The Welotec VPN Container Client (VPN-CC) is a hardware independent software container. In combination with our Welotec VPN Security Suite the VPN-CC provides secure connections for distributed VPN infrastructures. This enables secure E2E-connectivity with devices and machines in the field. The rollout can be done via cloud, Docker Swarm or Kubernets.
VPN Container Client is released as docker container. System should have following application installed:
Docker Engine - minimum version 19.03.8
Installation procedures for those applications can be found at:
https://docs.docker.com/engine/install/
docker-compose VPN-CC
To start, a Docker-Compose file (.yml) docker-compose is required. This can be started with docker-compose -f vpncc-compose.yml up -d
services:
vpncontainerclient:
image: welotec/vpncc:1.6.0
container_name: vpncontainerclient
network_mode: host
restart: unless-stopped
environment:
#INITIAL_NAME: "VPN Container Client" #Please fill in initial instance name, or leave blank to use system hostname
VSS_ADDRESS: https://smartems.welotec.com # Please fill in smartems instance address
#VSS_ENDPOINT_PREFIX: /api/edgegatewayvcc # Please fill in smartems instance VPN Container Client device type endpoint prefix, by default /api/vpncontainerclient is used
VSS_API_USER: vpncontainerclient #Please fill in VPN Container Client API user
VSS_API_KEY: 123456 #Please fill in VPN Container Client API password
VSS_LOG_LEVEL: debug #Lowest log level of messages shown on the docker logs, available options: debug, info, error
VSS_SEND_LOG_LEVEL: info #Lowest log level of messages sent to Smart EMS, available options: debug, info, error
VSS_CONTACT_INTERVAL: 300 #Interval of contact to Smart EMS (to check for configuration change), value is in seconds
VSS_SEND_LOGS_INTERVAL: 120 #Interval of sending logs to Smart EMS, value is in seconds
DISABLE_IPTABLES_PURGE: "false" #Disabling might solve docker other containers issue
#IPTABLES_RECONCILE_INTERVAL: 10 # Interval in seconds to check that NAT/masquerade iptables rules still exist on the host and re-apply them if missing. 0 disables, minimum 2, default 10
# In some OS adding iptables rules in container makes docker masquarading rules overriten
IPTABLES_MASQ_TYPE: "disabled" # Available options: "disabled", "enabled", "iface", "networks"
# if above is enabled, network from docker0 interface will be used for masquerading, if iface is choosen network from IPTABLES_MASQ_IFACE interface will be used for masquerading, if networks is choosen - networks from IPTABLES_MASQ_NETWORKS will be used for masquerading
#IPTABLES_MASQ_IFACE: "docker1" # Available after choosing "iface" option above,
#IPTABLES_MASQ_NETWORKS: "172.17.0.0/16 172.99.3.0/24" # Available after choosing "networks" option above this parameter if filled adds those rules e.g. "172.17.0.0/16 172.99.3.0/24", or leave empty to disable
# If incorrect options are set we should stop container
VSS_VERIFY_SSL_CERTIFICATE: "True" # Enables SSL certifictate verification of VPN Security Suite. Set to "False" to disable. Disabling may cause vulnerabilities for man in the middle attacks
# PROXY_SERVER: http://proxyserver:port # Please fill in proxy server address and port, if proxy is needed.
# If Proxy uses basic authentication, please add then PROXY server like: http://user:password@proxyserver:port
# Custom HTTP request timeout in seconds
# VSS_REQUEST_TIMEOUT: 10 # Please fill in custom HTTP request timeout in seconds, default is 10 seconds
# STARTUP_DELAY: 10 # Please fill in startup delay in seconds, default is 0 seconds
# VPN Control Mode
#
# Available options:
# ALWAYS_ON - VPN is always connected. External control is disabled
# CONTROL_API - VPN can be enabled/disabled via the local API server
# CONTROL_DIO - VPN is controlled by Digital Input/Output signals
#
VPN_CONTROL_TYPE: "ALWAYS_ON"
# VPN_CONTROL_API_* configuration is required when VPN_CONTROL_TYPE = "CONTROL_API"
# API authentication HTTP basic auth username
VPN_CONTROL_API_USERNAME: api
# API authentication HTTP basic auth password
VPN_CONTROL_API_PASSWORD: 123456
# API server bind host
VPN_CONTROL_API_HOST: 0.0.0.0
# API server bind port
VPN_CONTROL_API_PORT: 8000
# Enable or disable API documentation endpoints
#
# When enabled, the following endpoints are available:
# Swagger UI: /api/docs/vpn
# OpenAPI JSON: /api/docs/vpn_openapi.json
#
VPN_CONTROL_API_DOCS_ENABLED: "False"
# Defines the VPN state after application startup when controlled by API
#
# Available options:
# ENABLED - VPN connects automatically on startup
# DISABLED - VPN starts disconnected and requires manual activation
# LAST_STATE - Restores the VPN state from the previous session. On first startup, ENABLED is used
VPN_CONTROL_API_STARTUP_STATE: "ENABLED"
# VPN_CONTROL_DIO_* configuration is required when VPN_CONTROL_TYPE = "CONTROL_DIO"
# Expected VPN state is always read from DIO. Startup state is not required
# Interval for reading DIO input in seconds. Must be greater than 0
VPN_CONTROL_DIO_INTERVAL: 1
# DEBUG="False" # Set to "True" to enable debug mode with exceptions showing full stack trace
cap_add:
- NET_ADMIN
volumes:
- /proc/sys/net/ipv4/ip_forward:/ip_forward
- "filestorage:/filestorage"
devices:
- /dev/net/tun:/dev/net/tun
# - /dev/i2c-0:/dev/i2c-0
volumes:
# Volume for storing files e.g. uuid
filestorage:
name: vpncontainerclient-volume-filestorage
You could check if VPN-CC is running correctly by take a look inside of the docker logs.
docker logs -f vpncontainerclient
With our software solution Welotec VPN Security Suite users benefit from a fully automated VPN infrastructure enabling connectivity and secure access to devices like HMI, PLC, IPC and machines in the field. It comes with an easy deployment, brings flexibility in case of applications and ads an additional security layer to the network infrastructure. The advantages at a glance:
Learn more about our solution here: https://www.welotec.com/product/welotec-vpn-security-suite/
In case on interest, please get in touch: https://www.welotec.com/contact/
As a service provider we are responsible according to § 7 Abs.1 TMG for our own contents on these pages according to the general laws. According to §§ 8 to 10 TMG, we are not obliged to monitor transmitted or stored third-party information or to investigate circumstances that indicate illegal activity. Obligations to remove or block the use of information in accordance with general laws remain unaffected by this. However, liability in this respect is only possible from the time of knowledge of a concrete violation of the law. As soon as we become aware of such infringements, we will remove the content immediately.
Liability for links
Our offer contains links to external websites of third parties on whose contents we have no influence. Therefore, we cannot assume any liability for these external contents. The respective provider or operator of the pages is always responsible for the contents of the linked pages. The linked pages were checked for possible legal infringements at the time of linking. Illegal contents were not recognisable at the time of linking.
A permanent control of the contents of the linked pages is not reasonable without concrete evidence of an infringement. As soon as we become aware of any legal infringements, we will remove such links immediately.
Copyright
The contents and works on these pages created by the site operators are subject to German copyright law. Duplication, processing, distribution and any form of commercialization of such material beyond the scope of the copyright law shall require the prior written consent of its respective author or creator. Downloads and copies of these pages are only permitted for private, non-commercial use.
Insofar as the content on this site was not created by the operator, the copyrights of third parties are respected. In particular, contents of third parties are marked as such. Should you nevertheless become aware of a copyright infringement, please inform us accordingly. As soon as we become aware of any infringements, we will remove such content immediately.
Content type
Image
Digest
sha256:36caf0b0f…
Size
30.7 MB
Last updated
8 days ago
docker pull welotec/vpncc:1.7.0