Generalik

IP leakage can occur at startup if you route other containers through the PrivoxyVPN image. In my opinion, the security of your image can be significantly improved by moving the iptables drop rules to the very start of init.sh. In start.sh, if vpn_remote_server is not an IP address, create temporary iptable rules to allow communications to the given nameservers via port 53. After the IP address is resolved, flush the iptables rules and let iptable.sh run. I also believe it is best to remove ICMP rules from iptable.sh since these rules are not necessary. I have modified your images as I suggested above for my personal use and have not encountered any issues. Until you have the time to implement these changes to mitigate leaks at startup, please warn about IP leakage in Q24 of your "VPN Docker FAQ."

I was looking over your arch-int-vpn code and noticed the possibility of leaks at startup. It appears to me that iptable rules are loaded immediately preceding the start of OpenVPN or WireGuard, before which leaks are possible while configuration file preprocessing, various sanity checks, and VPN IP resolution are performed. Is my impression correct? Also, why do you allow ICMP over all interfaces?