theohbrothers/docker-openvpn repository overview
docker-openvpn
Dockerized openvpn.
easy-rsa is not included, since is not best practice to be signing or be able to sign certs on the server. it is better to run easy-rsa in a separate container.
Tags
| Tag | Dockerfile Build Context |
|---|---|
:2.6.14-alpine-3.22, :latest | View |
:2.6.11-alpine-3.18 | View |
:2.5.10-alpine-3.17 | View |
:2.4.12-alpine-3.12 | View |
:2.4.11-alpine-3.11 | View |
:2.4.11-alpine-3.10 | View |
:2.4.6-alpine-3.9 | View |
:2.4.6-alpine-3.8 | View |
:2.4.4-alpine-3.7 | View |
:2.4.4-alpine-3.6 | View |
:2.3.18-alpine-3.5 | View |
:2.3.18-alpine-3.4 | View |
:2.3.18-alpine-3.3 | View |
Usage
It is assumed that you have knowledge of configuring openvpn. If needed, refer to the official manuals:
To run the image, at the least you should mount a /etc/openvpn/server.conf, which may be a unified openvpn profile (see INLINE FILE SUPPORT section in the openvpn manual).
docker run --rm -it --cap-add NET_ADMIN -v /path/to/server.conf:/etc/openvpn/server.conf theohbrothers/docker-openvpn:2.6.14-alpine-3.22
Environment variables
The defaults should work, so that there should be no need to specify any environment variable when running the container.
| Environment variables | Description | Default Value |
|---|---|---|
OPENVPN_CONFIG_FILE | Absolute path to the server config | /etc/openvpn/server.conf |
OPENVPN_ROUTES | Space-delimited CIDRs to add iptables POSTROUTING MASQUERADE rules, performed only when NAT=1 and NAT_MASQUERADE=1 | 192.168.50.0/24 192.168.51.0/24 |
NAT | Whether to use NAT. 0 to disable. 1 to enable. | 1 |
NAT_INTERFACE | Interface on which to use NAT. E.g. eth0 | eth0 |
NAT_MASQUERADE | Whether to add iptables POSTROUTING MASQUERADE rules, if NAT=1. 0 to disable. 1 to enable. Disable this if running as a client. | 1 |
CUSTOM_FIREWALL_SCRIPT | Full path to a custom script for firewall. If present, this script is executed before any other iptables rules are provisioned | /etc/openvpn/firewall.sh |
docker-entrypoint.sh
The entrypoint script performs (in order):
- Normalize environment variables
- Provision the
tundevice - Execute the
CUSTOM_FIREWALL_SCRIPTif it exists - Provision a
NATPOSTROUTING iptables rule for tunnel-to-world packets - Provision a
NATPOSTROUTING iptables rule each entry inOPENVPN_ROUTES - List iptables
- Generate the final
openvpncommand line
IPv4 and IPv6 forwarding
If not already enabled on the host, ipv4 and ipv6 forwarding may be enabled at container runtime by using the sysctls key in docker-compose.yml, or with --sysctl flag in docker-run
Development
Requires Windows powershell or pwsh.
# Install Generate-DockerImageVariants module: https://github.com/theohbrothers/Generate-DockerImageVariants
Install-Module -Name Generate-DockerImageVariants -Repository PSGallery -Scope CurrentUser -Force -Verbose
# Edit ./generate templates
# Generate the variants
Generate-DockerImageVariants .
Tag summary
Content type
Image
Digest
sha256:c17addbee…
Size
3.7 MB
Last updated
about 1 year ago
docker pull theohbrothers/docker-openvpn:20250606.0.0-18b9050-2.4.6-alpine-3.8