docker-openvpn

OpenVPN server (or client) in a Docker container complete with an EasyRSA PKI CA.

Quick Start VPN server

• Prepare data storage in host folder

mkdir -p /data/openvpn

• Start OpenVPN server container

docker run \
    --name OPENVPN \
    --cap-add NET_ADMIN \
    -e OPENVPN_PROTO=tcp \
    -p 1194:1194 \
    -v "/data/openvpn:/openvpn" \
    tsaikd/openvpn

• Or you can alternatively start OpenVPN server with docker-compose

docker-compose up -d

• Generate a client certificate without a passphrase

docker exec "OPENVPN" easyrsa build-client-full CLIENTNAME nopass

• Retrieve the client configuration with embedded certificates
  • PROTO: tcp | udp
  • IP: openvpn server IP, used for connection of client
  • PORT: openvpn server port, used for connection of client

docker exec "OPENVPN" ovpn_getclient CLIENTNAME PROTO IP PORT > CLIENTNAME.ovpn

• Revoke the client certificate

docker exec "OPENVPN" ovpn_revoke CLIENTNAME

Issues

• CRL expired

  TCP connection established with [AF_INET]XXX.XXX.XXX.XXX:XXXXX
  TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:XXXXX, sid=XXXXXXXX XXXXXXXX
  VERIFY ERROR: depth=0, error=CRL has expired: CN=XXXXX
  OpenSSL: error:140360B2:SSL routines:ACCEPT_SR_CERT:no certificate returned
  TLS_ERROR: BIO read tls_read_plaintext error
  TLS Error: TLS object -> incoming plaintext read error
  TLS Error: TLS handshake failed

run the following command to regenerate easyrsa CRL

docker exec "OPENVPN" easyrsa gen-crl

Reference

• https://github.com/kylemanna/docker-openvpn

OpenVPN client mode

• Create client docker container

docker run \
    --name VPNCLIENT \
    --cap-add NET_ADMIN \
    --device /dev/net/tun \
    -v "/data/CLIENTNAME.ovpn:/openvpn/client.ovpn" \
    tsaikd/openvpn \
    openvpn --config /openvpn/client.ovpn

• Use VPN in other containers

docker run \
    --net=container:VPNCLIENT \
    alpine:3.7

$ apk add --no-cache curl
$ curl http://ifconfig.io

UDP Mode

The OpenVPN documentation recommends using the UDP protocol :

The OpenVPN protocol itself functions best over just the UDP protocol. And by default the connection profiles that you can download from the Access Server are preprogrammed to always first try UDP, and if that fails, then try TCP

To do this you just need to change the environment variable to OPENVPN_PROTO=udp.

Then you specify to contact the udp protocol of your container by doing this : "1194:1194/udp"

So when you will create a client file, you just have to change from tcp to udp.