openvpn-ui: Example from docker-compose.yml does not work properly
Hello,
I tried to build docker containers from docs/docker-compose.yml however it does not work properly for me.
OS: Debian 10
Pulling from d3vilh/openvpn-ui-arm32v7 executed correctly, then when building openvpn I get the error like:
Cannot locate specified Dockerfile: Dockerfile
After adding dockerfile, problem occurs at step 5/11:
Step 5/11 : RUN apk --no-cache --no-progress upgrade && apk --no-cache --no-progress add bash bind-tools curl wget ip6tables iptables openvpn easy-rsa
---> [Warning] The requested image's platform (linux/arm64/v8) does not match the detected host platform (linux/amd64/v3) and no specific platform was requested
---> Running in 412f6d3d663e
exec /bin/sh: exec format error
ERROR: Service 'openvpn' failed to build: The command '/bin/sh -c apk --no-cache --no-progress upgrade && apk --no-cache --no-progress add bash bind-tools curl wget ip6tables iptables openvpn easy-rsa' returned a non-zero code: 1
I also tried installing docker image kylemann/openvpn separately, however I don’t know how to hook it up to openvpn-ui
Docker file looks like ready to use for Alpine, not for Debian. Will it there be some prepared version under Debian?
Can openvpn-ui be hooked up to openvpn from another container such as the one from kylemann?
About this issue
- Original URL
- State: closed
- Created a year ago
- Comments: 27 (13 by maintainers)
For subnet isolation the easiest trick would be to apply FW rules inside OpenVPN Server container. Something like this:
here how you can drop it inside container:
sudo docker exec openvpn 'iptables -A FORWARD -s 10.0.70.4 -d 10.0.70.22 -j DROP; iptables -A FORWARD -d 10.0.70.4 -s 10.0.70.22 -j DROP'I didn’t test it though, it should work, but not as the permanent solution for sure (after each container restart you have to apply it again).
Test it, if it will work, then we can have some kind of WA with optional script execution on every OVPN Server container restart.
EDIT: Meanwhile I like the idea of custom FW rules execution at the time of container start and it is implemented now. Container on Docker hub and openvpn-aws updated.
docker-compose.yml:
New volume:
fw-rules.shis shell file with additional firewall rules you would like to apply during container startHere is possible content of
fw-rules.shfile:Yes. I’ve checked this many times and I can only access the internet with this configuration:
and this is exactly what docker logs openvpn returns
I have no idea why this is so, but if I change anything here:
at e.g.
then I no longer have access to the internet
I think, I have clue 😃 Could you show the networking rules apply logs form your OpenVPN server (
docker logs openvpn)? Here is how it looks like on my devBoard:We need to be sure the FW rules applied correctly. There should be 3 subnets:
10.0.70.0/24from which OpenVPN server will assign IPs to trusted clients10.0.71.0/24the subnet for clients with internet access only192.168.88.0/24in the example above. This must be your subnet where the VPN server is located, thru which you get internet access to the clients with MASQUERADE.Update: I rebuild OpenVPN Server image so now you can pass this subnets via options:
@d3vilh I checked and with the default settings, however, it does not work - both under the Windows client and Linux - no Internet access, but the devices see each other in OpenVPN LAN
I think something in the 192.168.0.0/24 range should work, but I’m not sure - or at least that’s what the route looks like initially on the client side
Client logs:
OpenVPN log:
@PennyLook good day, Im traveling and don’t have x86 CPU around, but I rebuilt the image with the latest fixes on AWS x86 instance. So, you can just drop old
openvpn-uiimage, then pull it and try again.There was a bug reported some time ago, related to certificate names, and couple of more improvements which was not part of x86 image. Now, when I rebuild it, these fixes included and ready for testing (I tried on my AWS node and it seems fine now, but I appreciate if you could confirm the same).
There also one thing which may be related and I would implement the fix in the future - certificates does not support spaces in certificate name (I would replace spaces automatically with
_as a fix). It may be the reason as well.If yo still will have a problem, please share:
docker logs openvpn-uiand timestamp of cert generation attempt. This will help to debug the issue more precisely.Post installation, password can be changed in docker-compose.xml file:
just edit it and restart container:
EDIT: Not just restart, you need to stop it, and recreate containers:
It will keep updated password in container parameters.
Yes, that one will fit very well.
Well yes, i should verify it more deeply.
It is a VPS:
Linux 4.19.0-25-cloud-amd64 #1 SMP Debian 4.19.289-1 x86_64 GNU/Linuxso I should probably try this one
Will it also work on such a VPS?
Hi @d3vilh Thank you for the information.
I used the solution from here
and I stopped at step 3/8 and a message appears:
I tried to replace it go get, however, I was not able to configure/change it properly.
Could you please take a look at this dockerfile?