yukifolf/docker-openvpn repository overview

⁠OpenVPN for Docker

OpenVPN server in a Docker container, complete with an EasyRSA PKI certificate authority. Run a full VPN server — keys, certs, and config included — in a single self-contained image.

⁠Supported tags

• latest — current stable build
• <version> — pinned release tags (recommended for production)

⁠Why this image

• Self-contained — the OpenVPN daemon and all dependencies ship in the image, so you can run a bleeding-edge server on an old, stable host without touching system libraries.
• Distribution-agnostic — works identically on Ubuntu, Debian, Arch, Fedora, and anything else that runs Docker.
• Clean footprint — everything lives in the image plus a single data volume. Remove the container, volume, and image, and it's gone — no files scattered across the host.
• Built-in PKI — an EasyRSA certificate authority is generated for you; client profiles are exported as a single inline .ovpn file.
• Sensible defaults — tun mode and net30 topology for the widest device and OS compatibility, including Android and Windows.

⁠Quick Start

Replace VPN.SERVERNAME.COM with your server's public hostname or IP.

1. Pick a data volume name (the ovpn-data- prefix works seamlessly with the reference systemd service):

OVPN_DATA="ovpn-data-example"

2. Initialize config and the PKI (you'll be prompted for a CA passphrase):

docker volume create --name $OVPN_DATA
docker run -v $OVPN_DATA:/etc/openvpn --rm yukifolf/docker-openvpn:tagname ovpn_genconfig -u udp://VPN.SERVERNAME.COM
docker run -v $OVPN_DATA:/etc/openvpn --rm -it yukifolf/docker-openvpn:tagname ovpn_initpki

3. Start the server:

docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN yukifolf/docker-openvpn:tagname

4. Generate a client certificate (omit nopass to protect the client key with a passphrase):

docker run -v $OVPN_DATA:/etc/openvpn --rm -it yukifolf/docker-openvpn:tagname easyrsa build-client-full CLIENTNAME nopass

5. Export the client profile:

docker run -v $OVPN_DATA:/etc/openvpn --rm yukifolf/docker-openvpn:tagname ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn

Hand CLIENTNAME.ovpn to the client and connect with openvpn --config CLIENTNAME.ovpn.

⁠How it works

On initialization the image generates Diffie-Hellman parameters, a server private key and matching self-certificate, an EasyRSA CA key and certificate, and a TLS-auth HMAC key. All of this — config and PKI — is stored under /etc/openvpn, which is declared as a volume so it persists and can be backed up. The server runs via the default ovpn_run command. By default the UDP server hands out 192.168.255.0/24 to dynamic clients, and client profiles use redirect-gateway def1 so all traffic flows through the VPN once connected.

⁠Two-factor authentication

OTP-based 2FA for clients is supported. See the OTP documentation⁠ in the docs folder.

⁠Documentation

More advanced configuration — Docker Compose, systemd init scripts, static client IPs, and other write-ups — is available in the docs folder⁠ of the GitHub repository⁠.

⁠Security notes

The container runs its own EasyRSA PKI CA, trading some security for convenience under the assumption that the host is trusted — anyone with access to the PKI files under /etc/openvpn/pki could compromise the server. Recommendations:

• Always protect the CA key with a passphrase. Without the passphrase, an attacker with filesystem access still cannot sign forged certificates.
• For higher assurance, keep the CA on an offline system — the same image plus ovpn_copy_server_files can move server files off the signing host.
• Note that build-client-full leaves client keys on the server; treat the host filesystem accordingly.

Assuming the host filesystem is secure, TLS + PKI prevents any unauthorized host from using the VPN.

⁠Credits

Based on the original work by Kyle Manna. This fork is maintained by Wojciech Szyjka with ongoing improvements and updates.

Source code and issues: github.com/yukifolf/docker-openvpn⁠