robonuka/openvpn repository overview

⁠OpenVPN server

⁠It is yet another docker version of OpenVPN server with some conveniences

Homepage of sources: https://openvpn.net/community-downloads/⁠

The reasons are: PKCS11 and DCO modules absence in Alpine's OpenVPN and whole unstable situation with OpenVPN package building in Alpine Linux at all.

ALPINE:
OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]

DEBIAN:
OpenVPN 2.6.16 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]

This docker image has some scripts for simplifying ordinary Easy-RSA tasks.

⁠Install and run OpenVPN server

To make a permanent docker volume for storing any OpenVPN and Easy-RSA CA settings and data please create the /opt/openvpn folder on the host of your OpenVPN server, and put this docker-compose.yml file anywhere you want in this host:

services:
  openvpn:
    container_name: openvpn
    image: robonuka/openvpn:latest
    restart: unless-stopped
    network_mode: 'host'
    privileged: true
    ulimits:
      memlock:
        soft: -1
        hard: -1
    environment:
      - 'TUNX=tun0'
      - 'PROTOCOL=tcp4'
      - 'PORT=1194'
      - 'EASYRSA_ALGO=ed'
      - 'TLS_VERSION_MIN=1.3'
      - 'TLS_CIPHERSUITES=TLS_AES_256_GCM_SHA384'
      - 'DATA_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305'
      - 'DATA_CIPHERS_FALLBACK=AES-256-CBC'
      - 'AUTH=SHA256'
      - 'MAXCLIENTS=253'
      - 'SERVER_ADDR_PORT=example.com 1194'
      - 'SUBNET=10.8.0.0'
      - 'NETMASK=255.255.255.0'
      - 'DNS1=8.8.8.8'
      - 'DNS2=1.1.1.1'
      - 'KEY_COUNTRY=XX'
      - 'KEY_PROVINCE=XX'
      - 'KEY_CITY=XX'
      - 'KEY_ORG=XX'
      - '[email protected]'
      - 'KEY_OU=xxx'
      - 'CA_EXPIRE=3650'
      - 'CERT_EXPIRE=3650'
      - 'CRL_DAYS=3650'
      - 'VERB=4'
      - 'MUTE=20'
      - 'MANAGEMENT_IP=localhost'
      - 'MANAGEMENT_PORT=7505'
      - 'MANAGEMENT_PW_FILE=/etc/openvpn/server.pass'
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /opt/openvpn:/etc/openvpn

Then run docker container as usually:

cd /opt && sudo docker compose up -d openvpn

See the log of docker container with command:

sudo docker logs -f openvpn

⁠Important notes:

1. OpenVPN server re-generate it's server.conf file everytime when you start the container.
2. If you want to use your own/custom server.conf file you should add # symbol in begin of the 1st line of your server.conf file.

⁠Docker container environment variables description

⁠Commands to simple manage OpenVPN clients

⁠Show help info about available commands

sudo docker exec openvpn help

⁠Show userlist

sudo docker exec openvpn list [full]

⁠New user creation

sudo docker exec -ti [-e 'EASYRSA_ALGO=<rsa|ec|ed>'] openvpn create <new_username> [days]

Important notes:

1. Users private keys are stored encryped in СА. Private key encryption occurs while you creating a new user. You'll be asked about entering passphrase for private key encryption: Enter PEM pass phrase: and then again: Verifying - Enter PEM pass phrase:
   Advice to save entered passphrases in safe place. Each new user have to know his own private key passhrase when you'll send his personal .ovpn file to him.
   You should revoke user's certificate from CA immediately if you suspect that user's private key passphrase was compromised! Then investigate the reasons why private key passphrase was compromised, then fix these reasons and only then re-create this user again with a new private key passphrase.
2. You can create a new user only if there are no the same usernames exist in CA in active state.
3. In the usernames allowing only lowercase latin alphanumeric charaters, dots, dashes and underscores.

⁠Get user's personal .ovpn file

sudo docker exec openvpn get <tls_auth_method> <active_username> [key-passphrase]

Important notes:

1. You can't get .ovpn file for username server.
2. You can't get .ovpn file for any not exists or revoked user.

⁠Revoke user's certificate from CA

sudo docker exec -ti openvpn revoke <active_username>

Important notes:

1. You can't revoke the OpenVPN server's certificate.
2. You can't revoke certificate of an absent or already revoked user.

⁠Renew user's certificate

sudo docker exec openvpn renew <active/expired_username> [days]

Important notes:

1. You can't renew the OpenVPN server's certificate.
2. You can't renew certificate of an absent or already revoked user.
3. Renewing process will use the existing user's private key file. So you can't change private key encryption apgorhytm when you doing certificate renewing.
4. Certificate renewing process won't ask you about user's private key passphrase.