51 Security

Learning, Sharing, Creating

Docker VPN

[5 Mins Docker] One Command to Build Your Own OpenVPN Server – Multiple Ways

Bynetsec

Sep 28, 2023

The OpenVPN Community Edition (CE) is an open source Virtual Private Network (VPN) project. It creates secure connections over the Internet using a custom security protocol that utilizes SSL/TLS. This community-supported OSS (Open Source Software) project, using a GPL license, is supported by many OpenVPN Inc. developers and contributors as well as the extended OpenVPN community. CE is free to deploy, but it does require a strong understanding of Linux and using the command line interface.

The OpenVPN tunneling protocol uses the Secure Socket Layer (SSL) encryption protocol to ensure data shared via the Internet remains private using AES-256 encryption. Because the code is available for audits, anyone can find — and fix — vulnerabilities. It’s not only considered the most secure VPN tunneling protocol, it also delivers faster connections and can bypass most firewalls.

Diagram

Pre-requirements

Free resources you will need to build this docker project:

Pre-installed services:
  • Docker, Docker-Compose (Using Ubuntu OS for the commands)
    • apt update
    • apt install docker.io
    • apt install docker-compose
    • apt upgrade docker.io
  • Portainer (Optional)
    • docker volume create portainer_data
    • docker run -d -p 9000:9000 –name portainer –restart always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest
  • aapanel with Nginx (Optional)
  • Nginx Proxy Manager (Optional)

Docker Run or Docker-Compose

Github Project:  https://github.com/dockovpn/dockovpn

Prerequisites

To get started with this one command Docker OpenVPN installation, you’ll have to have a few things:

  • Linux server
  • Public IP address
  • Docker

Steps

1 Install docker

  • apt update
  • apt install docker.io

2 run one line command

Original command from Github

docker run -it --rm --cap-add=NET_ADMIN \
-p 1194:1194/udp -p 80:8080/tcp \
-e HOST_ADDR=$(curl -s https://api.ipify.org) \
--name dockovpn alekslitvinenk/openvpn
A little bit modification with -d option:
docker run -itd --rm --cap-add=NET_ADMIN \
-p 1194:1194/udp -p 80:8080/tcp \
-e HOST_ADDR=$(curl -s https://api.ipify.org) \
--name dockovpn alekslitvinenk/openvpn

More with persisting configuraiton:

You will need to create a local folder at /opt/Dockovpn_data folder first.
docker run -itd --rm --cap-add=NET_ADMIN \
-p 1194:1194/udp -p 80:8080/tcp \
-e HOST_ADDR=$(curl -s https://api.ipify.org) \
--name dockovpn alekslitvinenk/openvpn \
-v openvpn_conf:/opt/Dockovpn_data

3 Outputs

root@ub20-1-test:~# docker run -itd --rm --cap-add=NET_ADMIN \
> -p 1194:1194/udp -p 80:8080/tcp \
> -e HOST_ADDR=$(curl -s https://api.ipify.org) \
> --name dockovpn alekslitvinenk/openvpn
Unable to find image 'alekslitvinenk/openvpn:latest' locally
latest: Pulling from alekslitvinenk/openvpn
29291e31a76a: Pull complete
ee9d0fc0608b: Pull complete
050f6b5684f5: Pull complete
3df1fe3bf9f7: Pull complete
7663deeb3206: Pull complete
ee20c2e12945: Pull complete
Digest: sha256:86480f318120c9db963cd431ed08cd240c5eac1c3f74de689476ab68a4666765
Status: Downloaded newer image for alekslitvinenk/openvpn:latest
45f835677b614b285826a6bdfdd735ae9b24307b3605b58d27cd9a858837a4b7
root@ub20-1-test:~#
Make sure your VPS opened two ports: tcp 80, and udp 1194. 

4 open http://<Public IP> to get your client profile which will be imported to your OpenVPN Client. 

Once this http port accessed, it will be automatically shutted down. No more http opened to the world. 

5 Download OpenVPN Client for Windows

OpenVPN Connect – Client Software For Windows | OpenVPN

Double click to install it.

6 Run OpenVPN client and import step 4’s downloaded file 

You will see your vpn profile has been added . Click connect:

Super Simple and easy:

Verify your ip address from What Is My IP? Best Way To Check Your Public IP Address  and speed from Internet Speed Test | Fast.com. Your Public ip will be changed to your VPS’s ip now. 

The downside of it is the speed performance might be limited by both of your VPS and internet connection. 

Notes:

  • Log into Dockovpn, docker exec -it dockovpn /bin/bash
  • Logs are in the folder /opt/log/Dockvpn/openvpn-status.log
  • It supports more than 2 concurrent sessions. Here are four concurrent sessions in the log:
bash-5.1# cat openvpn-status.log
OpenVPN CLIENT LIST
Updated,2023-09-02 14:53:15
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
o4A2MZCT1WIod3gBZwf7TJpa5ZKzIKWQ,160.32.192.102:61313,3279343,130756,2023-09-02 14:52:51
o4A2MZCT1WIod3gBZwf7TJpa5ZKzIKWQ,160.32.192.102:52765,1945156,8131199,2023-09-02 14:50:50
o4A2MZCT1WIod3gBZwf7TJpa5ZKzIKWQ,160.32.192.102:62549,26651919,702882451,2023-09-02 14:29:15
o4A2MZCT1WIod3gBZwf7TJpa5ZKzIKWQ,160.32.192.102:56676,1355538,34810046,2023-09-02 14:19:56
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.14,o4A2MZCT1WIod3gBZwf7TJpa5ZKzIKWQ,160.32.192.102:52765,2023-09-02 14:53:14
10.8.0.18,o4A2MZCT1WIod3gBZwf7TJpa5ZKzIKWQ,160.32.192.102:61313,2023-09-02 14:53:05
10.8.0.6,o4A2MZCT1WIod3gBZwf7TJpa5ZKzIKWQ,160.32.192.102:56676,2023-09-02 14:53:14
10.8.0.10,o4A2MZCT1WIod3gBZwf7TJpa5ZKzIKWQ,160.32.192.102:62549,2023-09-02 14:53:14
GLOBAL STATS
Max bcast/mcast queue length,0
END
bash-5.1#

version:

bash-5.1# openvpn --version
OpenVPN 2.5.6 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Mar 24 2022
library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2022 OpenVPN Inc <[email protected]>
Compile time defines: enable_async_push='no' enable_comp_stub='no' enable_crypto_ofb_cfb='yes' enable_debug='yes' enable_def_auth='yes' enable_dlopen='unknown' enable_dlopen_self='unknown' enable_dlopen_self_static='unknown' enable_fast_install='yes' enable_fragment='yes' enable_iproute2='yes' enable_libtool_lock='yes' enable_lz4='yes' enable_lzo='yes' enable_management='yes' enable_multihome='yes' enable_pam_dlopen='no' enable_pedantic='no' enable_pf='yes' enable_pkcs11='no' enable_plugin_auth_pam='yes' enable_plugin_down_root='yes' enable_plugins='yes' enable_port_share='yes' enable_selinux='no' enable_shared='yes' enable_shared_with_static_runtimes='no' enable_small='no' enable_static='yes' enable_strict='no' enable_strict_options='no' enable_systemd='no' enable_werror='no' enable_win32_dll='yes' enable_x509_alt_username='yes' with_aix_soname='aix' with_crypto_library='openssl' with_gnu_ld='yes' with_mem_check='no' with_sysroot='no'

Client file:

bash-5.1# find / -type f -name "*.ovpn"
/opt/Dockovpn/config/client.ovpn
/opt/Dockovpn_data/clients/o4A2MZCT1WIod3gBZwf7TJpa5ZKzIKWQ/client.ovpn

Install from Cloud Provider’s Marketplace

From Oracle

1 Log in to Oracle Cloud Account

2 From Dropdown menu to choose marketplace then choose all applications

3 Search OpenVPN

4 Lauch Instance

5 Create a free instance

Make sure ports 80/443/943, 1194 are open to the public.

Direction Source Type Source Protocol Source Port Destination Port
Ingress CIDR 0.0.0.0/0 TCP All 943
Ingress CIDR 0.0.0.0/0 TCP All 22
Ingress CIDR 0.0.0.0/0 TCP All 443
Ingress CIDR 0.0.0.0/0 TCP All 945
Ingress CIDR 0.0.0.0/0 UDP All 1194
You might need more ports, please check the quick start guide at https://openvpn.net/vpn-server-resources/oracle-quick-start-guide/

One Command to Install OpenVPN

Github Project: openvpn-install

Run the script and follow the prompts:

wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh

Once it ends, you can run it again to add more users, remove some of them or even completely uninstall OpenVPN.

Note: wireguard-install is also available.
After completed the installation, you will need to use WINSCP or similar tool to download OpenVPN client configuraiton file. 
WINSCP Configuration:
Escalate your SFTP privilege :
Without su privilege, you wont be able to go to other folder to download / copy files.
sudo su -c /usr/libexec/openssh/sftp-server

Change Shell permission after logged in. 

Install OpenVPN from Repository

 

Install OpenVPN Access Server Commands (Ubuntu):
  • wget -qO – https://as-repository.openvpn.net/as-repo-public.gpg | apt-key add –
  • echo “deb http://as-repository.openvpn.net/as/debian focal main”>/etc/apt/sources.list.d/openvpn-as-repo.list
  • apt update
  • apt install openvpn-as
Web Access:
  • https://<your-ip>:943/admin
    • using following command set up password for admin user openvpn
    • passwd openvpn
  • https://<your-ip>:943
    • client access. You will need to create a user from admin portal and set up a password for this client first.

Videos

 

By netsec

Related Post

Docker

[5 Mins Docker] Deploy Your Own Online Toolbox – IT-Tools

Oct 6, 2024 netsec
Docker

[5 Mins Docker] Online Web Proxy Projects to Hide Your IP or Reverse Proxy to Access Other Websites

Oct 6, 2024 netsec
Docker

[5 Mins Docker] Deploy a free, simple and safe honeypot with Own Domain – HFISH

Oct 6, 2024 netsec

Leave a Reply

You missed

Vulnerability Scan

Tenable Web Application Cerdential Scans For Web Appications and APIs

2024-10-30 netsec
CyberArk

Steps to Update/Renew Your CyberArk Infrastrucure Certificates (PSM)

2024-10-30 netsec
Vulnerability Scan

Tenable Lab Steps and Notes – Part 1 (Discovery, NNM, Assessment, Plugins, Compliance, VPR, Analysis)

2024-10-30 netsec
Vulnerability Scan

Tenable Lab Steps and Notes – Part 2 (Dashboards, Reports, Core, Nessus, NNM, Agent, Scanner Groups)

2024-10-30 netsec