Setup & konfigurasi OpenVPN server menggunakan Docker

Introduction

OpenVPN adalah solusi VPN open-source yang populer untuk mengamankan koneksi jaringan. Dengan menggunakan Docker, kita dapat dengan mudah men-deploy OpenVPN server tanpa perlu konfigurasi manual yang rumit pada sistem host. Artikel ini akan memandu kita step-by-step untuk setup OpenVPN server menggunakan Docker container.

Flow

Ini adalah best practices menurut saya dalam melakukan implementasi security contohnya saat kita akan membangun aplikasi.

Prerequisites

Sebelum memulai, pastikan Anda memiliki:

• Docker terinstall (versi 20.10+)
• Docker Compose terinstall
• Ubuntu / anothers OS Linux
• Root/sudo access pada server
• Port 1110/TCP terbuka di firewall disini kebetulan saya menggunakan TCP
• Public IP address atau domain name
• Minimal 1GB RAM dan 10GB storage

Verifikasi Prerequisites

# Check Docker
docker --version

# Check Docker Compose  
docker-compose --version

# Check available ports
netstat -tulpn | grep 1194

Step by Step Installation

Step 1: Directory create

# Buat directory kerja
mkdir ~/openvpn-docker
cd ~/openvpn-docker

# Buat directory untuk data persistent
mkdir openvpn-data

Step 2: Create Cert & Server.conf

nano config/easy-rsa.vars

set_var EASYRSA_DN           "org"
set_var EASYRSA_REQ_COUNTRY  "ID"
set_var EASYRSA_REQ_PROVINCE "JK"
set_var EASYRSA_REQ_CITY     "Jakarta"
set_var EASYRSA_REQ_ORG      "Igunawan.com"
set_var EASYRSA_REQ_EMAIL    "admin@igunawan.com"
set_var EASYRSA_REQ_OU       "IT"
set_var EASYRSA_REQ_CN       "OpenVPNServer"
set_var EASYRSA_KEY_SIZE     2048
set_var EASYRSA_CA_EXPIRE    3650
set_var EASYRSA_CERT_EXPIRE  825
set_var EASYRSA_CERT_RENEW   30
set_var EASYRSA_CRL_DAYS     180

Format ini digunakan untuk create certificate user / client nantinya

nano server.conf

anagement 0.0.0.0 2080  # Don't change this line. OpenVPN UI uses this feature to manage the server

dev tun
port 1194
proto tcp-server

topology subnet
keepalive 10 120
max-clients 100

persist-key
persist-tun
explicit-exit-notify 1

user nobody
group nogroup

client-config-dir /etc/openvpn/staticclients
ifconfig-pool-persist pki/ipp.txt

ca pki/ca.crt
cert pki/issued/server.crt
key pki/private/server.key
crl-verify pki/crl.pem
dh pki/dh.pem

tls-crypt pki/ta.key
tls-version-min 1.2
remote-cert-tls client


auth SHA512

server 10.0.70.0 255.255.255.0           # Trusted VPN subnet
route 10.0.71.0 255.255.255.0            # Route to Guest VPN subnet
push "route 10.0.60.0 255.255.255.0"     # Route to Home VPN subnet
push "dhcp-option DNS 8.8.8.8"             # DNS1 server for VPN clients
push "dhcp-option DNS 1.0.0.1"             # DNS2 server for VPN clients
push "redirect-gateway def1 bypass-dhcp"    # Redirect gateway for VPN clients

log /var/log/openvpn/openvpn.log
verb 3
status /var/log/openvpn/openvpn-status.log
status-version 2

Step 3: Create docker-compose

version: "3.8"

services:
    openvpn:
       container_name: openvpn
       image: d3vilh/openvpn-server:latest
       privileged: true
       ports: 
          - "1110:1100/tcp"   # openvpn TCP port
       environment:
           TRUST_SUB: "10.0.70.0/24"
           GUEST_SUB: "10.0.71.0/24"
           HOME_SUB: "192.168.88.0/24"

       volumes:
           - ./pki:/etc/openvpn/pki
           - ./clients:/etc/openvpn/clients
           - ./config:/etc/openvpn/config
           - ./staticclients:/etc/openvpn/staticclients
           - ./log:/var/log/openvpn
           - ./fw-rules.sh:/opt/app/fw-rules.sh
           - ./checkpsw.sh:/opt/app/checkpsw.sh
           - ./server.conf:/etc/openvpn/server.conf
       cap_add:
           - NET_ADMIN
       restart: always
       depends_on:
           - "openvpn-ui"

    openvpn-ui:
       container_name: openvpn-ui
       image: d3vilh/openvpn-ui:latest
       environment:
           - OPENVPN_ADMIN_USERNAME=admin
           - OPENVPN_ADMIN_PASSWORD=akwj3eh2ouehoiqwheiruh3871idjbqjwer123
       privileged: true
       ports:
           - "8080:8080/tcp"
       volumes:
           - ./:/etc/openvpn
           - ./db:/opt/openvpn-ui/db
           - ./pki:/usr/share/easy-rsa/pki
           - /var/run/docker.sock:/var/run/docker.sock:ro
       restart: always

NB: disini saya juga menggunakan UI untuk management users jadi lebih mudah managenya, opsional bisa dimatikan untuk UI nya.

Step 4: Start OpenVPN Server

# Start container
docker-compose up -d

# Verify container running
docker-compose ps

Step 5: Management OpenVPN via GUI

http://IP-Server:8080

Gunawan

Admin website igunawan.com, System Administrator, DevOps Engineer