How to Force All Traffic Through a VPN on Windows Using Docker (When Your Router Can’t)

Published January 16, 2026 | By Adblockdude

How to Force All Traffic Through a VPN on Windows Using Docker (When Your Router Can’t)

When your router can’t run a VPN client (which is very common with ISP-provided or locked-down models, instructions here for doing it though), one workaround is to route all network traffic through a Windows machine running a VPN inside a Docker container. In this setup, the Windows PC effectively becomes a gateway: other devices send their traffic to it, Windows forwards it to the Docker virtual machine, and the VPN container tunnels it out to the internet. It’s not as clean or simple as a true router-level VPN, and it comes with real limitations (firewalls, sleep states, Docker networking quirks), but it can achieve “whole-network VPN” behavior when traditional router installs aren’t possible.

If you’re running MacOS there are different instructions for installing a VPN in Docker on MacOS + instructions for routing traffic.

Windows Architecture Reality

So we need:

Windows to forward traffic
Windows to NAT into Docker VM
Docker VM to forward into VPN tunnel (click here for instructions on installing the VPN Docker container on Windows).

Requirements

Windows 10/11 Pro (Home can work, but more painful)
Docker Desktop using WSL2 backend
NordVPN service account (click here to watch the video on how to generate service account credentials)
Admin access on Windows
Router that either:
- Allows changing DHCP gateway OR
- You are OK setting gateway manually per device

The Hard Limits

Know this!

If Windows sleeps → internet dies
Docker updates can break networking
WSL2 networking is NAT’d → adds latency
Some devices (Chromecast, consoles) hate non-standard gateways
This is not “set and forget”

Click if you need a NordVPN service account

Step 0 – Verify Docker is Using WSL2

In PowerShell:

You should see:

If not, fix that first.

Step 1 – Enable IP Forwarding in Windows

Open PowerShell as Administrator:

Find your main LAN interface (usually Ethernet or Wi-Fi), note the InterfaceIndex.

Then:

Now enable the routing service:

This is important. Without this, Windows often won’t forward packets reliably.

Step 2 – Allow Forwarding Through Windows Firewall

Still in admin PowerShell:

Or, more controlled:

(You can tighten later.)

Step 3 – Run NordVPN in Docker

Example:

Then:

Verify tunnel:

You must see tun0. If not, stop.

Step 4 – Enter the Docker VM (WSL2)

In PowerShell:

Now you are inside the Linux VM that actually hosts the container network.

Step 5 – Enable Forwarding in WSL2

Step 6 – NAT WSL2 Traffic Into the VPN Tunnel

Still inside WSL2:

Allow forwarding:

At this point:

Windows can forward → WSL2 can forward → VPN tunnel exists

The pipeline is now technically functional.

Step 7 – Make Windows the Gateway for Other Devices

This is where router reality kicks in.

Case A – Router Allows DHCP Gateway Override (Rare)

Router LAN settings:

Done.

Case B – Router Does NOT Allow (Most Common)

You must set per device:

Example on a device:

Now that device routes:

Step 8 – Test

On the device:

Go to: https://whatismyip.com
It should show NordVPN location.

If not:

Check Windows firewall
Check ip route in WSL2
Check iptables -t nat -L

Click here if you want to save on NordVPN