{"id":102,"date":"2022-01-15T12:02:02","date_gmt":"2022-01-15T12:02:02","guid":{"rendered":"https:\/\/vitorprado.com\/?p=102"},"modified":"2024-08-12T23:37:15","modified_gmt":"2024-08-12T23:37:15","slug":"openvpn-server-com-docker","status":"publish","type":"post","link":"https:\/\/vitorprado.com\/?p=102","title":{"rendered":"OpenVPN Server com Docker"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">VPN<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Uma Virtual Private Network (VPN) permite que voc\u00ea atravesse redes n\u00e3o confi\u00e1veis como se estivesse em uma rede privada. Ela d\u00e1 a voc\u00ea a liberdade de acessar a internet com seguran\u00e7a no seu smartphone ou notebook ao se conectar a uma rede n\u00e3o confi\u00e1vel, como o wi-fi em um hotel ou caf\u00e9. [<a href=\"https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-set-up-and-configure-an-openvpn-server-on-ubuntu-20-04-pt#:~:text=Uma%20Virtual%20Private%20Network%20(VPN,em%20um%20hotel%20ou%20caf%C3%A9.\" target=\"_blank\" rel=\"noreferrer noopener\">1<\/a>]<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Docker<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Docker<\/strong>&nbsp;\u00e9 uma plataforma aberta, criada com o objetivo de facilitar o desenvolvimento, a implanta\u00e7\u00e3o e a execu\u00e7\u00e3o de aplica\u00e7\u00f5es em ambientes isolados. Foi desenhada especialmente para disponibilizar uma aplica\u00e7\u00e3o da forma mais r\u00e1pida poss\u00edvel. [<a href=\"https:\/\/stack.desenvolvedor.expert\/appendix\/docker\/oquee.html\" target=\"_blank\" rel=\"noreferrer noopener\">2<\/a>]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Docker Compose<\/strong>&nbsp;\u00e9 uma ferramenta que foi desenvolvida para ajudar a definir e compartilhar aplicativos de v\u00e1rios cont\u00eaineres. Com o&nbsp;<strong>Compose<\/strong>, voc\u00ea pode criar um arquivo YAML para definir os servi\u00e7os e, com um \u00fanico comando, pode girar tudo ou destruir tudo. [<a href=\"https:\/\/docs.microsoft.com\/pt-br\/visualstudio\/docker\/tutorials\/use-docker-compose#:~:text=Docker%20Compose%20%C3%A9%20uma%20ferramenta,girar%20tudo%20ou%20destruir%20tudo.\" target=\"_blank\" rel=\"noreferrer noopener\">3<\/a>]<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Instala\u00e7\u00e3o<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Arquivo docker-compose.yml: [<a rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/kylemanna\/docker-openvpn\/blob\/master\/docs\/docker-compose.md\" target=\"_blank\">4<\/a>]<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>version: '3.7'\n\nservices:\n  openvpn:\n    cap_add:\n     - NET_ADMIN\n    image: kylemanna\/openvpn\n    container_name: openvpn\n    ports:\n     - \"1194:1194\/udp\"\n    restart: always\n    volumes:\n     - .\/openvpn-data\/conf:\/etc\/openvpn\n    expose:\n      - 5555\n    networks:\n      - skynet\n\n\n  web:\n    image: 'ruimarinho\/openvpn-monitor'\n    environment:\n            - OPENVPNMONITOR_DEFAULT_DATETIMEFORMAT=%%d\/%%m\/%%Y\n            - OPENVPNMONITOR_DEFAULT_LATITUDE=-37\n            - OPENVPNMONITOR_DEFAULT_LONGITUDE=144\n            - OPENVPNMONITOR_DEFAULT_MAPS=True\n            - OPENVPNMONITOR_DEFAULT_MAPSHEIGHT=500\n            - OPENVPNMONITOR_DEFAULT_SITE=Live\n            - OPENVPNMONITOR_SITES_0_ALIAS=server1\n            - OPENVPNMONITOR_SITES_0_HOST=openvpn\n            - OPENVPNMONITOR_SITES_0_NAME=server1\n            - OPENVPNMONITOR_SITES_0_PORT=5555\n            - OPENVPNMONITOR_SITES_0_SHOWDISCONNECT=True\n    networks:\n      - skynet\n\n\n  auth:\n    image: 'beevelop\/nginx-basic-auth'\n    ports:\n      - '8080:80'\n    links:\n      - \"web:web\"\n    environment:\n      - PORT=80\n      - FORWARD_HOST=web\n      - FORWARD_PORT=80\n      ## escape $ with $$ in Docker yml due to variable expansion\n      ## example user\/pass generated with htpasswd is admin:batman \n      - HTPASSWD=admin:$$apr1$$2tupacmb$$heiUX0m1cgIACrT63\/y3k\/\n    networks:\n      - skynet\n\n\nnetworks:\n  skynet:\n    name: skynet\n    ipam:\n      driver: default\n      config:\n      - subnet: \"192.168.35.0\/20\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Inicialize os arquivos de configura\u00e7\u00e3o e certificados<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker-compose run --rm openvpn ovpn_genconfig -u udp:\/\/VPN.SERVERNAME.COM\ndocker-compose run --rm openvpn ovpn_initpki<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Corrija a permiss\u00e3o (dependendo da forma como lida com seus backups, isso pode n\u00e3o ser necess\u00e1rio)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo chown -R $(whoami): .\/openvpn-data<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Iniciar o processo OpenVPN server<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker-compose up -d openvpn<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Voc\u00ea pode acessar os logs do cont\u00eainer com:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker-compose logs -f<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Gerar um certificado de cliente<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>export CLIENTNAME=\"your_client_name\"\n\n# with a passphrase (recommended)\ndocker-compose run --rm openvpn easyrsa build-client-full $CLIENTNAME\n\n# without a passphrase (not recommended)\ndocker-compose run --rm openvpn easyrsa build-client-full $CLIENTNAME nopass<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Recupere a configura\u00e7\u00e3o do cliente com certificados incorporados<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker-compose run --rm openvpn ovpn_getclient $CLIENTNAME &gt; $CLIENTNAME.ovpn<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Revogar um certificado de cliente<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Keep the corresponding crt, key and req files.\ndocker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME\n\n# Remove the corresponding crt, key and req files.\ndocker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME remove<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Dicas de depura\u00e7\u00e3o<br>Crie uma vari\u00e1vel de ambiente com o nome DEBUG e valor 1 para habilitar a sa\u00edda de depura\u00e7\u00e3o (usando &#8220;docker -e&#8221;)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">docker-compose run -e DEBUG=1 -p 1194:1194\/udp openvpn<br><br>Obs.: para que o monitor tenha acesso ao servidor OpenVPN \u00e9 necess\u00e1rio incluir no arquivo de configura\u00e7\u00e3o do OpenVPN a seguinte linha:<br><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vim openvpn-data\/conf\/openvpn.conf\nmanagement openvpn 5555<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Configura\u00e7\u00e3o OpenVPN no Linux<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mova o arquivo <strong>ovpn<\/strong> para&nbsp;<code>\"\/etc\/openvpn\"<\/code><\/li>\n\n\n\n<li><code>\"cd \/etc\/openvpn\"<\/code>&nbsp;e insira&nbsp;o arquivo <code>\"yourserver.txt\" <\/code>contendo:\n<ul class=\"wp-block-list\">\n<li><code>your_server_user_name <\/code><\/li>\n\n\n\n<li><code>your_server_passowrd<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>No arquivo <code>\"OpenVPNConfigFile.ovpn\"<\/code> encontre ou adicione&nbsp;<code>\"auth-user-pass yourserver.txt\"<\/code> Isso permitir\u00e1 que voc\u00ea pule a inser\u00e7\u00e3o de suas credenciais sempre que iniciar a conex\u00e3o openvpn.<\/li>\n\n\n\n<li>Renomeie&nbsp;<code>\"OpenVPNConfigFile.ovpn\"<\/code> para <code>\"OpenVPNConfigFile.conf\"<\/code><\/li>\n\n\n\n<li>Em <code>\"\/etc\/default\/openvpn\"<\/code> descomentar&nbsp;<code>'AUTOSTART=\"all\"'<\/code><\/li>\n\n\n\n<li><code>\"sudo service openvpn start\"<\/code> A conex\u00e3o ser\u00e1 estabelecida toda vez que voc\u00ea iniciar o computador.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Dicas<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Editar o arquivo <code>vim ~\/.bashrc<\/code> , adicionar em .bashrc a linha a seguir, e posteriormente executar o comando <code>source ~\/.bashrc<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>alias meuip='dig @resolver4.opendns.com myip.opendns.com +short' <\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Ap\u00f3s esses passos, \u00e9 poss\u00edvel usar o comando &#8220;meuip&#8221; para identificar o IP externo e testar se a VPN est\u00e1 ativa.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Para executar o OpenVpn automaticamente, \u00e9 necess\u00e1rio editar o arquivo \/etc\/default\/openvpn e remover o coment\u00e1rio da linha <code>AUTOSTART<\/code>=&#8221;all&#8221;. Copiar o arquivo <code>.opvn<\/code> para o diret\u00f3rio <code>\/etc\/openvpn\/client.conf<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vim \/etc\/default\/openvpn \n# Descomentar a linha AUTOSTART=\"all\"\n# Mover o arquivo .ovpn para \/etc\/openvpn\/\nsudo cp arquivo.ovpn \/etc\/openvpn\/arquivo.conf<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Para executar o OpenVPN client no modo &#8220;dettached&#8221;:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo openvpn --config arquivo.ovpn --askpass --daemon<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">DNS Leak<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To avoid DNS leak use the following commands: (<a href=\"https:\/\/unix.stackexchange.com\/questions\/434916\/how-to-fix-openvpn-dns-leak\" target=\"_blank\" rel=\"noreferrer noopener\">source<\/a>)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install openvpn-systemd-resolved<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">and&nbsp;<strong>append<\/strong>&nbsp;the following lines to your .ovpn file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>script-security 2\ndhcp-option DNS 208.67.222.222\ndhcp-option DNS 208.67.220.220\ndhcp-option DNS 8.26.56.26\nup \/etc\/openvpn\/update-systemd-resolved\ndown \/etc\/openvpn\/update-systemd-resolved<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>VPN Uma Virtual Private Network (VPN) permite que voc\u00ea atravesse redes n\u00e3o confi\u00e1veis como se estivesse em uma rede privada. Ela d\u00e1 a voc\u00ea a liberdade de acessar a internet com seguran\u00e7a no seu smartphone ou notebook ao se conectar a uma rede n\u00e3o confi\u00e1vel, como o wi-fi em um hotel ou caf\u00e9. [1] Docker [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"blank","format":"standard","meta":{"footnotes":""},"categories":[12,11],"tags":[24,16,17,26,27,18,25],"class_list":["post-102","post","type-post","status-publish","format-standard","hentry","category-cloud","category-software","tag-cloud","tag-docker","tag-linux","tag-privacity","tag-security","tag-tutorial","tag-vpn"],"_links":{"self":[{"href":"https:\/\/vitorprado.com\/index.php?rest_route=\/wp\/v2\/posts\/102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vitorprado.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vitorprado.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vitorprado.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vitorprado.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=102"}],"version-history":[{"count":12,"href":"https:\/\/vitorprado.com\/index.php?rest_route=\/wp\/v2\/posts\/102\/revisions"}],"predecessor-version":[{"id":307,"href":"https:\/\/vitorprado.com\/index.php?rest_route=\/wp\/v2\/posts\/102\/revisions\/307"}],"wp:attachment":[{"href":"https:\/\/vitorprado.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vitorprado.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vitorprado.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}