What is OpenVPN
This package allows you to deploy your personal OpenVPN server to any part of the world and region provided by the cloud provider. For example, with Digital Ocean you have the possibility to have your own VPN server in North America, Canada, Europe, or somewhere in Asia. OpenVPN server in a Docker container complete with an EasyRSA PKI CA. OpenVPN stack is built with Docker Compose.
What is included
- OpenVPN docker container based on https://hub.docker.com/r/kylemanna/openvpn
How to deploy
Once your deployment is complete you will receive an email that contains your “ovpn” file attached. Save the file with “.ovpn” extension somewhere on your computer disk.
In order to connect to the VPN server, you need to:
Install a client to work with OpenVPN
The installation process is unique for each platform and OS:
For Windows users
https://openvpn.net/client-connect-vpn-for-windows/
For OSX users
https://openvpn.net/vpn-server-resources/connecting-to-access-server-with-macos/
For Ubuntu/Debian users execute the following commands in your terminal
sudo apt-get updatesudo apt-get install openvpnsudo openvpn --config xxxx.ovpn
Note: Replace 'xxxx' with the filename you got in e-mail
For CentOS users
sudo yum install epel-releasesudo yum install openvpnsudo openvpn --config xxxx.ovpn
Note: Replace 'xxxx' with the filename you got in e-mail
You can run the OpenVPN command by root (or using sudo):
sudo openvpn --config xxxx.ovpn
Note: Replace 'xxxx' with the filename you got in e-mail
Or, send to background / run vpn client as daemon process:
openvpn --config xxxx.ovpn --daemon
Note: Replace 'xxxx' with the filename you got in e-mail
How to add new VPN users
Go to directory that containing docker-compose.yml file on your server and execute commands below.
Add a new user without a passphrase
docker-compose run --rm openvpn easyrsa build-client-full USERNAME nopassGenerate user’s ovpn file
docker-compose run --rm openvpn ovpn_getclient USERNAME > USERNAME.ovpnCompanion apps
knockd is a port-knock server. It listens to all traffic on an ethernet (or PPP) interface, looking for special knock sequences of port-hits. A client makes these port-hits by sending a TCP (or UDP) packet to a port on the server. This port need not be open -- since knockd listens at the link-layer level, it sees all traffic even if it's destined for a closed port. When the server detects a specific sequence of port-hits, it runs a command defined in its configuration file. This can be used to open up holes in a firewall for quick access.
SFTP - Allows you to manage files directly using SFTP protocol.
Fail2ban scans log files and bans IPs that show the malicious signs. Highly recommended for simple VPS server setup
Minimal docker container management panel. Allows you to check the status and logs of all services of this stack. It also simplifies SSL setup and configuration.
Portainer is a lightweight management UI which allows you to easily manage your different Docker environments (Docker hosts or Swarm clusters)