softfour/openvpn-gw repository overview

⁠OpenVPN Client Gateway (Ubuntu Noble)

softfour/openvpn-gw is a lightweight container based on Ubuntu 24.04 (noble) that runs an OpenVPN client and configures NAT/masquerade and iptables rules to route traffic from the container network through the VPN tunnel (tun0). It also supports static routes and forwarding restrictions to specific subnets.

⁠Features

• Base image: ubuntu:noble
• Installed packages: openvpn, iptables, iproute2, iputils-ping, net-tools, procps, tzdata
• Automatic setup via /entrypoint:
  • Optional static routes (env ROUTE_MAPS)
  • Firewall with NAT to tun0
  • Forwarding restriction to subnets (env FIREWALL_SUBNETS)
  • OpenVPN started with config: /opt/openvpn/client.ovpn

⁠Requirements

• TUN device available in the container

• Network capabilities to manage iptables

  docker run -d --name ovpn-gw
  --cap-add=NET_ADMIN
  --device /dev/net/tun
  -e TZ=UTC
  -e ROUTE_MAPS="10.10.0.0/16:192.168.1.1, 172.16.0.0/12:192.168.1.1"
  -e FIREWALL_SUBNETS="192.168.1.0/24; 192.168.2.0/24"
  -v $(pwd)/client.ovpn:/opt/openvpn/client.ovpn:ro
  softfour/openvpn-gw:latest

  services: ovpn-gw: image: softfour/openvpn-gw:latest container_name: ovpn-gw cap_add: - NET_ADMIN devices: - /dev/net/tun environment: TZ: "UTC" ROUTE_MAPS: "10.10.0.0/16:192.168.1.1,172.16.0.0/12:192.168.1.1" FIREWALL_SUBNETS: "192.168.1.0/24; 192.168.2.0/24" volumes: - ./client.ovpn:/opt/openvpn/client.ovpn:ro restart: unless-stopped

⁠Environment Variables

• TZ (default: UTC) – Container timezone.
• ROUTE_MAPS (optional) – Comma/semicolon/space-separated list of CIDR:GATEWAY. Example: 10.10.0.0/16:192.168.1.1, 172.16.0.0/12:192.168.1.1. Adds routes with ip route add <CIDR> via <GATEWAY> dev eth0.
• FIREWALL_SUBNETS (optional) – Comma/semicolon/space-separated list of subnets allowed to forward traffic to tun0. If unset, forwarding is allowed for all traffic.

⁠Files and Paths

• OpenVPN configuration required: /opt/openvpn/client.ovpn (mount via volume)
• Entrypoint: /entrypoint

⁠Security & Notes

• Applies MASQUERADE on traffic to tun0, allowing ESTABLISHED,RELATED connections.
• Use ROUTE_MAPS for multi-network static routing.
• Restrict VPN access to specific subnets with FIREWALL_SUBNETS.

⁠License

This container uses open source packages from Ubuntu. Please verify licensing for OpenVPN and dependencies in your environment.