The project was developed for personal use and tested for the joint use of server (ocserv-server) and client (openconnect-client-mikrotik) parts, and is also compatible with a mobile client. Linux server under the general control of the Angia webserver.
Webserver Angie module stream:
stream {
map $ssl_preread_server_name $backend {
oc.example.com ocserv_backend;
default https_backend;
}
upstream ocserv_backend {
server 127.0.0.1:8443;
}
upstream https_backend {
server 127.0.0.1:8444;
}
server {
listen 443;
listen [::]:443;
# listen 443 udp;
# listen [::]:443 udp;
ssl_preread on;
# proxy_protocol on;
proxy_pass $backend;
}
}
docker-compose:
services:
ocserv:
image: anvarsoft/ocserv-server:${TAG:-latest}
pull_policy: always
container_name: ocserv
restart: unless-stopped
cap_add:
- NET_ADMIN
sysctls:
- net.ipv4.ip_forward=1
devices:
- /dev/net/tun
env_file:
- .env
ports:
- "127.0.0.1:${TCP_PORT:-8443}:${TCP_PORT:-8443}/tcp"
volumes:
- ${CERT_PATH:-./certs/certificate.pem}:/etc/ocserv/certs/certificate.pem:ro
- ${KEY_PATH:-./certs/private.key}:/etc/ocserv/certs/private.key:ro
- ocserv-state:/etc/ocserv
networks:
- ocserv-net
volumes:
ocserv-state:
networks:
ocserv-net:
name: ocserv-net
driver: bridge
driver_opts:
com.docker.network.bridge.name: br-ocserv
.env.example:
# Image tag that is pulled from Docker Hub (anvarsoft/ocserv-server:TAG)
TAG=v1
# Port on which ocserv listens for TCP
TCP_PORT=8443
# DTLS (UDP)
ENABLE_DTLS=false
# First VPN user
VPN_USER=myuser
VPN_PASS=change-me
DEFAULT_DOMAIN=oc.example.com
# Pool of client addresses
IPV4_NETWORK=192.168.200.0
IPV4_NETMASK=255.255.255.0
MAX_CLIENTS=16
MAX_SAME_CLIENTS=2
DNS_SERVER=1.1.1.1
RELOAD_CHECK_INTERVAL=60
# Auto-routing to the LAN behind a remote gateway. The first gateway is without a number,
# further GATEWAY_2_*, GATEWAY_3_*, etc. LAN_NETWORK may contain several
# subnets separated by commas (for example, if there are several VLANs behind the gateway):
# "192.168.88.0/24,10.10.10.0/24".
# GATEWAY_VPN_USER=<xxx>
# GATEWAY_LAN_NETWORK=<xxx>
# GATEWAY_2_VPN_USER=<xxx>
# GATEWAY_2_LAN_NETWORK=<xxx,xxx>
CERT_PATH=/var/lib/angie/acme/openconnect/certificate.pem
KEY_PATH=/var/lib/angie/acme/openconnect/private.key
CAMOUFLAGE_SECRET=change-me-to-a-long-random-secret
Full list of variables:
| Variable | Default | Description |
|---|---|---|
VPN_USER / VPN_PASS | — | First user, created once upon initial startup (while ocpasswd does not exist in the volume). Changing the password retroactively via .env does not work — see the users section |
TCP_PORT | 8443 | ocserv port inside the container and on host 127.0.0.1; Angie proxies to this port from 443 |
ENABLE_DTLS | false | Enable UDP/DTLS — Angie's SNI proxying is designed for TCP, this is only meaningful with direct UDP port forwarding bypassing Angie |
MAX_CLIENTS | 16 | Total concurrent sessions limit |
MAX_SAME_CLIENTS | 2 | Session limit per individual user |
DEFAULT_DOMAIN | vpn.local | CN of the self-signed certificate (fallback) and default-domain |
IPV4_NETWORK / IPV4_NETMASK | 192.168.200.0/255.255.255.0 | VPN IP address pool |
DNS_SERVER | 1.1.1.1 | DNS assigned to clients |
SERVER_CERT_FILE / SERVER_KEY_FILE | /etc/ocserv/certs/{certificate.pem,private.key} | Paths to the certificate inside the container |
RELOAD_CHECK_INTERVAL | 60 | Period (sec) for checking certificate updates for auto-reload |
CAMOUFLAGE_SECRET | — (required) | Secret for camouflage, see the corresponding section |
GATEWAY_VPN_USER / GATEWAY_LAN_NETWORK | — | First gateway for auto-routing to the LAN. Followed by GATEWAY_2_* … GATEWAY_10_*. LAN_NETWORK values are comma-separated. |
Add a new user:
docker exec -it ocserv ocpasswd -c /etc/ocserv/ocpasswd name_user
Will ask for password twice (interactively).
See who is already registered:
docker exec -it ocserv sh -c "cut -d: -f1 /etc/ocserv/ocpasswd"
Delete user:
docker exec -it ocserv ocpasswd -c /etc/ocserv/ocpasswd -d name_user
See who is really connected now:
docker exec -it ocserv sh -c "PAGER=cat occtl show users"
Content type
Image
Digest
sha256:6f97f67b3…
Size
35.8 MB
Last updated
26 days ago
docker pull anvarsoft/ocserv-server:v1