title: Docker-Compose: how to configure container with VPN Split-Tunnelling?
body: <p>I need the network traffic of a Docker service to pass through VPN,
  and also to be able to reach other containers outside VPN from that container.</p>
  <p>I'm able to get the first requirement working by configuring an <code>OpenConnect</code> service</p>
  <pre><code>version: &quot;3.8&quot;
  
  services:
    open-connect:
      container_name: open-connect
      image: open-connect
      build:
        dockerfile: Docker/OpenConnect.Dockerfile
        context: .
      privileged: true
      environment:
        - VPN_PROTOCOL
        - VPN_HOST
        - VPN_PORT
        - VPN_USERNAME
        - VPN_PASSWORD
  </code></pre>
  <p>and making the traffic of the other service pass through it via <code>network_mode: container:open-connect</code></p>
  <pre><code>version: &quot;3.8&quot;
  
  services:
    vpn-client:
      container_name: vpn-client
      image: vpn-client
      build:
        dockerfile: Docker/Busybox.Dockerfile
        context: ..
      network_mode: container:open-connect
    service-a:
      hostname: service-a
      container_name: service-a
      image: service-a
      build:
        dockerfile: Docker/Busybox.Dockerfile
        context: ..
      networks:
        backend:
    service-b:
      hostname: service-b
      container_name: service-b
      image: service-b
      build:
        dockerfile: Docker/Busybox.Dockerfile
        context: ..
      networks:
        backend:
  
  networks:
    backend:
  </code></pre>
  <p>The problem is that only <code>service-a</code> and <code>service-b</code> are able to ping each other.</p>
  <p>From <code>vpn-client</code> it is not possible to reach neither <code>service-a</code> or <code>service-b</code>,
  similarly in the reverse way.</p>
  <p>I cannot combine <code>network-mode</code> and <code>networks</code> in the <code>vpn-client</code> service:</p>
  <pre><code>ERROR: 'network_mode' and 'networks' cannot be combined
  </code></pre>
  <p>What else can be done to make the <code>vpn-client</code>, <code>service-a</code> and <code>service-b</code> mutually reachable without being all of them behind <code>VPN network</code>?</p>
  <hr />
  <p><strong>Update</strong></p>
  <p><strong>VPN Split Tunnelling</strong></p>
  <p>Based on some resources I found, the solution seems to be the
  configuration of VPN with <code>split-tunnelling</code> instead of <code>full-tunneling</code>.</p>
  <ul>
  <li><a href="https://cybernews.com/what-is-vpn/split-tunneling/" rel="nofollow noreferrer">https://cybernews.com/what-is-vpn/split-tunneling/</a></li>
  <li><a href="https://gist.github.com/stefancocora/686bbce938f27ef72649a181e7bd0158" rel="nofollow noreferrer">https://gist.github.com/stefancocora/686bbce938f27ef72649a181e7bd0158</a></li>
  <li><a href="https://gist.github.com/jagtesh/5531300" rel="nofollow noreferrer">https://gist.github.com/jagtesh/5531300</a></li>
  </ul>
  <p>So the question becomes: how to configure VPN split-tunnelling in the <code>open-connect</code> service?</p>