yerayvillamarin/openvpn-arm64v8 repository overview

⁠OpenVPN for Docker | ARM64v8

OpenVPN server in a Docker container complete with an EasyRSA PKI CA.

⁠DEPRECATION NOTICE

This image is deprecated. We will not support this image and it will not be updated. We recommend using Wireguard.

⁠Important information!

⁠This is a fork of the kylemanna repository, compiled for the ARM64v8 architecture.

⁠Compatible with Raspberry Pi (OS 64 bits).

⁠If you want to run this image on an amd64 system, use the official image:

• Docker Registry @ kylemanna/openvpn⁠
• GitHub @ kylemanna/docker-openvpn⁠

⁠Anyway, all questions and thanks go to kylemanna, Thank you!

⁠Quick Start

• To have persistent data we need to use a volume, this can be a docker volume or a bind format. For this example I will use a static path where we will store the container data. This path has to be always the same when we work with this image.

   /path/host/openvpn-config
  

  Copy

  Remember that you have to change the volume path in the following commands.

• Now we will create the initial configuration. These commands will use a temporary container to create a certificate authority and the private key it will use. It may ask for a passphrase to protect the generated private key. You have to change the DNS domain name.

  docker run -v /path/host/openvpn-config:/etc/openvpn --rm yerayvillamarin/openvpn-arm64v8 ovpn_genconfig -u udp://VPN.SERVERNAME.COM
  docker run -v /path/host/openvpn-config:/etc/openvpn --rm -it yerayvillamarin/openvpn-arm64v8 ovpn_initpki
  

  Copy

  Note: This process may take several minutes, be patient.

• Create the container to run the OpenVPN service on port 1194/UDP. You have to change the CONTAINER_NAME.

  docker run -d \
  --name=CONTAINER_NAME \
  -v /path/host/openvpn-config:/etc/openvpn \
  -p 1194:1194/udp \
  --cap-add=NET_ADMIN \
  --restart unless-stopped \
  yerayvillamarin/openvpn-arm64v8
  

  Copy

• Generate a client certificate without a passphrase. You have to change CLIENTNAME to a user name. This name must be unique.

  docker run -v /path/host/openvpn-config:/etc/openvpn --rm -it yerayvillamarin/openvpn-arm64v8 easyrsa build-client-full CLIENTNAME nopass
  

  Copy

• Finally, we will extract the client configuration with embedded certificates into an .ovpn file.

  docker run -v /path/host/openvpn-config:/etc/openvpn --rm yerayvillamarin/openvpn-arm64v8 ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn
  

  Copy

  The CLIENTNAME.ovpn file will be saved in the current path of our host.

⁠How to create new clients

In order to allow new clients / devices to connect to our server at the same time, we need to create new client certificates. For this we have to execute the last two commands of the initial configuration.

• Generate a client certificate without a passphrase. You have to change CLIENTNAME to a user name. This name must be unique.

  docker run -v /path/host/openvpn-config:/etc/openvpn --rm -it yerayvillamarin/openvpn-arm64v8 easyrsa build-client-full CLIENTNAME nopass
  

  Copy

• Finally, we will extract the client configuration with embedded certificates into an .ovpn file.

  docker run -v /path/host/openvpn-config:/etc/openvpn --rm yerayvillamarin/openvpn-arm64v8 ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn
  

  Copy

  The CLIENTNAME.ovpn file will be saved in the current path of our host.

⁠How to revoke client certificates

• If we want to block the connection of a created client.

  docker run --rm -it -v /path/host/openvpn-config:/etc/openvpn yerayvillamarin/openvpn-arm64v8 ovpn_revokeclient CLIENTNAME
  

  Copy

• And if we want to remove their corresponding files too, we only have to pass the parameter remove.

  docker run --rm -it -v /path/host/openvpn-config:/etc/openvpn yerayvillamarin/openvpn-arm64v8 ovpn_revokeclient CLIENTNAME remove
  

  Copy

⁠How to connect

In order to connect to the server from the client we need the CLIENTNAME.ovpn file generated when creating the client. This file contains the information for the connection and the necessary keys.

• Pass CLIENTNAME.ovpn file to the device from where we want to connect.
• Download OpenVPN Connect. (This is multiplatform)
• Inside the OpenVPN application import the file CLIENTNAME.ovpn

As in the creation of the users we passed the parameter nopass, we could already connect without the need to set passwords. If we want more security in our client we can create the user without nopass and this way it will ask for a password for that client.

Remember to open port 1194/UDP in the router and route it to the IP where this container is located.

⁠Useful Commands

• See an overview of the configured clients, including revocation and expiration status

  docker run --rm -it -v /path/host/openvpn-config:/etc/openvpn yerayvillamarin/openvpn-arm64v8 ovpn_listclients
  

  Copy

• View OpenVPN log

  docker logs CONTAINER_NAME
  

  Copy

⁠OpenVPN Details

We use tun mode, because it works on the widest range of devices. tap mode, for instance, does not work on Android, except if the device is rooted.

The topology used is net30, because it works on the widest range of OS. p2p, for instance, does not work on Windows.

The UDP server uses192.168.255.0/24 for dynamic clients by default.

The client profile specifies redirect-gateway def1, meaning that after establishing the VPN connection, all traffic will go through the VPN. This might cause problems if you use local DNS recursors which are not directly reachable, since you will try to reach them through the VPN and they might not answer to you. If that happens, use public DNS resolvers like those of Google (8.8.4.4 and 8.8.8.8) or OpenDNS (208.67.222.222 and 208.67.220.220).

⁠Security Discussion

The Docker container runs its own EasyRSA PKI Certificate Authority. This was chosen as a good way to compromise on security and convenience. The container runs under the assumption that the OpenVPN container is running on a secure host, that is to say that an adversary does not have access to the PKI files under /etc/openvpn/pki. This is a fairly reasonable compromise because if an adversary had access to these files, the adversary could manipulate the function of the OpenVPN server itself (sniff packets, create a new PKI CA, MITM packets, etc).

• The certificate authority key is kept in the container by default for simplicity. It's highly recommended to secure the CA key with some passphrase to protect against a filesystem compromise. A more secure system would put the EasyRSA PKI CA on an offline system (can use the same Docker image and the script ovpn_copy_server_files to accomplish this).
• It would be impossible for an adversary to sign bad or forged certificates without first cracking the key's passphase should the adversary have root access to the filesystem.
• The EasyRSA build-client-full command will generate and leave keys on the server, again possible to compromise and steal the keys. The keys generated need to be signed by the CA which the user hopefully configured with a passphrase as described above.
• Assuming the rest of the Docker container's filesystem is secure, TLS + PKI security should prevent any malicious host from using the VPN.

⁠Differences from kylemanna/openvpn

• The structure remains the same.
• The expiration time of all certificates has been increased to 10 years.
• The image is compiled for ARMv8 (ARM 64bit) architectures.

⁠Originally Tested On

• Docker hosts:
  • Raspberry Pi 4 model B with 8GB RAM
• Clients
  • Android App OpenVPN Connect 3.2.5
  • Windows 10 Pro x64 21H2 OpenVPN Connect 3.3.4 (2600)