Requires support for openvpn and openvpn-ui

[Jeriyant]

I really like this project, and I hope it continues.
I've tried using this project as a VPN server. but sadly I don't really understand the Docker environment, especially using OpenVPN to route, if the owner of this project wants to help setup my server, I will pay for it. I need help with a routing problem and the host cannot ping the VPN client. I am ready to pay if the owner of this project wants to help me.

[jannoke]

I don't understand docker either. But recently standalone script was added. So you can run it on system without docker.

[Jeriyant]

Thank you for your valuable response.
Can openvpn-ui run without docker and work together with the openvpn server installed on debian 12 for example?
is this openvpn-ui like a web page running with apache?

[d3vilh]

Can openvpn-ui run without docker and work together with the openvpn server installed on debian 12 for example?

Yes it can, this is why standalone-install.sh script has been provided.

Basically, it will install and build all the dependencies for you. Just follow standalone installation section of this instruction.

You are lucky this script, at the moment supports only Debian based Linux distributions :)

[Jeriyant]

Wow, this is really amazing. Can openvpn-ui work together with the angristan/Openvpn-install in my VPS Debian12?

[d3vilh]

Can openvpn-ui work together with the angristan/Openvpn-install

OpenVPN-UI provides the best integration with d3vilh/openvpn-server setup. However, this setup using docker :)

The answer is - yes, standalone OpenVPN-UI setup can use any openvpn servers.

You just need to configure right path for OpenVPN server configuration files, EasyRSA binaries and set Management interface address and port accordingly (you could use 127.0.0.1:2080 or define real listening IP , or hostname):

[Jeriyant]

actually I don't have a problem with openvpn and openvpn-ui running inside docker because it makes it easier and simpler. but the problem is I don't understand how to route so that client2 can access the local network within client1.

[d3vilh]

Hey @Jeriyant you could run it at once with openvpn-aws, it is ansible automation to install Docker and all the containers (OpenVPN-server and OpenVPN-UI) with easy. It runs very well on regular PC (you don't even need to configure any security groups).

If you somehow have Raspberry-Pi, the Raspberry-Gateway is the way to go.

[Jeriyant]

Thank you for your very valuable response.
A few days ago, I installed it on my VPS using Docker and its function as a VPN can work well, but I don't understand how to set it up, such as turning off TLS Crypto so that it is supported by the Mikrotik VPN client, routing to the local network within Client1 and can be accessed from Client2, for example. How do I contact you to ask for help configuring it? I will pay for your services.

[d3vilh]

turning off TLS Crypto

Please note that disabling TLS can have serious security implications. If you disable TLS, your VPN connection will not be encrypted, which could expose your data to attackers.

However you still can do it via UI following by this instruction:

Disabling TLS crypt on the server side

1. Login to OpenVPN-UI
2. Go to Configuration > OpenVPN Server option
3. Comment out these three lines:
   
4. Click Save Config button on the same page below and then
5. Click Restart Server button at top

Disabling TLS crypt for the client certificates

1. Login to OpenVPN-UI
2. Go to Configuration > OpenVPN Client option
3. Comment out remote-cert-tls server and tls-client options:
   
4. Click Save Config button on the same page below and then
5. Click Restart Server button, this time at the bottom of the page :)

Please note you don't need to re-generate your *.ovpn certificates, just re-download it from the Certificates page.

Here is Server config example, in View mode:

management 0.0.0.0 2080  # Don't change this line. OpenVPN UI uses this feature to manage the server 

dev tun
port 1194
proto udp

topology subnet
keepalive 10 120
max-clients 100

persist-key
persist-tun
explicit-exit-notify 1

user nobody
group nogroup

client-config-dir /etc/openvpn/staticclients
ifconfig-pool-persist pki/ipp.txt

ca pki/ca.crt
cert pki/issued/server.crt
key pki/private/server.key
crl-verify pki/crl.pem
dh pki/dh.pem

#tls-crypt pki/ta.key
#tls-version-min 1.2
#remote-cert-tls client

cipher AES-256-GCM
# ncp-ciphers AES-256-GCM:AES-192-GCM:AES-128-GCM   # Deprecated since ver. 0.9.3. We have to use data-ciphers below instead
data-ciphers AES-256-GCM:AES-192-GCM:AES-128-GCM

auth SHA512

server 10.0.70.0 255.255.255.0           # Trusted VPN subnet
route 10.0.71.0 255.255.255.0            # Route to Guest VPN subnet
push "route 10.0.60.0 255.255.255.0"     # Route to Home VPN subnet
push "dhcp-option DNS 8.8.8.8"             # DNS1 server for VPN clients
push "dhcp-option DNS 1.0.0.1"             # DNS2 server for VPN clients
push "redirect-gateway def1 bypass-dhcp"    # Redirect gateway for VPN clients

log /var/log/openvpn/openvpn.log
verb 3
status /var/log/openvpn/openvpn-status.log
status-version 2

# Custom Option One
# Custom Option Two
# client-to-client
# Custom Option Three
# push "route 0.0.0.0 255.255.255.255 net_gateway"
# push block-outside-dns

# Auto generated by OpenVPN-UI v.0.9.5.3

Here is client confg:

client
dev tun
proto udp
remote 127.0.0.1 1194 udp
resolv-retry infinite
user nobody
group nogroup
persist-tun
persist-key
#remote-cert-tls server
cipher AES-256-GCM
auth SHA512
auth-nocache
#tls-client
redirect-gateway def1
verb 3
 
#Custom Option One
#Custom Option Two
#Custom Option Three
<ca>

</ca>
<cert>

</cert>
<key>

</key>
<tls-crypt>

</tls-crypt>
# Auto generated by OpenVPN-UI v.0.9.5.3

Again, be aware that disabling TLSwill reduce the security of your VPN connection. The TLS helps to prevent man-in-the-middle attacks by ensuring that the client only establishes a connection if the server's certificate is valid and is a server certificate. If you disable it, your client will not perform this check.

[Jeriyant]

Yes, I am aware that it can reduce the VPN security level, but it is needed so that the VPN server can support Mikrotik client devices.

Thank you for the response you have given, and I immediately tried it, wow, this is amazing, it immediately works and connects from the Mikrotik client device. I also changed the encryption to AES-256-CBC and SHA1 and it really works for the Mikrotik client.

[Jeriyant]

One more thing my lord, how do I configure it so that clients can access the local network on client1?

client1 / mikrotik router
VPN IP: 192.168.30.2/24
local ip: 192.168.11.100/24

client2 / android Phone
VPN IP: 192.168.30.3/24

and why can't a debian 12 host with openvpn and openvpn-ui running inside docker ping client1 and client2 directly from the debian 12 host? is there an error?

[d3vilh]

Hi @Jeriyant,
somehow missed your comment.

how do I configure it so that clients can access the local network on client1?

With tun setup you can access only the subnet which defined specifically for clients pool server 10.0.70.0 255.255.255.0 + server side subnets if you'll push it to the client side push "route 10.0.60.0 255.255.255.0" and have proper FW configuration (iptables -t nat -A POSTROUTING -s 10.0.70.0/24 -o eth0 -j MASQUERADE) but no other way around. Here is some explanation of tun setup with different routes

If you need to bridge into the same subnet then you have to configure tap configuration for your OpenVPN server. In this case you could connect directly to the subnet of your server and all the devices of this subnet will see your client.

why can't a debian 12 host with openvpn and openvpn-ui running inside docker ping client1 and client2 directly from the debian 12 host? is there an error?

No it is work as designed.
You have VPN connection inside isolated OpenVPN container and your server does not know anything abut the clients. so you have to add server side route (ip route add 10.0.70.0/24 via <container_ip>) then OpenVPN clients will become available from the server side.

Here is how you could add route for the client with IP 10.0.70.6:

slava@ukraine:~ $ grep -A10 Virtual ~/openvpn-server/log/openvpn-status.log | grep CLIENT_LIST | tail -1
CLIENT_LIST,MPB14_NEO,88.88.88.1:27853,10.0.70.6,,1233601,9100127,2024-06-17 17:43:33,171340946213,UNDEF,9,2,AES-256-GCM
slava@ukraine:~ $ ping 10.0.70.6
PING 10.0.70.6 (10.0.70.6) 56(84) bytes of data.
^C
--- 10.0.70.6 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3065ms

slava@ukraine:~ $ docker exec -it openvpn ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 500
    link/none
    inet 10.0.70.1/24 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::bd09:f0d4:59e2:759c/64 scope link stable-privacy
       valid_lft forever preferred_lft forever
18: eth0@if19: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:1a:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.26.0.2/16 brd 172.26.255.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:acff:fe1a:2/64 scope link
       valid_lft forever preferred_lft forever

slava@ukraine:~ $ sudo ip r a 10.0.70.0/24 via 172.26.0.2

slava@ukraine:~ $ ping 10.0.70.6
PING 10.0.70.6 (10.0.70.6) 56(84) bytes of data.
64 bytes from 10.0.70.6: icmp_seq=1 ttl=63 time=120 ms
64 bytes from 10.0.70.6: icmp_seq=2 ttl=63 time=108 ms
^C
--- 10.0.70.6 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 107.815/113.881/119.947/6.066 ms

[Jeriyant]

Based on your suggestion, now I can successfully ping from the host to the VPN client server in Docker. extraordinary, I am very grateful, may God reward you with your kindness.

but one thing that is problematic and confusing, what about the CCD to connect the local network in client1 and client2, I have tried your suggestion, but the ping from client1 cannot penetrate to the local network of client2

root@jeriyant:# docker exec -it openvpn ping 172.22.1.1
PING 172.22.1.1 (172.22.1.1): 56 data bytes
^C
--- 172.22.1.1 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss
root@jeriyant:# docker exec -it openvpn ip route
default via 172.18.0.1 dev eth0
10.0.70.0/24 dev tun0 proto kernel scope link src 10.0.70.1
172.18.0.0/16 dev eth0 proto kernel scope link src 172.18.0.3

[GasparFabio]

I loved the openvpn-ui project
But when I went to install it in Standalone installation mode, it showed an error, could you help with the solution?

[d3vilh]

it showed an error

Hi @GasparFabio, you have to clone whole repo, then enter ./build directory and run standalone-install.sh from there, then it should build without any issues.