Example from docker-compose.yml does not work properly #6
Comments
|
Hi @PennyLook I had a look into You are the second person, who asks for |
|
Hi @d3vilh I used the solution from here and I stopped at step 3/8 and a message appears: I tried to replace it go get, however, I was not able to configure/change it properly. Could you please take a look at this dockerfile? |
I see, it may indicate arch mismatch. |
|
Well yes, i should verify it more deeply. It is a VPS:
so I should probably try this one Will it also work on such a VPS? |
Yes, that one will fit very well. |
|
@d3vilh looks better I installed this way and the frontend is accessible. I changed the login and password config.yml however this login and password does not work - there is an orange alert stating "invalid login or password" I also tried the default password and login and that doesn't work either. What could be wrong? |
|
Post installation, password can be changed in docker-compose.xml file: philipp@devBoard:~ $ grep OPENVPN ~/openvpn-server/docker-compose.yml
- OPENVPN_ADMIN_USERNAME=admin
- OPENVPN_ADMIN_PASSWORD=gagaZush
philipp@devBoard:~ $just edit it and restart container: EDIT: It will keep updated password in container parameters. |
|
I managed to solve it, logged in correctly, in I downloaded the certificate, imported it into the OpenVPN client and the private key password is required when trying to connect. Is it possible to disable this password somehow, so that the generated certificates do not require it when trying to connect? |
The password is the "Passphrase" you entered. You can leave it empty when generating new certificate and it will not ask for the password. |
|
yeap, but then the password is still required (in my case):
OpenVPN client GUI: Windows: client logs: Linux: However, if I set a password in the
EDIT |
|
@PennyLook good day, There was a bug reported some time ago, related to certificate names, and couple of more improvements which was not part of x86 image. There also one thing which may be related and I would implement the fix in the future - certificates does not support spaces in certificate name (I would replace spaces automatically with If yo still will have a problem, please share: |
|
@d3vilh sure, I ran the entire playbook from scratch: and a value of In the after this change everything works and I get an IP in the range 10.0.70.0/24 but the problem is that now I can't access the "Internet" (after establishing an OpenVPN connection) What should be the IP range selected so that for the certificates issued there is internet access? |
It is OK,
If it still will not work, the you can increase logs verbose level on server and client side, try to connect and then share the logs here (for the security reasons it is better to change or blur your real Internet IP). EDIT: OpenVPN Server config is here |
|
@d3vilh
I think something in the 192.168.0.0/24 range should work, but I'm not sure - or at least that's what the route looks like initially on the client side Client logs: OpenVPN log: |
|
I think, I have clue :) ...
Configuring networking rules...
net.ipv4.ip_forward = 1
Configuring iptables...
NAT for OpenVPN clients
Blocking ICMP for external clients
Blocking internal home subnet to access from external openvpn clients (Internet still available)
IPT MASQ Chains:
MASQUERADE all -- 10.0.70.0/24 anywhere
MASQUERADE all -- 10.0.71.0/24 anywhere
IPT FWD Chains:
0 0 DROP 1 -- * * 10.0.71.0/24 0.0.0.0/0 icmptype 8
0 0 DROP 1 -- * * 10.0.71.0/24 0.0.0.0/0 icmptype 0
0 0 DROP 0 -- * * 10.0.71.0/24 192.168.88.0/24
Start openvpn process...
philipp@d3vBoard:~/openvpn-seWe need to be sure the FW rules applied correctly.
Update: I rebuild OpenVPN Server image so now you can pass this subnets via options: openvpn:
container_name: openvpn
# If you want to build your own image, uncomment the following line and comment the image line
build: ./openvpn-docker
#image: d3vilh/openvpn-server:latest
privileged: true
ports:
- "1194:1194/udp"
environment:
REQ_COUNTRY: UA
REQ_PROVINCE: Kyiv
REQ_CITY: Chayka
REQ_ORG: CopyleftCertificateCo
REQ_OU: ShantiShanti
REQ_CN: MyOpenVPN
TRUST_SUB: 10.0.70.0/24
GUEST_SUB: 10.0.71.0/24
HOME_SUB: 192.168.88.0/24
volumes:
- ./pki:/etc/openvpn/pki
- ./clients:/etc/openvpn/clients
- ./config:/etc/openvpn/config
- ./staticclients:/etc/openvpn/staticclients
- ./log:/var/log/openvpn
cap_add:
- NET_ADMIN
restart: always
depends_on:
- "openvpn-ui"
``` |
|
My Would it be possible to convert/change this my MASQUERADE 10.0.0.0/24 to some addresses in the range 192.168.0.0/24 and 10.0.1.0/24 to 192.168.1.0/24 with still internet access available? According to what you wrote, my configuration currently looks like this from UI:
DNS without changes and my And it currently works exactly as shown in this diagram:
but my changes:
Would it be possible to convert/change this my MASQUERADE 10.0.0.0/24 to some addresses in the range 192.168.0.0/24 and 10.0.1.0/24 to 192.168.1.0/24 with still internet access available? Thank you for your help :) |
|
I have one more question about custom network configurations. Example: and two devices Is it possible to set such a configuration that internal connection possible connections: blocked connections: Then from device 1 and 2, do I have to set to block traffic from IP range |
|
For subnet isolation the easiest trick would be to apply FW rules inside OpenVPN Server container. iptables -A FORWARD -s 10.0.70.5 -d 10.0.70.6 -j DROP
iptables -A FORWARD -d 10.0.70.6 -s 10.0.70.5 -j DROPhere how you can drop it inside container: I didn't test it though, it should work, but not as the permanent solution for sure (after each container restart you have to apply it again). Test it, if it will work, then we can have some kind of WA with optional script execution on every OVPN Server container restart. EDIT: Meanwhile I like the idea of custom FW rules execution at the time of container start and it is implemented now. docker-compose.yml: ---
version: "3.5"
services:
openvpn:
container_name: openvpn
image: d3vilh/openvpn-server:latest
privileged: true
ports:
- "1194:1194/udp"
environment:
REQ_COUNTRY: UA
REQ_PROVINCE: Kyiv
REQ_CITY: Chayka
REQ_ORG: CopyleftCertificateCo
REQ_OU: ShantiShanti
REQ_CN: MyOpenVPN
TRUST_SUB: 10.0.70.0/24
GUEST_SUB: 10.0.71.0/24
HOME_SUB: 192.168.88.0/24
volumes:
- ./pki:/etc/openvpn/pki
- ./clients:/etc/openvpn/clients
- ./config:/etc/openvpn/config
- ./staticclients:/etc/openvpn/staticclients
- ./log:/var/log/openvpn
- ./fw-rules.sh:/opt/app/fw-rules.sh
cap_add:
- NET_ADMIN
restart: alwaysNew volume:
Here is possible content of ~/openvpn-server $ cat fw-rules.sh
iptables -A FORWARD -s 10.0.70.88 -d 10.0.70.77 -j DROP
iptables -A FORWARD -d 10.0.70.77 -s 10.0.70.88 -j DROP |
|
It looks good - a very good improvement which I think can still be useful to someone. I'll check it out and let you know. I still have the question I asked about: My docker logs openvpn output: Would it be possible to convert/change this my MASQUERADE 10.0.0.0/24 to some addresses in the range 192.168.0.0/24 and 10.0.1.0/24 to 192.168.1.0/24 with still internet access available? I'm asking because some devices I'm trying to connect to have some kind of problem with OpenVPN when they have addresses in the 10.0.x.x range and in the 192.168.x.x range it already works |
Yes, you can pass these subnets as environment options to OpenVPN Server container directly via 'docker-compose.yml' or during the installation via 'config.xml' you can set there any subnets you would like to. There also option to set the same via WEB-UI, but it will not affect Firewall configuration only certificate DB. |
Yes, I tried to do it, but something is wrong openvpn logs still same: changes I've made in via UI: example from which I checked: there is a connection to OpenVPN, I get the address I'm getting tired of this configuration because I don't know what I should set in order to have access from the Internet with this IP address Maybe I am missing some redirection, and this given |
Did you stop container and then run |
|
Yes. and this is exactly what docker logs openvpn returns I have no idea why this is so, but if I change anything here: at e.g. then I no longer have access to the internet |
|
Interesting. Did you use static IP configuration for that clients? |
for another openvpn configuration with I think it is related to this "issue" |
|
It seems In real, he probably did this to keep back compatibility, as lot of people uses his server image. |
I completely agree with this. I need to replace the current OpenVPN configuration with a new one, hence I set up my own OpenVPN server and now I'm left with swapping out the configuration on the client side. The problem is that I can't upgrade OpenVPN on the client side - it's just a simple machine with sensors that only transmits numbers and nothing has been updated on it for ~10+ years, also it looks like this. So I am on these machines (client side) doomed to That's why I'm trying to somehow hook up this openvpn configuration which is from I'll check it out some more, but it's already taken me quite a while to create the various configurations on the server/client side and it still hasn't done anything. It only works with |
Hello,
I tried to build docker containers from
docs/docker-compose.ymlhowever it does not work properly for me.OS: Debian 10
Pulling from
d3vilh/openvpn-ui-arm32v7executed correctly, then when building openvpn I get the error like:After adding dockerfile, problem occurs at step 5/11:
I also tried installing docker image
kylemann/openvpnseparately, however I don't know how to hook it up toopenvpn-uiDocker file looks like ready to use for Alpine, not for Debian.
Will it there be some prepared version under Debian?
Can
openvpn-uibe hooked up toopenvpnfrom another container such as the one fromkylemann?The text was updated successfully, but these errors were encountered: