Membangun Server OpenVPN Menggunakan Docker

Diposting oleh Problem Child Selasa, Februari 16, 2021 Posting Komentar

Membangun Server OpenVPN Menggunakan Docker. Oke di tutorial ini saya akan sharing sedikit mengenai bagaimana cara deploy OpenVPN di server. Nah, untuk lebih praktis dan amannya, kita bangun server VPN kita diatas container. Ya, disini kita akan menggunakan docker.

Di tutorial ini saya menggunakan server dengan sistem operasi Ubuntu 18.04 LTS.

Pastikan kalian sudah menginstall Docker maupun Docker Compose. Untuk tutorialnya bisa cek disini:

Install Docker

sudo apt-get install apt-transport-https ca-certificates curl gnupg-agent software-properties-common

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

sudo apt-get update && sudo apt-get install docker-ce docker-ce-cli containerd.io

sudo usermod -aG docker $(whoami)

Install Docker Compose

sudo curl -L https://github.com/docker/compose/releases/download/1.24.1/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose

sudo chmod +x /usr/local/bin/docker-compose

docker-compose --version

Nah, berikut docker-compose untuk openvpn nya. Disini saya menggunakan image dari linuxserver.

---
version: "2.1"
services:
  openvpn-as:
    image: linuxserver/openvpn-as:version-2.8.7-c7d6c210-Ubuntu18
    container_name: openvpn-as
    cap_add:
      - NET_ADMIN
    network_mode: "host"
    environment:
      - PUID=1004
      - PGID=999
      - TZ=Europe/London
      - INTERFACE=ens33
    volumes:
      - ./config:/config
    ports:
      - 127.0.0.1:943:943
      - 6969:9443
      - 6969:1194/udp
    restart: unless-stopped

Untuk penjelasan tiap barisnya bisa cek disini:

https://hub.docker.com/r/linuxserver/openvpn-as

Nah untuk mengekspos dashboard OpenVPN-nya, kita gunakan reverse proxy di Nginx.

server {
       listen         80;
       server_name    openvpn.linuxsec.org;
       return         301 https://$server_name$request_uri;
}

server {
  listen       443 ssl http2;
  listen       [::]:443 ssl http2;
  server_name  openvpn.linuxsec.org;
  server_tokens off;

  ssl_protocols TLSv1.2 TLSv1.3;          # TLS 1.3 requires nginx >= 1.13.0
  ssl_prefer_server_ciphers on;
  ssl_dhparam /etc/ssl/certs/dhparam.pem; # openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 4096
  ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
  ssl_ecdh_curve secp384r1;               # Requires nginx >= 1.1.0
  ssl_session_timeout  10m;
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off;                # Requires nginx >= 1.5.9
  ssl_stapling on;                        # Requires nginx >= 1.3.7
  ssl_stapling_verify on;                 # Requires nginx => 1.3.7
  ssl_early_data off;                     # 0-RTT, enable if desired - Requires nginx >= 1.15.4
  resolver 1.1.1.1 valid=300s;            # Replace with your local resolver
  resolver_timeout 5s;

# HTTP Security Headers
  ssl_certificate /etc/letsencrypt/live/openvpn.linuxsec.org/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/openvpn.linuxsec.org/privkey.pem;
  root /var/www/openvpn-web/;
  access_log /var/log/nginx/openvpn_dashboard_access.log;
  index index.html;

location / {
        proxy_pass       https://localhost:943;
        proxy_set_header Host $proxy_host;
        proxy_ssl_server_name on;
        proxy_set_header Accept-Encoding "";
        proxy_pass_request_body on;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_intercept_errors on;
  }
}

Nah default creds untuk login admin adalah: