blcarlson01/openvpn repository overview

⁠OpenVPN for Docker

• Docker Hub⁠
• Build⁠
• Setup⁠
• Run⁠
• Generate a client certificate without a passphrase⁠
• Retrieve the client configuration with embedded certificates⁠
• Retrieve Current Clients List⁠
• Security Information⁠
• Docker + OpenVPN systemd Service⁠
• Backup⁠
• Restore Backup⁠
• Debugging Tips⁠
• Docker Compose⁠

Originally based on https://github.com/kylemanna/docker-openvpn⁠

OpenVPN server in a Docker container complete with an EasyRSA PKI CA.

⁠Docker Hub

https://hub.docker.com/r/blcarlson01/openvpn⁠

⁠Build

docker build -t openvpn:latest .

⁠Setup

• Pick a name for the $OVPN_DATA data volume container. It's recommended to use the ovpn-data- prefix to operate seamlessly with the reference systemd service. Users are encourage to replace example with a descriptive name of their choosing. i.e. OVPN_DATA="openvpn-data"

  OVPN_DATA="ovpn-data-example"
  

  Copy

• Initialize the $OVPN_DATA container that will hold the configuration files and certificates. The container will prompt for a passphrase to protect the private key used by the newly generated certificate authority.

  docker volume create --name $OVPN_DATA
  

  Copy

  This is an area that I changed from the original instructions.

  docker run -v $OVPN_DATA:/etc/openvpn --rm openvpn:latest ovpn_genconfig -u udp://VPN.SERVERNAME.COM -C 'AES-256-CBC' -a 'SHA384'
  
  docker run -e EASYRSA_KEY_SIZE=4096 -v $OVPN_DATA:/etc/openvpn --rm -it openvpn:latest ovpn_initpki
  

  Copy

⁠Run

docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN openvpn:latest

⁠Generate a client certificate without a passphrase

I also modified these instructions. Replace CLIENTNAME with what you want the user to be called.

docker run -e EASYRSA_KEY_SIZE=4096 -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm -it openvpn:latest easyrsa build-client-full CLIENTNAME nopass

⁠Retrieve the client configuration with embedded certificates

Replace CLIENTNAME with what you want the user to be called.

docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm openvpn ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn

⁠Retrieve Current Clients List

docker run --rm -it -v $OVPN_DATA:/etc/openvpn --rm openvpn:latest ovpn_listclients

⁠Security Information

See Security Details⁠ for additional processes to run within and on the host environment and Dockerfile.

⁠Backup

Backs up your configuration.

docker run -v $OVPN_DATA:/etc/openvpn --rm openvpn tar -cvf - -C /etc openvpn | xz > openvpn-backup.tar.xz

⁠Restore Backup

Create an volume container named $OVPN_DATA and extract the data to it.

docker volume create --name $OVPN_DATA

xzcat openvpn-backup.tar.xz | docker run -v $OVPN_DATA:/etc/openvpn -i blcarlson01/openvpn tar -xvf - -C /etc

⁠Docker + OpenVPN systemd Service

The systemd service aims to make the update and invocation of the docker-openvpn container seamless. It automatically downloads the latest docker-openvpn image and instantiates a Docker container with that image. At shutdown it cleans-up the old container. For more details and setup see systemd Service Setup.⁠

Minor modification from the original documentation and scripts.

⁠Debugging Tips

• Create an environment variable with the name DEBUG and value of 1 to enable debug output (using "docker -e").

docker run -v $OVPN_DATA:/etc/openvpn -p 1194:1194/udp --privileged -e DEBUG=1 openvpn

• Test using a client that has openvpn installed correctly

    $ openvpn --config CLIENTNAME.ovpn
  

  Copy

• Run through a barrage of debugging checks on the client if things don't just work

    $ ping 8.8.8.8    # checks connectivity without touching name resolution
    $ dig google.com  # won't use the search directives in resolv.conf
    $ nslookup google.com # will use search
  

  Copy

• Consider setting up a systemd service⁠ for automatic start-up at boot time and restart in the event the OpenVPN daemon or Docker crashes.

⁠Docker Compose

Docker Compose Information⁠

Copy/Paste from https://github.com/kylemanna/docker-openvpn⁠