{"id":20811329,"url":"https://github.com/express42/openvpn","last_synced_at":"2025-05-07T09:25:47.129Z","repository":{"id":12336731,"uuid":"14977539","full_name":"express42/openvpn","owner":"express42","description":"Express 42 openvpn cookbook","archived":false,"fork":false,"pushed_at":"2017-05-10T10:47:32.000Z","size":77,"stargazers_count":0,"open_issues_count":0,"forks_count":5,"subscribers_count":23,"default_branch":"master","last_synced_at":"2025-03-31T08:38:48.296Z","etag":null,"topics":["chef","cookbooks","openvpn"],"latest_commit_sha":null,"homepage":"","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/express42.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2013-12-06T08:28:58.000Z","updated_at":"2024-05-11T21:17:12.000Z","dependencies_parsed_at":"2022-09-10T14:40:30.325Z","dependency_job_id":null,"html_url":"https://github.com/express42/openvpn","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/express42%2Fopenvpn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/express42%2Fopenvpn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/express42%2Fopenvpn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/express42%2Fopenvpn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/express42","download_url":"https://codeload.github.com/express42/openvpn/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252849459,"owners_count":21813812,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["chef","cookbooks","openvpn"],"created_at":"2024-11-17T20:40:16.394Z","updated_at":"2025-05-07T09:25:47.106Z","avatar_url":"https://github.com/express42.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Build Status](https://travis-ci.org/express42/openvpn.svg?branch=master)](https://travis-ci.org/express42/openvpn)\n\n# Description\n\nInstalls and configures OpenVPN.\n\n# Requirements\n\n## Platform:\n\n* Ubuntu\n* RHEL\n* CentOS\n\n## Gems:\n\n* knife-openvpn\n\n# Attributes\n\n## Default\n\n* `node['openvpn']['server_name']` -  Defaults to `\"default\"`.\n* `node['openvpn']['install_epel']` -  Defaults to `true`.\n* `node['openvpn']['default']['remote_host']` -  Defaults to `\"vpn.example.com\"`.\n* `node['openvpn']['default']['server_ip']` -  Defaults to `\"127.0.0.1\"`.\n* `node['openvpn']['default']['port']` -  Defaults to `\"1194\"`.\n* `node['openvpn']['default']['proto']` -  Defaults to `\"udp\"`.\n* `node['openvpn']['default']['dev']` -  Defaults to `\"tun\"`.\n* `node['openvpn']['default']['mode']` -  Defaults to `\"routed\"`.\n* `node['openvpn']['default']['netmask']` -  Defaults to `\"255.255.255.0\"`.\n* `node['openvpn']['default']['subnet']` -  Defaults to `\"127.0.1.0\"`.\n* `node['openvpn']['default']['network_bridge']` -  Defaults to `\"br0\"`.\n* `node['openvpn']['default']['network_interface']` -  Defaults to `\"eth0\"`.\n* `node['openvpn']['default']['dhcp_start']` -  Defaults to `\"127.0.0.100\"`.\n* `node['openvpn']['default']['dhcp_end']` -  Defaults to `\"127.0.0.150\"`.\n* `node['openvpn']['default']['verb']` -  Defaults to `\"3\"`.\n* `node['openvpn']['default']['push']` -  Defaults to `\"[ ... ]\"`.\n* `node['openvpn']['default']['duplicate_cn']` -  Defaults to `\"false\"`.\n* `node['openvpn']['default']['client_to_client']` -  Defaults to `\"false\"`.\n* `node['openvpn']['default']['keepalive_interval']` -  Defaults to `\"10\"`.\n* `node['openvpn']['default']['keepalive_timeout']` -  Defaults to `\"60\"`.\n* `node['openvpn']['default']['comp_lzo']` -  Defaults to `\"true\"`.\n* `node['openvpn']['default']['link_mtu']` -  Defaults to `\"nil\"`.\n* `node['openvpn']['default']['tun_mtu']` -  Defaults to `\"nil\"`.\n* `node['openvpn']['default']['cipher']` -  Defaults to `\"false\"`.\n* `node['openvpn']['default']['redirect_gateway']` -  Defaults to `\"false\"`.\n* `node['openvpn']['default']['push_dns_server']` -  Defaults to `\"false\"`.\n* `node['openvpn']['default']['script_security']` -  Defaults to `\"1\"`.\n* `node['openvpn']['default']['use_tls_auth']` -  Defaults to `\"true\"`.\n* `node['openvpn']['default']['chroot']` -  Defaults to `\"false\"`.\n* `node['openvpn']['default']['client_config_dir']` -  Defaults to `\"false\"`.\n* `node['openvpn']['default']['ccd_exclusive']` -  Defaults to `\"false\"`.\n* `node['openvpn']['default']['users']` -  Defaults to `\"[ ... ]\"`.\n* `node['openvpn']['default']['revoked_users']` -  Defaults to `\"[ ... ]\"`.\n* `node['openvpn']['default']['ifconfig_pool_persist']` - Defaults to `\"true\"`.\n* `node['openvpn']['client']['remote_servers']` - Defaults to `\"[ ... ]\"`.\n\n## Iptables\n\n* `node['openvpn']['iptables']['postrouting']` -  Defaults to `true`.\n* `node['openvpn']['iptables']['interface']` -  Defaults to `eth0`.\n\n## Sysctl\n\n* `node['openvpn']['ip_forward']` -  Defaults to `true`.\n\n# Recipes\n\n* openvpn::default - Installs and configures OpenVPN.\n* openvpn::sysctl - Configures IP forwarding via sysctl\n* openvpn::iptables - Configures postrouting via iptables\n* openvpn::client - Configures client connection to server\n\n# Server Modes\n\n* Routed\n\nFor routed network you must define vpn ```subnet```, like in previous example\n\n* Bridged\n\nBridged setup need more configuration and configured network bridge on your server\n\n```\n\"default_attributes\": {\n  \"openvpn\": {\n    \"server_name\": \"office\",\n    \"office\": {\n      \"remote_host\": \"vpn.example.com\",\n      \"server_ip\": \"10.90.5.5\",\n      \"port\": \"443\",\n      \"proto\": \"tcp\",\n      \"dev\": \"tap\",\n      \"verb\": \"3\",\n      \"mode\": \"bridged\",\n      \"script_security\": \"2\",\n      \"dhcp_start\": \"10.90.5.100\",\n      \"dhcp_end\": \"10.90.5.240\",\n      \"network_bridge\": \"br0\",\n      \"network_interface\": \"eth0\"\n    }\n  }\n}\n\n```\n\nSee fixture cookbook in `tests/fixtures/cookbooks`.\n\n\n# To-do\n\n1. Revoke access\n2. Import existing certs/keys\n3. Add support for client recipe-friendly config generation\n\n\n# Usage\n\nFor example you want to setup vpn server and call it ```office```\n\n* Ensure that you have ```.chef/encrypted_data_bag_secret```.\nOtherwise you can generate one with ```openssl rand -base64 512 \u003e .chef/encrypted_data_bag_secret```\n\n* Install knife plugin:\n\n  ```\n  gem install knife-openvpn\n  ```\n\n* Create server certificate authority, server cert/key, DH params:\n\n  ```\n  knife openvpn server create office\n  ```\n\n  ```office``` - is a name of vpn-server, there is some limitations on this: no dots, no commas, no spaces, no special symbols for reasons.\n\n* Great, now check ```data_bags``` directory, you will find new databag ```openvpn-office``` with few items for ca, dh, cert/key pair and some openssl config. Now it is time to upload it to Chef server:\n\n  ```\n  knife data bag create openvpn-office --secret-file=.chef/encrypted_data_bag_secret\n  knife data bag from file openvpn-office data_bags/openvpn-office/*\n  ```\n\n* Add ```recipe[openvpn]``` to node run_list, and override default attributes:\n\n  ```\n  \"run_list\": [\n  \"recipe[openvpn]\"\n  ],\n  \"default_attributes\": {\n    \"openvpn\": {\n      \"server_name\": \"office\",\n      \"office\": {\n        \"remote_host\": \"vpn.example.com\",\n        \"server_ip\": \"10.90.5.5\",\n        \"subnet\": \"10.200.1.0\",\n        \"port\": \"443\",\n        \"proto\": \"tcp\",\n        \"dev\": \"tun\",\n        \"verb\": \"3\",\n        \"push\": [\n        \"route 10.90.0.0 255.255.255.0\",\n        \"route 10.90.1.0 255.255.255.0\"\n        ]\n      }\n    }\n  }\n\n  ```\n\n* Add ```recipe[openvpn::sysctl]``` if you need to setup net.ipv4.ip_forward with this cookbook. ```node['openvpn']['ip_forward']``` should be set to ```true``` (it's ```true``` by default).\n\n* Add ```recipe[openvpn::iptables]``` if you need to setup nat postrouting with this cookbook.\n\n  Chef, run!\n\n* When server is up and running we can add some users to start use it.\nNo moar certificate management pain:\n\n  ```\n  knife openvpn user create office john\n  knife data bag from file openvpn-office data_bags/openvpn-office/john.json\n  ```\n\n* Export vpn-client data and send it to John:\n\n  ```\n  knife openvpn user export office john\n  ```\nresulting archive contains config (.ovpn), ca cert, John's cert and key\n\n* Revokation of user certificate is also possible:\n  ```\n  knife openvpn user revoke office john\n  knife data bag from file openvpn-office data_bags/openvpn-office/openvpn-crl.json\n  ```\n\n# Client configuration\n\n* Add ```recipe[openvpn::client]``` to run_list\n\n* Add data bag item for each server in ```node['openvpn']['client']['remote_servers']``` containing next elements (replace new lines with '\\n'):\n\n  ```\n  \"ca\" - contents of ca.crt generated with knife-openvpn\n  \"crt\" - contents of client's certificate\n  \"key\" - contents of client's private key\n  \"conf\" - contents of client's configuration\n  ```\n\n# License and Maintainer\n\nMaintainer:: LLC Express 42 (\u003ccookbooks@express42.com\u003e)\n\nLicense:: MIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fexpress42%2Fopenvpn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fexpress42%2Fopenvpn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fexpress42%2Fopenvpn/lists"}