azinchen/ocserv-server repository overview

⁠OpenConnect VPN Server Docker Container

OpenConnect VPN server (ocserv⁠) in a small self-configuring Docker container: it builds ocserv from source on Alpine, sets up NAT/forwarding automatically with nftables, and can disguise itself as an ordinary HTTPS website.

⁠✨ Key Features

• 🔐 Broad client support — everything ocserv supports (the image runs it unmodified): the openconnect client, Cisco AnyConnect / Secure Client, mobile apps, and routers such as Keenetic / Netcraze, OpenWrt and GL.iNet (details⁠)
• 🚀 Self-configuring networking — NAT, forwarding and MSS clamping set up automatically with nftables; just mount a config and go (details⁠)
• 🕵️ Camouflage mode — to probes and DPI the server looks like an ordinary HTTPS website; only clients that know the secret reach the VPN (details⁠)
• 🚪 Gateway mode — route clients out through upstream VPN containers (e.g. NordVPN) instead of the host's connection (details⁠)
• 👥 Per-user routing — map each user to a different upstream exit; sessions steered on connect, no static IPs needed (details⁠)
• 🎯 Destination bypass — route by destination: country pools go direct, chosen services out a specific exit, ad/malware pools blocked (details⁠)
• 📥 Auto-fetched IP lists — country CIDR lists downloaded on a schedule, validated, and swapped in atomically (details⁠)
• 🛡️ Fail-closed kill switch — nftables next-hop guards on every routed path: if an upstream is down, clients lose internet rather than leak (details⁠)
• 🔄 Hot-reload everything — user maps, pool lists, DNS-named gateway addresses and TLS certificates all reload live, without dropping sessions (details⁠)
• 🔒 Reverse-proxy & Let's Encrypt friendly — share SWAG's certificates; renewals are picked up without a restart (details⁠)
• 📊 Session accounting — session-report shows every session's connect/disconnect times and its traffic split per gateway and bypass pool (details⁠)
• 🩺 Opt-in health monitor — Docker-native HEALTHCHECK: server liveness, routing integrity, and (optionally) real egress probes per gateway (details⁠)
• 📵 IPv6 without leaks — optional NAT66; when an upstream has no IPv6, client IPv6 is rejected fail-closed instead of escaping (details⁠)
• 📦 Multi-arch, from source — amd64 / arm64 / riscv64 images, ocserv built from source, supervised by s6-overlay

⁠Quick Start

# docker-compose.yml
services:
  ocserv:
    image: azinchen/ocserv-server:latest
    container_name: ocserv-server
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    sysctls:
      - net.ipv4.ip_forward=1
    ports:
      - 443:443/tcp
    environment:
      - VPN_SUBNET=10.10.0.0/24
    volumes:
      - ./volumes/config:/etc/ocserv

docker compose up -d
# create a user
docker exec -it ocserv-server ocpasswd -c /etc/ocserv/ocpasswd alice
# connect
sudo openconnect https://vpn.example.com --user=alice

You provide an ocserv.conf and a certificate in the config volume — ready-to-use configurations are on the wiki: Basic⁠ · Self-Signed⁠ · SWAG / Let's Encrypt⁠. Start with Getting Started⁠.

⁠Requirements

⁠Common Setups

For example, chaining every client out through a NordVPN container is just:

    environment:
      - VPN_SUBNET=10.20.0.0/24
      - VPN_GATEWAY=172.28.0.2        # the nordvpn container, kill switch included

⁠Environment Variables

Grouped by feature; every variable is one line here — the Configuration Reference⁠ has the full descriptions.

⁠Core networking

⁠IPv6

⁠Gateway mode — details⁠

⁠Destination bypass — details⁠

⁠Session accounting — details⁠

⁠Health monitor — details⁠

⁠Certificate hot-reload — details⁠

⁠Build

docker build -t ocserv-server .

Base: Alpine Linux · Init: s6-overlay · VPN: ocserv (built from source) · Firewall: nftables

⁠Issues

If you have any problems with or questions about this image, please contact me through a GitHub issue⁠ or email⁠.

Check the Troubleshooting⁠ and FAQ⁠ wiki pages first — and attach the output of the built-in diagnostic to any report:

docker exec ocserv-server network-diagnostic

It prints server status, config sanity checks, certificate state (issuer + expiry), a camouflage self-test, gateway/bypass state with live egress probes (public IP through each gateway and bypass target), connected sessions with live traffic counters, routing and firewall state, and [ok]/[warn] verdicts (non-zero exit on warnings). --explain <user> <ip> tells you which path a destination takes; --json emits a machine-readable summary.

⁠License

MIT — see LICENSE⁠.