Effortless OpenVPN Server Setup Using Docker Compose
Written on
Chapter 1: Understanding OpenVPN and VPNs
In this guide, we will explore the process of creating a client certificate for OpenVPN, which is essential for connecting to an OpenVPN server. OpenVPN is renowned for being an open-source application that provides a secure and adaptable virtual private network (VPN) solution.
But what exactly is a VPN? A VPN is a technology that establishes a secure and private connection between multiple devices over the internet, allowing users to access remote network resources as if they were on the same local network.
OpenVPN stands out as one of the most widely adopted VPN solutions due to its open-source nature, allowing anyone to access and contribute to its development. It is compatible with various operating systems, such as Windows, macOS, Linux, Android, and iOS, making it an excellent choice for multi-platform usage.
The primary benefit of OpenVPN lies in its robust security features. It utilizes a mix of encryption and authentication methods to ensure that VPN connections remain secure and private. Furthermore, OpenVPN is highly customizable, enabling users to modify settings to meet specific security requirements.
In summary, OpenVPN is a versatile, high-security, open-source VPN solution that suits a diverse range of platforms and environments. For more insights about OpenVPN, be sure to follow our blog for upcoming articles.
Section 1.1: Setting Up Your OpenVPN Server
To install the OpenVPN server, you need to create a docker-compose.yml file in your desired directory. This file should include the following configuration:
version: '2'
services:
openvpn:
cap_add:
- NET_ADMIN
image: kylemanna/openvpn # For ARM: mjenz/rpi-openvpn
container_name: openvpn
ports:
- "1194:1194/udp"
restart: always
volumes:
- ./openvpn-data/conf:/etc/openvpn
Next, initialize the configuration and certificate files by executing:
docker-compose run --rm openvpn ovpn_genconfig -u udp://<YOUR_SERVER_IP> -n CUSTOM_DNS
docker-compose run --rm openvpn ovpn_initpki
Make sure to adjust <YOUR_SERVER_IP> to reflect your server's IP address.
Section 1.2: Managing Permissions and Starting the Container
Adjust permissions for the OpenVPN data directory (this might be unnecessary if you operate as root):
sudo chown -R $(whoami): ./openvpn-data
Now, you can start the OpenVPN container with:
docker-compose up -d
To view container logs, use:
docker-compose logs -f
Chapter 2: Client Certificate Management
To generate a client certificate, set your client name:
export CLIENTNAME="el_nombre_del_cliente"
For a certificate with a password, run:
docker-compose run --rm openvpn easyrsa build-client-full $CLIENTNAME
For a certificate without a password, execute:
docker-compose run --rm openvpn easyrsa build-client-full $CLIENTNAME nopass
To create the client configuration file, use:
docker-compose run --rm openvpn ovpn_getclient $CLIENTNAME > $CLIENTNAME.ovpn
To revoke a client certificate, you can keep the .crt, .key, and .req files by running:
docker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME
To completely remove the corresponding files, use:
docker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME remove
To list registered users, execute:
docker run -v $OVPN_DATA:/etc/openvpn --rm $OVPN_IMAGE ovpn_listclients
The output will display registered users along with their certificate status:
name,begin,end,status
alice,Nov 16 16:25:45 2021 GMT,Feb 19 16:25:45 2024 GMT,VALID
bob,Nov 19 09:46:50 2021 GMT,Feb 22 09:46:50 2024 GMT,VALID
By following these steps, you will successfully set up a fully operational OpenVPN server using Docker Compose. Ensure that you configure security and authentication settings according to your needs.
This video titled "Running OpenVPN in Docker on Ubuntu" demonstrates how to effectively run OpenVPN in a Docker environment, providing a visual guide to the setup process.
In "5 Minutes to Create OpenVPN Service Using Docker," viewers can quickly learn how to create an OpenVPN service using Docker, making the process accessible and efficient.
If you found this article helpful and wish to support my work, please consider buying me a coffee ☕️ via the BuyMeACoffee link.