OpenVPN server in a Docker container complete with an EasyRSA PKI CA.
-
Pick a name for the
$OVPN_DATA
data volume container. It's recommended to use theovpn-data-
prefix to operate seamlessly with the reference systemd service. Users are encourage to replaceexample
with a descriptive name of their choosing.OVPN_DATA="ovpn-data-example"
-
Initialize the
$OVPN_DATA
container that will hold the configuration files and certificates. The container will prompt for a passphrase to protect the private key used by the newly generated certificate authority.docker volume create --name $OVPN_DATA docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig -u udp://VPN.SERVERNAME.COM docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn ovpn_initpki
-
Start OpenVPN server process
docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
-
Generate a client certificate without a passphrase
docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn easyrsa build-client-full CLIENTNAME nopass
-
Retrieve the client configuration with embedded certificates
docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn
A systemd
init script is available to manage the OpenVPN container. It will
start the container on system boot, restart the container if it exits
unexpectedly, and pull updates from Docker Hub to keep itself up to date.
Please refer to the systemd documentation to learn more.
If you prefer to use docker-compose
please refer to the documentation.
-
Create an environment variable with the name DEBUG and value of 1 to enable debug output (using "docker -e").
docker run -v $OVPN_DATA:/etc/openvpn -p 1194:1194/udp --cap-add=NET_ADMIN -e DEBUG=1 kylemanna/openvpn
-
Test using a client that has openvpn installed correctly
openvpn --config CLIENTNAME.ovpn
-
Run through a barrage of debugging checks on the client if things don't just work
ping 8.8.8.8 # checks connectivity without touching name resolution dig google.com # won't use the search directives in resolv.conf nslookup google.com # will use search
-
Consider setting up a systemd service for automatic start-up at boot time and restart in the event the OpenVPN daemon or Docker crashes.
Initialize the volume container using the kylemanna/openvpn
image with the
included scripts to automatically generate:
- Diffie-Hellman parameters
- a private key
- a self-certificate matching the private key for the OpenVPN server
- an EasyRSA CA key and certificate
- a TLS auth key from HMAC security
The OpenVPN server is started with the default run cmd of ovpn_run
The configuration is located in /etc/openvpn
, and the Dockerfile
declares that directory as a volume. It means that you can start another
container with the -v
argument, and access the configuration.
The volume also holds the PKI keys and certs so that it could be backed up.
To generate a client certificate, kylemanna/openvpn
uses EasyRSA via the
easyrsa
command in the container's path. The EASYRSA_*
environmental
variables place the PKI CA under /etc/openvpn/pki
.
Conveniently, kylemanna/openvpn
comes with a script called ovpn_getclient
,
which dumps an inline OpenVPN client configuration file. This single file can
then be given to a client for access to the VPN.
To enable Two Factor Authentication for clients (a.k.a. OTP) see this document.
We use tun
mode, because it works on the widest range of devices.
tap
mode, for instance, does not work on Android, except if the device
is rooted.
The topology used is net30
, because it works on the widest range of OS.
p2p
, for instance, does not work on Windows.
The UDP server uses192.168.255.0/24
for dynamic clients by default.
The client profile specifies redirect-gateway def1
, meaning that after
establishing the VPN connection, all traffic will go through the VPN.
This might cause problems if you use local DNS recursors which are not
directly reachable, since you will try to reach them through the VPN
and they might not answer to you. If that happens, use public DNS
resolvers like those of Google (8.8.4.4 and 8.8.8.8) or OpenDNS
(208.67.222.222 and 208.67.220.220).