安裝 DockOVPN 的 OpenVPN Docker 方案

• 因為之前主要的 OpenVPN Docker 方案(Exp. kylemanna/openvpn, linuxserver/openvpn-as 似乎都已不再更新, 因此找了 DockOVPN 來安裝使用
• 目前 DockOVPN 版本是 v1.13.0 (Release:2023-10-28) 系統算是穩定, 但實際使用還是需要一些手動程序
• 安裝環境 :
  • VM : 1vCore, 1G RAM, 16G SSD
  • OS : Alpine 3.18 + Docker Compose
  • 參考 在 Alpine Linux 3 底下安裝 docker + docker-compose

modprobe ip_tables
echo 'ip_tables' >> /etc/modules

• 因應維護管理設定 OpenVPN Server 的方便性, 預計將以下目錄或設定檔掛載出來
  • /opt/Dockovpn → ./Dockovpn
  • /opt/Dockovpn_data → ./Dockovpn_data
  • /etc/openvpn/server.conf → ./Dockovpn/config/server.conf
• VPN Server : vpn.ichiayi.com
• docker-compose.yml

  version: '3'
  services:
      dockovpn:
          image: alekslitvinenk/openvpn:v1.13.0
          cap_add:
              - NET_ADMIN
          ports:
              - 80:8080/tcp
              - 1194:1194/udp
              - 5555:5555/tcp
          environment:
              - HOST_ADDR=vpn.ichiayi.com
              - HOST_TUN_PORT=1194
          container_name: dockovpn
          #volumes:
          #    - ./Dockovpn:/opt/Dockovpn
          #    - ./Dockovpn_data:/opt/Dockovpn_data
          #    - ./Dockovpn/config/server.conf:/etc/openvpn/server.conf
          restart: always

  第一次執行時, volumes 部分必須要註解起來, 否則會出錯

• 第一次啟動

  docker compose up -d

• 啟動後將 Dockovpn 與 Dockovpn_data 複製出來

  docker cp dockovpn:/opt/Dockovpn .
  docker cp dockovpn:/opt/Dockovpn_data .

• 將 Dockovpn 內的 genclient.sh 與 functions.sh 用 github 最新版本取代

  wget https://github.com/dockovpn/dockovpn/raw/master/scripts/genclient.sh -O ./Dockovpn/genclient.sh
  wget https://github.com/dockovpn/dockovpn/raw/master/scripts/functions.sh -O ./Dockovpn/functions.sh

• 依照實際需要修改 server.conf

  vi ./Dockovpn/config/server.conf

  port 1194
  proto udp
  dev tun
  
  cipher AES-256-GCM
  auth SHA512
  
  keepalive 10 120
  
  persist-key
  persist-tun
  
  crl-verify /etc/openvpn/crl.pem
  
  ca /etc/openvpn/ca.crt
  dh /etc/openvpn/dh.pem
  tls-auth /etc/openvpn/ta.key 0
  key /etc/openvpn/MyReq.key
  cert /etc/openvpn/MyReq.crt
  
  ifconfig-pool-persist ipp.txt
  status openvpn-status.log
  verb 4
  management 0.0.0.0 5555
  
  server 10.8.0.0 255.255.255.0
  push "redirect-gateway def1 bypass-dhcp"
  #push "dhcp-option DNS 1.1.1.1"
  #push "dhcp-option DNS 8.8.8.8"
  push "route 192.168.11.0 255.255.255.0"
  push "route 172.16.0.0 255.255.255.0"
  push "route 172.16.1.0 255.255.255.0"
  push "route 172.16.2.0 255.255.255.0"
  push "route 172.16.12.0 255.255.255.0"
  
  #duplicate-cn
  #ncp-ciphers AES-256-GCM:AES-256-CBC
  #tls-server
  #tls-version-min 1.2

• 將 vloumes 掛上, 重啟 dockovpn

  vi ./docker-compose.yml

  :
          container_name: dockovpn
          volumes:
              - ./Dockovpn:/opt/Dockovpn
              - ./Dockovpn_data:/opt/Dockovpn_data
              - ./Dockovpn/config/server.conf:/etc/openvpn/server.conf
          restart: always

  docker compose up -d

vi Dockovpn/config/server.conf

將 redirect-gateway 註解掉

:
#push "redirect-gateway def1 bypass-dhcp"
:

1. 修改 docker-compose.yml 將 port 由 1194:1194/udp 改成 443:443/tcp

           :
           ports:
               - 80:8080/tcp
               - 443:443/tcp
               - 5555:5555/tcp
           environment:
               - HOST_ADDR=vpn.ichiayi.com
               - HOST_TUN_PORT=443
           :

2. 修改 Dockovpn/config/server.conf 內 port 與 proto 的設定

   port 443
   proto tcp
   dev tun
   :

3. 修改 Dockovpn/config/client.ovpn 內 proto 的設定

   :
   proto tcp
   :

4. 重新啟動 docker compose

   docker compose up -d

1. 更新 Dockovpn/start.sh (用這檔案取代 https://github.com/tryweb/dockovpn/blob/master/scripts/start.sh)¹⁾

   wget https://github.com/tryweb/dockovpn/raw/master/scripts/start.sh -O ./Dockovpn/start.sh

2. 修改 docker-compose.yml 增加環境變數 OVPN_IP_NET=10.9.0.0/24

           :
           environment:
               - HOST_ADDR=vpn.ichiayi.com
               - HOST_TUN_PORT=443
               - HOST_TUN_PROTO=tcp
               - OVPN_IP_NET=10.9.0.0/24
           :

3. 修改 Dockovpn/config/server.conf 內 server 的設定

   :
   server 10.9.0.0 255.255.255.0
   :

4. 重新啟動 docker compose

   docker compose up -d

• 表示 CRL 自動更新異常, 需要重新產生

1. 進入 dockovpn 容器內

   docker exec -it dockovpn bash

2. 切換到憑證目錄手動更新 CRL 檔

   cd /opt/Dockovpn_data/
   easyrsa gen-crl

3. 重新啟動 dockovpn 服務

   docker compose restart

• Exp. 新增 test1

  docker exec dockovpn ./genclient.sh n test1

• 可以在 ./Dockovpn_data/clients 目錄看到建立 test1

  ls -lt ./Dockovpn_data/clients

• Exp. 刪除 test1

  docker exec dockovpn ./rmclient.sh test1
  rm -rf ./Dockovpn_data/clients/test1

• 可以在 ./Dockovpn_data/pki/index.txt 看到被廢止憑證註記 R

  cat ./Dockovpn_data/pki/index.txt

• cat ./Dockovpn/openvpn-status.log

• 參考 - https://github.com/tryweb/-openvpn-snmp-stats/tree/alpine3
• 安裝 openvpn.py

  apk add --update --no-cache python3
  ln -sf python3 /usr/bin/python
  mkdir -p /opt/openvpn-snmp-stats/db
  cd /opt/openvpn-snmp-stats
  wget https://raw.githubusercontent.com/tryweb/-openvpn-snmp-stats/alpine3/openvpn.py
  chmod a+x openvpn.py

  安裝後可以先執行驗證 Exp.

  openvpn-61:~# /opt/openvpn-snmp-stats/openvpn.py
  {"errorString": "", "error": 0, "version": 1, "data": {"tun0": {"iv9614": {"minutes_since_last_handshake": 506, "bytes_rcvd": 106350, "bytes_sent": 78677}, "jonathan_pixel5": {"minutes_since_last_handshake": 535, "bytes_rcvd": 23584, "bytes_sent": 37931}, "jonathan": {"minutes_since_last_handshake": 536, "bytes_rcvd": 7086888, "bytes_sent": 41041820}, "UNDEF": {"minutes_since_last_handshake": 495, "bytes_rcvd": 0, "bytes_sent": 0}}}}

• 設定 snmpd.conf

  vi /etc/snmp/snmpd.conf

  :
  
  extend wireguard /opt/openvpn-snmp-stats/openvpn.py

  service snmpd restart

• https://github.com/dockovpn/dockovpn
• https://github.com/dockovpn/dockovpn/issues/184