Ethan ' s proposal is like the most H 3 H 3 thing anyone could imagine <| sep |> Well then that ' s settled , we should just let him and the Putinbots steal an election . You ' ve definitely convinced me . <| sep |> Ah , that makes sense . Docker is making use of a virtual ethernet pair with the local one essentially being renamed to docker 0 to get traffic to and from the container . It wouldn ' t surprise me if the container is running its own network stack and set of iptables rules , but I would think they ' re all defaulting to ACCEPT . Looking at your existing rules on lines 13 15 , anything exiting the docker container should be able to reach 1 Any port in the 192 . 168 . 1 . 024 subnet 2 Any host with port 22 connected to the LAN interfaceAre you able to ping the hosts from within the VPN ? Are any other ports showing as open if you scan them from the VPN ? nmap is very good for this . Honestly , I don ' t think the added complexity from the docker image is helping . I tend to manage my OpenVPN installs with Ansible if I can help it .