[skull]

I am looking for guidance on my wanted setup.

I plan to build a VPN that some penetration testers will be given access to, in order to learn.
On the server, there will be located some Docker servers, that will be pointed to by local IPs, each Docker container will have its own ports and vulnerabilities for the testers to play with.
However, I do not wish for the boxes or VPN users to be able to access the outgoing internet, since then the testers could use the server for attacks, which would be pretty bad.

How would I do this setup? I am aware of how to setup a generic VPN service and how to host Docker containers, but not aware of how to limit their access to not go out of this network.

Also, if anyone wanna join the project, feel free to message me.