw/private-internet-access)\n[![Docker Automated](https://img.shields.io/docker/automated/qmcgaw/private-internet-access.svg)](https://hub.docker.com/r/qmcgaw/private-internet-access)\n\n[![Image size](https://images.microbadger.com/badges/image/qmcgaw/private-internet-access.svg)](https://microbadger.com/images/qmcgaw/private-internet-access)\n[![Image version](https://images.microbadger.com/badges/version/qmcgaw/private-internet-access.svg)](https://microbadger.com/images/qmcgaw/private-internet-access)\n\n[![Donate PayPal](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://paypal.me/qdm12)\n\n| Image size | RAM usage | CPU usage |\n| --- | --- | --- |\n| 19.9MB | 14MB to 80MB | Low to Medium |\n\n

Click to show base components

\n\n- [Alpine 3.10](https://alpinelinux.org) for a tiny image\n- [OpenVPN 2.4.7](https://pkgs.alpinelinux.org/package/v3.10/main/x86_64/openvpn) to tunnel to PIA servers\n- [IPtables 1.8.3](https://pkgs.alpinelinux.org/package/v3.10/main/x86_64/iptables) enforces the container to communicate only through the VPN or with other containers in its virtual network (acts as a killswitch)\n- [Unbound 1.9.1](https://pkgs.alpinelinux.org/package/v3.10/main/x86_64/unbound) configured with Cloudflare's [1.1.1.1](https://1.1.1.1) DNS over TLS\n- [Files and blocking lists built periodically](https://github.com/qdm12/updated/tree/master/files) used with Unbound (see `BLOCK_MALICIOUS` and `BLOCK_NSA` environment variables)\n- [TinyProxy 1.10.0](https://pkgs.alpinelinux.org/package/v3.10/main/x86_64/tinyproxy)\n\n

\n\n## Features\n\n-

Configure everything with environment variables

\n\n - [Destination region](https://www.privateinternetaccess.com/pages/network)\n - Internet protocol\n - Level of encryption\n - PIA Username and password\n - DNS over TLS\n - Malicious DNS blocking\n - Internal firewall\n - Web HTTP proxy\n - Run openvpn without root\n\n

\n- Connect other containers to it, [see this](https://github.com/qdm12/private-internet-access-docker#connect-to-it)\n- **ARM** compatible\n- Port forwarding\n- HTTP proxy for LAN devices\n- The *iptables* firewall allows traffic only with needed PIA servers (IP addresses, port, protocol) combinations\n- OpenVPN reconnects automatically on failure\n- Docker healthcheck pings the DNS 1.1.1.1 to verify the connection is up\n- Unbound DNS runs *without root*\n- OpenVPN can run *without root* but this disallows OpenVPN reconnecting, it can be set with `NONROOT=yes`\n\n\n## Setup\n\n1.

Requirements

\n\n - A Private Internet Access **username** and **password** - [Sign up](https://www.privateinternetaccess.com/pages/buy-vpn/)\n - External firewall requirements, if you have one\n - Allow outbound TCP 853 to 1.1.1.1 to allow Unbound to resolve the PIA domain name at start. You can then block it once the container is started.\n - For UDP strong encryption, allow outbound UDP 1197\n - For UDP normal encryption, allow outbound UDP 1198\n - For TCP strong encryption, allow outbound TCP 501\n - For TCP normal encryption, allow outbound TCP 502\n - For the built-in web HTTP proxy, allow inbound TCP 8888\n\n

\n\n1. Ensure `/dev/net/tun` is setup on your host with either:\n\n ```sh\n insmod /lib/modules/tun.ko\n # or...\n modprobe tun\n ```\n\n1.

CLICK IF YOU HAVE AN ARM DEVICE

\n\n - If you have a ARM 32 bit v6 architecture\n\n ```sh\n docker build -t qmcgaw/private-internet-access \\\n --build-arg BASE_IMAGE=arm32v6/alpine \\\n https://github.com/qdm12/private-internet-access-docker.git\n ```\n\n - If you have a ARM 32 bit v7 architecture\n\n ```sh\n docker build -t qmcgaw/private-internet-access \\\n --build-arg BASE_IMAGE=arm32v7/alpine \\\n https://github.com/qdm12/private-internet-access-docker.git\n ```\n\n - If you have a ARM 64 bit v8 architecture\n\n ```sh\n docker build -t qmcgaw/private-internet-access \\\n --build-arg BASE_IMAGE=arm64v8/alpine \\\n https://github.com/qdm12/private-internet-access-docker.git\n ```\n\n

\n\n1. Launch the container with:\n\n ```bash\n docker run -d --init --name=pia --cap-add=NET_ADMIN --device=/dev/net/tun \\\n -e REGION=\"CA Montreal\" -e USER=js89ds7 -e PASSWORD=8fd9s239G \\\n qmcgaw/private-internet-access\n ```\n\n or use [docker-compose.yml](https://github.com/qdm12/private-internet-access-docker/blob/master/docker-compose.yml) with:\n\n ```bash\n docker-compose up -d\n ```\n\n Note that you can:\n - Change the many [environment variables](#environment-variables) available\n - Use `-p 8888:8888/tcp` to access the HTTP web proxy (and put your LAN in `EXTRA_SUBNETS` environment variable)\n - Pass additional arguments to *openvpn* using Docker's command function (commands after the image name)\n\n## Testing\n\nCheck the PIA IP address matches your expectations\n\n```sh\ndocker run --rm --network=container:pia alpine:3.10 wget -qO- https://ipinfo.io\n```\n\n## Environment variables\n\n| Environment variable | Default | Description |\n| --- | --- | --- |\n| `REGION` | `CA Montreal` | One of the [PIA regions](https://www.privateinternetaccess.com/pages/network/) |\n| `PROTOCOL` | `udp` | `tcp` or `udp` |\n| `ENCRYPTION` | `strong` | `normal` or `strong` |\n| `USER` | | Your PIA username |\n| `PASSWORD` | | Your PIA password |\n| `NONROOT` | `no` | Run OpenVPN without root, `yes` or `no` |\n| `DOT` | `on` | `on` or `off`, to activate DNS over TLS to 1.1.1.1 |\n| `BLOCK_MALICIOUS` | `off` | `on` or `off`, blocks malicious hostnames and IPs |\n| `BLOCK_NSA` | `off` | `on` or `off`, blocks NSA hostnames |\n| `UNBLOCK` | | comma separated string (i.e. `web.com,web2.ca`) to unblock hostnames |\n| `EXTRA_SUBNETS` | | comma separated subnets allowed in the container firewall (i.e. `192.168.1.0/24,192.168.10.121,10.0.0.5/28`) |\n| `PORT_FORWARDING` | false | Set to `true` to read the forwarded port |\n| `PF_KEEPCLIENTID` | `off` | `on` or `off`, keep the clientid and thus port between runs |\n| `PROXY` | `on` | `on` or `off`, to switch the internal HTTP proxy |\n| `PROXY_LOG_LEVEL` | `Critical` | `Info`, `Warning`, `Error` or `Critical` |\n| `PROXY_PORT` | `8888` | `1024` to `65535` internal port for HTTP proxy |\n| `PROXY_USER` | | Username to use to connect to the HTTP proxy |\n| `PROXY_PASSWORD` | | Passsword to use to connect to the HTTP proxy |\n\n## Connect to it\n\nThere are various ways to achieve this, depending on your use case.\n\n-

Connect containers in the same docker-compose.yml as PIA

\n\n Add `network_mode: \"service:pia\"` to your *docker-compose.yml* (no need for `depends_on`)\n\n

\n-

Connect other containers to PIA

\n\n Add `--network=container:pia` when launching the container, provided PIA is already running\n\n

\n-

Connect containers from another docker-compose.yml

\n\n Add `network_mode: \"container:pia\"` to your *docker-compose.yml*, provided PIA is already running\n\n

\n-

Connect LAN devices through the built-in HTTP proxy (i.e. with Chrome, Kodi, etc.)

\n\n 1. Setup a HTTP proxy client, such as [SwitchyOmega for Chrome](https://chrome.google.com/webstore/detail/proxy-switchyomega/padekgcemlokbadohgkifijomclgjgif?hl=en)\n 1. Ensure the PIA container is launched with:\n - port 8888 published `-p 8888:8888/tcp`\n - your LAN subnet, i.e. 192.168.1.0/24, set as `-e EXTRA_SUBNETS=192.168.1.0/24`\n 1. With your HTTP proxy client, connect to the Docker host (i.e. `192.168.1.10`) on port `8888`. You might need to enter your credentials if you set them with the environment variables `PROXY_USER` and `PROXY_PASSWORD`.\n 1. If you set `PROXY_LOG_LEVEL` to `Info`, you can check the log output of tinyproxy with:\n\n ```sh\n docker exec -it pia cat /var/log/tinyproxy/tinyproxy.log\n ```\n\n `PROXY_LOG_LEVEL` defaults to `Critical` to avoid logging everything, for privacy purposes as well as to save storage.\n\n

\n-

Access ports of containers connected to PIA

\n\n In example, to access port `8000` of container `xyz` and `9000` of container `abc` connected to PIA,\n publish ports `8000` and `9000` for the PIA container and access them as you would with any other container\n\n

\n-

Access ports of containers connected to PIA, all in the same docker-compose.yml

\n\n In example, to access port `8000` of container `xyz` and `9000` of container `abc` connected to PIA, publish port `8000` and `9000` for the PIA container.\n The docker-compose.yml file would look like:\n\n ```yml\n version: '3'\n services:\n pia:\n image: qmcgaw/private-internet-access\n container_name: pia\n cap_add:\n - NET_ADMIN\n devices:\n - /dev/net/tun\n environment:\n - USER=js89ds7\n - PASSWORD=8fd9s239G\n ports:\n - 8000:8000/tcp\n - 9000:9000/tcp\n abc:\n image: abc\n container_name: abc\n network_mode: \"service:pia\"\n xyz:\n image: xyz\n container_name: xyz\n network_mode: \"service:pia\"\n ```\n\n

\n\n## Port forwarding\n\nBy setting `PORT_FORWARDING` environment variable to `true`, the forwarded port will be read and written to `/forwarded_port`.\n\nYou can mount this file as a volume to read it from other containers.\n\nNote that not all regions support port forwarding.\n\n## For the paranoids\n\n- You can review the code which essential consists in the [Dockerfile](https://github.com/qdm12/private-internet-access-docker/blob/master/Dockerfile) and [entrypoint.sh](https://github.com/qdm12/private-internet-access-docker/blob/master/entrypoint.sh)\n- Build the images yourself:\n\n ```bash\n docker build -t qmcgaw/private-internet-access https://github.com/qdm12/private-internet-access-docker.git\n ```\n\n- The download and unziping of PIA openvpn files is done at build for the ones not able to download the zip files\n- Checksums for PIA openvpn zip files are not used as these files change often (but HTTPS is used)\n- Use `-e ENCRYPTION=strong -e BLOCK_MALICIOUS=on`\n- DNS Leaks tests might not work because of [this](https://github.com/qdm12/cloudflare-dns-server#verify-dns-connection) (*TLDR*: DNS server is a local caching intermediary)\n\n## TODOs\n\n- Mix logs from unbound, tinyproxy and openvpn in Docker logs\n- Maybe use `--inactive 3600 --ping 10 --ping-exit 60` as default behavior\n- Try without tun\n\n## License\n\nThis repository is under an [MIT license](https://github.com/qdm12/private-internet-access-docker/master/license)\n","has_starred","hub_user","immutable_tags_settings",{"_70":11,"_71":72},"enabled","rules",[73],".*","is_automated","permissions",{"_77":17,"_78":11,"_79":11},"read","write","admin","user","storage_size",134293296,"orgData","recentTags",[86],{"_87":39,"_88":89,"_90":91,"_92":93,"_94":95,"_45":113,"_114":89,"_115":28,"_116":51,"_52":117,"_118":119,"_120":104,"_121":113,"_122":61,"_123":17},"content_type","creator",109463,"full_size",9863879,"id",54116685,"images",[96],{"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_107":108,"_109":102,"_110":-5,"_111":91,"_58":61,"_112":-5},"architecture","amd64","digest","sha256:0de6cb516623833420d15cf890b291718f7e777e5b7121374a467e5a8520c309","features","","last_pulled","2026-08-31T05:37:13.712337776Z","last_pushed","2019-07-22T08:16:26Z","os","linux","os_features","os_version","size","variant","2019-07-22T08:16:25.821438Z","last_updater","last_updater_username","media_type","latest","repository",7049996,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_33":133,"_140":141,"_129":150,"_151":11},{"_35":134,"_37":135,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":136,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":28,"_68":137,"_74":11,"_75":139,"_80":28,"_81":82},[],[39],[51],{"_70":11,"_71":138},[73],{"_77":17,"_78":11,"_79":11},"tags",{"_142":59,"_143":-5,"_144":-5,"_145":146},"count","next","previous","results",[147],{"_87":39,"_88":89,"_90":91,"_92":93,"_94":148,"_45":113,"_114":89,"_115":28,"_116":51,"_52":117,"_118":119,"_120":104,"_121":113,"_122":61,"_123":17},[149],{"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_107":108,"_109":102,"_110":-5,"_111":91,"_58":61,"_112":-5},[],"canDeleteTags","actionData","errors"]

boggart/private-internet-access-portforward

Tags for boggart/private-internet-access-portforward