如何将Guacamole Docker容器通过tun0网卡连接至客户端OpenVPN

我在Ubuntu 18.04服务器上用Docker部署了Guacamole，同时安装了OpenVPN客户端。现在需要让Guacamole所在的Docker网络guacnetwork_compose连接到VPN网卡tun0，从而通过Guacamole访问VPN子网内其他客户端的VNC或RDP服务。

子网信息 #

• OpenVPN子网: 10.20.0.0/16（对应网卡tun0）
• 主机子网: 172.16.1.0/24（对应网卡ens3）
• Docker默认子网: 172.17.0.0/16（对应网卡docker0）
• Guacamole容器所在子网: 172.23.0.0/16

我的docker-compose.yml配置 #

version: '2.0'

networks:
  guacnetwork_compose:
    driver: bridge

services:
  # guacd
  guacd:
    container_name: guacd_compose
    image: guacamole/guacd
    networks:
      guacnetwork_compose:
    restart: always
    volumes:
    - ./drive:/drive:rw
    - ./record:/record:rw
  # postgres
  postgres:
    container_name: postgres_guacamole_compose
    environment:
      PGDATA: /var/lib/postgresql/data/guacamole
      POSTGRES_DB: guacamole_db
      POSTGRES_PASSWORD: 'xxxxx'
      POSTGRES_USER: guacamole_user
    image: postgres:15.2-alpine
    networks:
      guacnetwork_compose:
    restart: always
    volumes:
    - ./init:/docker-entrypoint-initdb.d:z
    - ./data:/var/lib/postgresql/data:Z

  # guacamole
  guacamole:
    container_name: guacamole_compose
    depends_on:
    - guacd
    - postgres
    environment:
      GUACD_HOSTNAME: guacd
      POSTGRES_DATABASE: guacamole_db
      POSTGRES_HOSTNAME: postgres
      POSTGRES_PASSWORD: 'xxxxx'
      POSTGRES_USER: guacamole_user
    image: guacamole/guacamole
    links:
    - guacd
    networks:
      guacnetwork_compose:
    ports:
    - 8080/tcp
    restart: always

  # nginx
  nginx:
   container_name: nginx_guacamole_compose
   restart: always
   image: nginx
   volumes:
   - ./nginx/templates:/etc/nginx/templates:ro
   - ./nginx/ssl/self.cert:/etc/nginx/ssl/self.cert:ro
   - ./nginx/ssl/self-ssl.key:/etc/nginx/ssl/self-ssl.key:ro
   ports:
   - 8443:443
   links:
   - guacamole
   networks:
     guacnetwork_compose:

已尝试的iptables规则 #

我添加了以下规则，但仍然无法通过Guacamole连接到VPN内客户端的VNC或RDP服务：

iptables -t nat -A POSTROUTING -s 172.23.0.0/16 -d 10.20.0.0/16 -j MASQUERADE
iptables -A FORWARD -s 172.23.0.0/16 -d 10.20.0.0/16 -j ACCEPT
iptables -A FORWARD -d 172.23.0.0/16 -s 10.20.0.0/16 -j ACCEPT

注：所有VPN客户端均已正确配置OpenVPN，我可以直接用VNC Viewer和远程桌面连接这些客户端，但希望通过Guacamole统一访问。

内容的提问来源于stack exchange，提问作者Angelo Uceda Malca