安裝 DockOVPN 的 OpenVPN Docker 方案

因為之前主要的 OpenVPN Docker 方案(Exp. kylemanna/openvpn, linuxserver/openvpn-as 似乎都已不再更新, 因此找了 DockOVPN 來安裝使用

目前 DockOVPN 版本是 v1.13.0 (Release:2023-10-28) 系統算是穩定, 但實際使用還是需要一些手動程序

VPN Server : vpn.ichiayi.com

docker-compose.yml

version: '3'
services:
    dockovpn:
        image: alekslitvinenk/openvpn:v1.13.0
        cap_add:
            - NET_ADMIN
        ports:
            - 80:8080/tcp
            - 1194:1194/udp
            - 5555:5555/tcp
        environment:
            - HOST_ADDR=vpn.ichiayi.com
            - HOST_TUN_PORT=1194
        container_name: dockovpn
        #volumes:
        #    - ./Dockovpn:/opt/Dockovpn
        #    - ./Dockovpn_data:/opt/Dockovpn_data
        #    - ./Dockovpn/config/server.conf:/etc/openvpn/server.conf
        restart: always

第一次執行時, volumes 部分必須要註解起來, 否則會出錯

第一次啟動

docker compose up -d

啟動後將 Dockovpn 與 Dockovpn_data 複製出來

docker cp dockovpn:/opt/Dockovpn .
docker cp dockovpn:/opt/Dockovpn_data .

將 Dockovpn 內的 genclient.sh 與 functions.sh 用 github 最新版本取代

wget https://github.com/dockovpn/dockovpn/raw/master/scripts/genclient.sh -O ./Dockovpn/genclient.sh
wget https://github.com/dockovpn/dockovpn/raw/master/scripts/functions.sh -O ./Dockovpn/functions.sh

依照實際需要修改 server.conf

vi ./Dockovpn/config/server.conf

port 1194
proto udp
dev tun

cipher AES-256-GCM
auth SHA512

keepalive 10 120

persist-key
persist-tun

crl-verify /etc/openvpn/crl.pem

ca /etc/openvpn/ca.crt
dh /etc/openvpn/dh.pem
tls-auth /etc/openvpn/ta.key 0
key /etc/openvpn/MyReq.key
cert /etc/openvpn/MyReq.crt

ifconfig-pool-persist ipp.txt
status openvpn-status.log
verb 4
management 0.0.0.0 5555

server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
#push "dhcp-option DNS 1.1.1.1"
#push "dhcp-option DNS 8.8.8.8"
push "route 192.168.11.0 255.255.255.0"
push "route 172.16.0.0 255.255.255.0"
push "route 172.16.1.0 255.255.255.0"
push "route 172.16.2.0 255.255.255.0"
push "route 172.16.12.0 255.255.255.0"

#duplicate-cn
#ncp-ciphers AES-256-GCM:AES-256-CBC
#tls-server
#tls-version-min 1.2

將 vloumes 掛上, 重啟 dockovpn

vi ./docker-compose.yml

:
        container_name: dockovpn
        volumes:
            - ./Dockovpn:/opt/Dockovpn
            - ./Dockovpn_data:/opt/Dockovpn_data
            - ./Dockovpn/config/server.conf:/etc/openvpn/server.conf
        restart: always

docker compose up -d

Exp. 新增 test1

docker exec dockovpn ./genclient.sh n test1

可以在 ./Dockovpn_data/clients 目錄看到建立 test1

ls -lt ./Dockovpn_data/clients

Exp. 刪除 test1

docker exec dockovpn ./rmclient.sh test1
rm -rf ./Dockovpn_data/clients/test1

可以在 ./Dockovpn_data/pki/index.txt 看到被廢止憑證註記 R

cat ./Dockovpn_data/pki/index.txt

cat ./Dockovpn/openvpn-status.log

參考 - https://github.com/tryweb/-openvpn-snmp-stats/tree/alpine3

安裝 openvpn.py

apk add --update --no-cache python3
ln -sf python3 /usr/bin/python
mkdir -p /opt/openvpn-snmp-stats/db
cd /opt/openvpn-snmp-stats
wget https://raw.githubusercontent.com/tryweb/-openvpn-snmp-stats/alpine3/openvpn.py
chmod a+x openvpn.py

安裝後可以先執行驗證 Exp.

openvpn-61:~# /opt/openvpn-snmp-stats/openvpn.py
{"errorString": "", "error": 0, "version": 1, "data": {"tun0": {"iv9614": {"minutes_since_last_handshake": 506, "bytes_rcvd": 106350, "bytes_sent": 78677}, "jonathan_pixel5": {"minutes_since_last_handshake": 535, "bytes_rcvd": 23584, "bytes_sent": 37931}, "jonathan": {"minutes_since_last_handshake": 536, "bytes_rcvd": 7086888, "bytes_sent": 41041820}, "UNDEF": {"minutes_since_last_handshake": 495, "bytes_rcvd": 0, "bytes_sent": 0}}}}

設定 snmpd.conf

vi /etc/snmp/snmpd.conf

:

extend wireguard /opt/openvpn-snmp-stats/openvpn.py

service snmpd restart

https://github.com/dockovpn/dockovpn

https://github.com/dockovpn/dockovpn/issues/184