<repo_name>fossabot/openvpn-on-docker<file_sep>/README.md
[![Build Status](https://travis-ci.org/OlegGorj/openvpn-on-docker.svg?branch=master)](https://travis-ci.org/OlegGorj/openvpn-on-docker)
[![GitHub Issues](https://img.shields.io/github/issues/OlegGorJ/openvpn-on-docker.svg)](https://github.com/OlegGorJ/openvpn-on-docker/issues)
[![Average time to resolve an issue](http://isitmaintained.com/badge/resolution/OlegGorJ/openvpn-on-docker.svg)](http://isitmaintained.com/project/OlegGorJ/openvpn-on-docker "Average time to resolve an issue")
[![Percentage of issues still open](http://isitmaintained.com/badge/open/OlegGorJ/openvpn-on-docker.svg)](http://isitmaintained.com/project/OlegGorJ/openvpn-on-docker "Percentage of issues still open")
[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2FOlegGorj%2Fopenvpn-on-docker.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2FOlegGorj%2Fopenvpn-on-docker?ref=badge_shield)

# OpenVPN on docker container

Implementation of OpenVPN on Docker container

To setup VPN clients, generate VPN client credentials for `CLIENTNAME` without password protection; leave 'nopass' out to enter password.

```
ENDPOINT_SERVER=<external IP of bastion instance>
CLIENTNAME=openvpn

docker run --user=$(id -u) -e OVPN_CN=$ENDPOINT_SERVER  -e OVPN_SERVER_URL=tcp://$ENDPOINT_SERVER:1194 -i -v $PWD:/etc/openvpn oleggorj/openvpn ovpn_initpki nopass $ENDPOINT_SERVER

docker run --user=$(id -u) -v $PWD:/etc/openvpn -ti oleggorj/openvpn easyrsa build-client-full $CLIENTNAME nopass
```

To generate `ovpn` file:

```
docker run --user=$(id -u) -e OVPN_DEFROUTE=1 -e OVPN_SERVER_URL=tcp://$INGRESS_IP_ADDRESS:80 -v $PWD:/etc/openvpn --rm oleggorj/openvpn ovpn_getclient $CLIENTNAME > ${CLIENTNAME}.ovpn
```


## License
[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2FOlegGorj%2Fopenvpn-on-docker.svg?type=large)](https://app.fossa.io/projects/git%2Bgithub.com%2FOlegGorj%2Fopenvpn-on-docker?ref=badge_large)<file_sep>/bin/ovpn_initpki
#!/bin/bash

#
# Initialize the EasyRSA PKI
#

if [ "$DEBUG" == "1" ]; then
  set -x
fi

set -e

source /usr/local/bin/func.sh

# Specify "nopass" as arg[2] to make the CA insecure (not recommended!)
nopass=$1

cn=$2

# Provides a sufficient warning before erasing pre-existing files
easyrsa init-pki

# CA always has a password for protection in event server is compromised. The
# password is only needed to sign client/server certificates.  No password is
# needed for normal OpenVPN operation.
echo -e "\n\n" | easyrsa build-ca $cn $nopass

RANDFILE=/tmp/.rnd easyrsa gen-dh

openvpn --genkey --secret $EASYRSA_PKI/ta.key

# For a server key with a password, manually init; this is autopilot
easyrsa build-server-full "$OVPN_CN" nopass

<file_sep>/entrypoint.sh
#!/bin/bash

[[ $DEBUG ]] && set -x && OVPN_VERB=${OVPN_VERB:-5}

set -ae

source /usr/local/bin/func.sh

addArg "--config" "$OVPN_CONFIG"

# Server name is in the form "udp://vpn.example.com:1194"
if [[ "$OVPN_SERVER_URL" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.\-]+)(:([0-9]+))?$ ]]; then
    OVPN_PROTO=${BASH_REMATCH[2]};
    OVPN_CN=${BASH_REMATCH[3]};
    OVPN_PORT=${BASH_REMATCH[5]};
else
    echo "Need to pass in OVPN_SERVER_URL in 'proto://fqdn:port' format"
    exit 1
fi

#OVPN_NETWORK="${OVPN_NETWORK:-10.140.0.0/24}"
OVPN_NETWORK="${OVPN_NETWORK:-10.0.1.0/24}"

OVPN_PROTO="${OVPN_PROTO:-tcp}"
OVPN_NATDEVICE="${OVPN_NATDEVICE:-eth0}"
#OVPN_K8S_DOMAIN="${OVPN_K8S_DOMAIN:-svc.cluster.local}"
OVPN_VERB=${OVPN_VERB:-3}

if [ ! -d "${EASYRSA_PKI}" ]; then
    echo "PKI directory missing. Did you mount in your Secret?"
    exit 1
fi

#if [ -z "${OVPN_K8S_SERVICE_NETWORK}" ]; then
#    echo "Service network not specified"
#    exit 1
#fi

#if [ -z "${OVPN_K8S_POD_NETWORK}" ]; then
#    echo "Pod network not specified"
#    exit 1
#fi

# You don't need to set this variable unless you touched your dnsPolicy for this pod.
#if [ -z "${OVPN_K8S_DNS}" ]; then
#    OVPN_K8S_DNS=$(cat /etc/resolv.conf | grep -i nameserver | head -n1 | cut -d ' ' -f2)
#fi

# Do some CIDR conversion
OVPN_NETWORK_ROUTE=$(getroute ${OVPN_NETWORK})
#OVPN_K8S_SERVICE_NETWORK_ROUTE=$(getroute $OVPN_K8S_SERVICE_NETWORK)
#OVPN_K8S_POD_NETWORK_ROUTE=$(getroute $OVPN_K8S_POD_NETWORK)

envsubst < $OVPN_TEMPLATE > $OVPN_CONFIG

echo "$(date "+%a %b %d %H:%M:%S %Y") Configuring net iptables"
if [ $OVPN_DEFROUTE -gt 0 ]; then
    iptables -t nat -C POSTROUTING -s $OVPN_NETWORK -o $OVPN_NATDEVICE -j MASQUERADE || {
      iptables -t nat -A POSTROUTING -s $OVPN_NETWORK -o $OVPN_NATDEVICE -j MASQUERADE
    }
fi
#sudo iptables -t nat -A POSTROUTING -o $OVPN_NATDEVICE -j MASQUERADE

# Use client configuration directory if it exists.
if [ -d "$OVPN_CCD" ]; then
    addArg "--client-config-dir" "$OVPN_CCD"

    # Watch for changes to port translation configmap in the background
    /sbin/watch-portmapping.sh &
fi

mkdir -p /dev/net
if [ ! -c /dev/net/tun ]; then
    mknod /dev/net/tun c 10 200
fi

if [ -n "${OVPN_STATUS}" ]; then
    addArg "--status" "${OVPN_STATUS}"
    /sbin/print-status.sh ${OVPN_STATUS} &
fi

if [ $DEBUG ]; then
    echo "openvpn.conf:"
    cat $OVPN_CONFIG
fi

echo "$(date "+%a %b %d %H:%M:%S %Y") Deploying and running 'OpenVPN AS'"
#cd ~ && wget http://swupdate.openvpn.org/as/openvpn-as-2.5.2-Ubuntu16.amd_64.deb
#sudo dpkg -i openvpn-as-2.5.2-Ubuntu16.amd_64.deb

echo "$(date "+%a %b %d %H:%M:%S %Y") Running 'openvpn ${ARGS[@]} ${USER_ARGS[@]}'"
exec openvpn "${ARGS[@]}" "${USER_ARGS[@]}" 1> /dev/stderr 2> /dev/stderr
