{"id":13811641,"url":"https://github.com/umputun/dockvpn","last_synced_at":"2025-05-14T19:33:51.513Z","repository":{"id":34396630,"uuid":"38324248","full_name":"umputun/dockvpn","owner":"umputun","description":"Recipe to build an OpenVPN image for Docker","archived":false,"fork":true,"pushed_at":"2023-09-13T13:31:33.000Z","size":20,"stargazers_count":123,"open_issues_count":3,"forks_count":59,"subscribers_count":7,"default_branch":"master","last_synced_at":"2024-03-08T18:35:21.269Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"jpetazzo/dockvpn","license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/umputun.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-06-30T17:52:17.000Z","updated_at":"2024-01-23T17:26:08.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/umputun/dockvpn","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/umputun%2Fdockvpn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/umputun%2Fdockvpn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/umputun%2Fdockvpn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/umputun%2Fdockvpn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/umputun","download_url":"https://codeload.github.com/umputun/dockvpn/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225307816,"owners_count":17453880,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T04:00:26.170Z","updated_at":"2024-11-19T06:32:35.378Z","avatar_url":"https://github.com/umputun.png","language":"Shell","funding_links":[],"categories":["CLI tools"],"sub_categories":["Networking"],"readme":"# OpenVPN for Docker\n\n**the original project - [jpetazzo/dockvpn](https://github.com/jpetazzo/dockvpn)** and it has its own [automatic build on dockerhub](https://hub.docker.com/r/jpetazzo/dockvpn/).\n\n\nQuick instructions:\n\n```bash\nCID=$(docker run -d --privileged -p 1194:1194/udp -p 443:443/tcp umputun/dockvpn)\ndocker run -t -i -p 8080:8080 --volumes-from $CID umputun/dockvpn serveconfig\n```\n\nOr run without logs:\n\n```bash\nCID=$(docker run -d --privileged -p 1194:1194/udp -p 443:443/tcp -e \"DISABLE_LOGS=1\" --log-driver none umputun/dockvpn)\ndocker run -t -i -p 8080:8080 -e \"DISABLE_LOGS=1\" --log-driver none --volumes-from $CID umputun/dockvpn serveconfig\n```\n\nDownload file with `curl`:\n```bash\ncurl -k https://[SERVER_IP]:8080/ \u003e ~/openvpn.ovpn\n```\n\nNow download the file located at the indicated URL. You will get a\ncertificate warning, since the connection is done over SSL, but we are\nusing a self-signed certificate. After downloading the configuration,\nstop the `serveconfig` container. You can restart it later if you need\nto re-download the configuration, or to download it to multiple devices.\n\nThe file can be used immediately as an OpenVPN profile. It embeds all the\nrequired configuration and credentials. It has been tested successfully on\nLinux, Windows, and Android clients. If you can test it on OS X and iPhone,\nlet me know!\n\n**Note:** there is a [bug in the Android Download Manager](\nhttp://code.google.com/p/android/issues/detail?id=3492) which prevents\ndownloading files from untrusted SSL servers; and in that case, our\nself-signed certificate means that our server is untrusted. If you\ntry to download with the default browser on your Android device,\nit will show the download as \"in progress\" but it will remain stuck.\nYou can download it with Firefox; or you can transfer it with another\nway: Dropbox, USB, micro-SD card...\n\nIf you reboot the server (or stop the container) and you `docker run`\nagain, you will create a new service (with a new configuration) and\nyou will have to re-download the configuration file. However, you can\nuse `docker start` to restart the service without touching the configuration.\n\n\n## How does it work?\n\nWhen the `jpetazzo/openvpn` image is started, it generates:\n\n- Diffie-Hellman parameters,\n- a private key,\n- a self-certificate matching the private key,\n- two OpenVPN server configurations (for UDP and TCP),\n- an OpenVPN client profile.\n\nThen, it starts two OpenVPN server processes (one on 1194/udp, another\non 443/tcp).\n\nThe configuration is located in `/etc/openvpn`, and the Dockerfile\ndeclares that directory as a volume. It means that you can start another\ncontainer with the `--volumes-from` flag, and access the configuration.\nConveniently, `jpetazzo/openvpn` comes with a script called `serveconfig`,\nwhich starts a pseudo HTTPS server on `8080/tcp`. The pseudo server\ndoes not even check the HTTP request; it just sends the HTTP status line,\nheaders, and body right away.\n\n\n## OpenVPN details\n\nWe use `tun` mode, because it works on the widest range of devices.\n`tap` mode, for instance, does not work on Android, except if the device\nis rooted.\n\nThe topology used is `net30`, because it works on the widest range of OS.\n`p2p`, for instance, does not work on Windows.\n\nThe TCP server uses `192.168.255.0/25` and the UDP server uses\n`192.168.255.128/25`.\n\nThe client profile specifies `redirect-gateway def1`, meaning that after\nestablishing the VPN connection, all traffic will go through the VPN.\nThis might cause problems if you use local DNS recursors which are not\ndirectly reachable, since you will try to reach them through the VPN\nand they might not answer to you. If that happens, use public DNS\nresolvers like those of Google (8.8.4.4 and 8.8.8.8) or OpenDNS\n(208.67.222.222 and 208.67.220.220).\n\n\n## Security discussion\n\nFor simplicity, the client and the server use the same private key and\ncertificate. This is certainly a terrible idea. If someone can get their\nhands on the configuration on one of your clients, they will be able to\nconnect to your VPN, and you will have to generate new keys. Which is,\nby the way, extremely easy, since each time you `docker run` the OpenVPN\nimage, a new key is created. If someone steals your configuration file\n(and key), they will also be able to impersonate the VPN server (if they\ncan also somehow hijack your connection).\n\nIt would probably be a good idea to generate two sets of keys.\n\nIt would probably be even better to generate the server key when\nrunning the container for the first time (as it is done now), but\ngenerate a new client key each time the `serveconfig` command is\ncalled. The command could even take the client CN as argument, and\nanother `revoke` command could be used to revoke previously issued\nkeys.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fumputun%2Fdockvpn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fumputun%2Fdockvpn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fumputun%2Fdockvpn/lists"}