{"id":53240,"date":"2019-11-27T00:00:00","date_gmt":"2019-11-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/zapuskaem-openvpn-v-dokere-za-2-sekundy"},"modified":"2020-02-18T14:01:07","modified_gmt":"2020-02-18T11:01:07","slug":"zapuskaem-openvpn-v-dokere-za-2-sekundy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","title":{"rendered":"Spou\u0161t\u00edme OpenVPN v Dockeru za 2 sekundy","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ahoj, Habr\u00e1ci! Setkali jste se n\u011bkdy se situac\u00ed, kdy byste si p\u0159\u00e1li virtu\u00e1ln\u011b se p\u0159en\u00e9st do jin\u00e9ho m\u011bsta, zem\u011b nebo dokonce na jin\u00fd kontinent? Tato pot\u0159eba m\u011b oslovuje pom\u011brn\u011b \u010dasto, a proto jsem m\u011bl velmi silnou pot\u0159ebu m\u00edt sv\u016fj VPN server, kter\u00fd bych mohl b\u011bhem p\u00e1r sekund spustit kdekoli. V tomto \u010dl\u00e1nku bych r\u00e1d prozradil sv\u016fj projekt, kter\u00fd jsem si vymyslel, kdy\u017e jsem hledal hotov\u00e9 \u0159e\u0161en\u00ed, v tomto p\u0159\u00edpad\u011b docker image, kter\u00fd by umo\u017enil rychl\u00e9 spu\u0161t\u011bn\u00ed OpenVPN serveru s minimem nastaven\u00ed a p\u0159ijatelnou \u00farovn\u00ed zabezpe\u010den\u00ed.<\/p>\n

\"Spou\u0161t\u00edme<\/a><\/noindex><\/p>\n

\n<\/a><\/noindex><\/p>\n

Pozad\u00ed<\/h3>\n

Mo\u017enost spou\u0161t\u011bt slu\u017ebu na jak\u00e9mkoli stroji: a\u0165 u\u017e fyzick\u00e9m serveru, virtu\u00e1ln\u00edm priv\u00e1tn\u00edm serveru, nebo dokonce v kontejnerov\u00e9m prostoru v r\u00e1mci jin\u00e9ho syst\u00e9mu \u0159\u00edzen\u00ed kontejner\u016f \u2014 byla kriticky d\u016fle\u017eit\u00e1. Okam\u017eit\u011b m\u011b zaujal Docker. Zaprv\u00e9, tato slu\u017eba nab\u00edr\u00e1 na popularit\u011b, a tud\u00ed\u017e \u010d\u00edm d\u00e1l v\u00edc poskytovatel\u016f nab\u00edz\u00ed hotov\u00e1 \u0159e\u0161en\u00ed s jeho p\u0159edinstalac\u00ed; zadruh\u00e9 \u2014 existuje centr\u00e1ln\u00ed \u00falo\u017ei\u0161t\u011b image, odkud si m\u016f\u017eete st\u00e1hnout a spustit slu\u017ebu jedn\u00edm p\u0159\u00edkazem v termin\u00e1lu. M\u011bla jsem my\u0161lenku, \u017ee takov\u00fd projekt u\u017e by m\u011bl existovat, a usilovn\u011b jsem hledal. Ale v\u011bt\u0161ina projekt\u016f, kter\u00e9 jsem na\u0161el \u2014 byly bu\u010f p\u0159\u00edli\u0161 komplikovan\u00e9 (bylo pot\u0159eba vytv\u00e1\u0159et kontejner pro trval\u00e9 uchov\u00e1n\u00ed dat a n\u011bkolikr\u00e1t spou\u0161t\u011bt kontejner s aplikac\u00ed s r\u016fzn\u00fdmi parametry), nebo bez smyslupln\u00e9 dokumentace, nebo dokonce zcela opu\u0161t\u011bn\u00e9. Kdy\u017e jsem nena\u0161el nic p\u0159ijateln\u00fdm, za\u010dal jsem pracovat na sv\u00e9m projektu. P\u0159edem byly bezesn\u00e9 noci zkoum\u00e1n\u00ed dokumentace, psan\u00ed k\u00f3du a lad\u011bn\u00ed, ale nakonec m\u016fj slu\u017eba uz\u0159ela sv\u011btlo a rozjasnila se v\u0161emi barvami monochromatick\u00e9 LED panelu sm\u011brova\u010de. Tak\u017ee, pros\u00edm, v\u00edtejte \u2014 Docker-OpenVPN<\/a><\/noindex>. Vymyslel jsem dokonce logo (naho\u0159e, p\u0159ed katem), ale nehodno\u0165te ho p\u0159\u00edli\u0161 p\u0159\u00edsn\u011b, nebo\u0165 nejsem design\u00e9r (u\u017e). Kdy\u017e jsem realizoval tento projekt, kladl jsem d\u016fraz na rychlost nasazen\u00ed, minimum nastaven\u00ed a p\u0159ijatelnou \u00farove\u0148 zabezpe\u010den\u00ed. Metodou pokus\u016f a omyl\u016f jsem na\u0161el optim\u00e1ln\u00ed rovnov\u00e1hu t\u011bchto krit\u00e9ri\u00ed, pravda, n\u011bkde bylo nutn\u00e9 ob\u011btovat rychlost nasazen\u00ed pro bezpe\u010dnost, a za minimum nastaven\u00ed jsem musel zaplatit p\u0159enositelnost\u00ed: v aktu\u00e1ln\u00ed konfiguraci jednou vytvo\u0159en\u00fd kontejner na jednom serveru nelze p\u0159esunout a spustit na jin\u00e9m. Nap\u0159\u00edklad v\u0161echny klientsk\u00e9 a serverov\u00e9 certifik\u00e1ty se generuj\u00ed p\u0159i spu\u0161t\u011bn\u00ed slu\u017eby a to zabere kolem 2 sekund. Nicm\u00e9n\u011b, generaci souboru DeFi Hellmana bylo nutn\u00e9 p\u0159esunout do doby sestaven\u00ed: ten se vytv\u00e1\u0159\u00ed b\u011bhem sestaven\u00ed Docker obrazu a m\u016f\u017ee trvat a\u017e 10 minut. Velmi bych si p\u0159\u00e1l z\u00edskat audit zabezpe\u010den\u00ed podobn\u00e9ho \u0159e\u0161en\u00ed od v\u00e1\u017een\u00e9ho spole\u010denstv\u00ed.<\/p>\n

Spu\u0161t\u011bn\u00ed<\/h3>\n

K provozu slu\u017eby pot\u0159ebujeme n\u011bkolik v\u011bc\u00ed:<\/p>\n

    \n
  1. Server: fyzick\u00fd nebo virtu\u00e1ln\u00ed. Teoreticky je mo\u017en\u00e9 spou\u0161t\u011bt v m\u00f3du docker-in-docker, ale tuto mo\u017enost jsem neprov\u00e1d\u011bl v \u0161irok\u00e9m testov\u00e1n\u00ed;<\/li>\n
  2. Samotn\u00fd Docker. Mnoz\u00ed poskytovatel\u00e9 hostingu nab\u00edzej\u00ed hotov\u00e1 \u0159e\u0161en\u00ed s Dockerem \u201ena palub\u011b\u201c;<\/li>\n
  3. Ve\u0159ejn\u00e1 IP adresa.<\/li>\n<\/ol>\n

    Pokud jsou v\u0161echny \u00fadaje v po\u0159\u00e1dku, zb\u00fdv\u00e1 n\u00e1m spustit n\u00e1sleduj\u00edc\u00ed p\u0159\u00edkaz v konzoli va\u0161eho serveru:<\/p>\n

    docker run --cap-add=NET_ADMIN \n-it -p 1194:1194\/udp -p 80:8080\/tcp \n-e HOST_ADDR=$(curl -s https:\/\/api.ipify.org) \nalekslitvinenk\/openvpn<\/code><\/pre>\n
    Pozorn\u00fd \u010dten\u00e1\u0159 si mohl v\u0161imnout, \u017ee IP adresa serveru se ur\u010duje automaticky pomoc\u00ed ipify.org<\/i>. Pokud to z n\u011bjak\u00e9ho d\u016fvodu nefunguje, lze adresu zadat ru\u010dn\u011b. Pokud byly v\u0161echny p\u0159edchoz\u00ed kroky provedeny spr\u00e1vn\u011b, m\u011bli bychom v konzoli vid\u011bt n\u011bco podobn\u00e9ho:<\/p>\n
    Sun Jun  9 08:56:11 2019 Initialization Sequence Completed\nSun Jun  9 08:56:12 2019 Client.ovpn file has been generated\nSun Jun  9 08:56:12 2019 Config server started, download your client.ovpn config at http:\/\/example.com\/\nSun Jun  9 08:56:12 2019 NOTE: After you download your client config, http server will be shut down!<\/code><\/pre>\n
    Jsme bl\u00edzko c\u00edle: nyn\u00ed mus\u00edme zkop\u00edrovat example.com<\/a><\/noindex><\/i> (ve va\u0161em p\u0159\u00edpad\u011b to bude adresa va\u0161eho serveru) a vlo\u017ete ji do adresn\u00edho \u0159\u00e1dku prohl\u00ed\u017ee\u010de. Jakmile stisknete Enter, soubor client.ovpn se st\u00e1hne a samotn\u00fd http server zmiz\u00ed. Pokud to vzbud\u00ed pochyby, m\u016f\u017eete vyzkou\u0161et n\u00e1sleduj\u00edc\u00ed trik: spus\u0165te p\u0159edchoz\u00ed p\u0159\u00edkaz a p\u0159idejte p\u0159\u00edznaky zp<\/i> a heslo. Nyn\u00ed, pokud vlo\u017e\u00edte vygenerovan\u00fd odkaz do okna prohl\u00ed\u017ee\u010de \u2014 z\u00edsk\u00e1te zip archiv s heslem. Jakmile m\u00e1te soubor s klientskou konfigurac\u00ed, m\u016f\u017eete pou\u017e\u00edt jak\u00fdkoliv vhodn\u00fd klient. J\u00e1 pou\u017e\u00edv\u00e1m Tunnelblick pro Mac.<\/p>\n
    Video tutori\u00e1l<\/h3>\n
    Tento video tutori\u00e1l obsahuje podrobn\u00fd n\u00e1vod k nasazen\u00ed slu\u017eby na DigitalOcean.
    \r\n        \"P\u0159ehr\u00e1t\r\n        
    <\/div>\r\n    <\/div><\/center>P.S.<\/b> Pokud pova\u017eujete tento projekt za u\u017eite\u010dn\u00fd, pros\u00edm, dejte mu hv\u011bzdi\u010dku na GitHubu, ud\u011blejte fork a \u0159ekn\u011bte o n\u011bm p\u0159\u00e1tel\u016fm. P\u0159isp\u011bvatel\u00e9 a kontroly bezpe\u010dnosti jsou tak\u00e9 \u0161iroce v\u00edt\u00e1ni.P.P.S.<\/b> Pokud se tento \u010dl\u00e1nek dostane na Habr, pl\u00e1nuji napsat dal\u0161\u00ed o tom, jak jsem spou\u0161t\u011bl docker-v-docker a docker-v-docker-v-docker, pro\u010d jsem to d\u011blal a co z toho vze\u0161lo.
    \nEDIT1:<\/b> <\/p>\n
      \n
    1. Opravil jsem chyby v publikaci,<\/li>\n
    2. Odpov\u00eddaj\u00edce na koment\u00e1\u0159e, rozhodl jsem se tuto informaci uv\u00e9st sem: p\u0159\u00edznak --privileged je pot\u0159ebn\u00fd pro pr\u00e1ci s iptables<\/li>\n<\/ol>\n
      \nEDIT2:<\/b> <\/p>\n
        \n
      1. Vylep\u0161il jsem p\u0159\u00edkaz pro spu\u0161t\u011bn\u00ed obrazu: nyn\u00ed nevy\u017eaduje p\u0159\u00edznak --privileged<\/li>\n
      2. P\u0159idal jsem odkaz na rusky mluv\u00edc\u00ed video n\u00e1vod: youtu.be\/A8zvrHsT9A0<\/a><\/noindex><\/li>\n<\/ol>\n
        Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u041f\u0440\u0438\u0432\u0435\u0442, \u0445\u0430\u0431\u0440\u043e\u0432\u0447\u0430\u043d\u0435! \u0421\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0432\u044b \u043a\u043e\u0433\u0434\u0430-\u043b\u0438\u0431\u043e \u0441 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438\u0441\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u043e\u0440\u043e\u0434, \u0441\u0442\u0440\u0430\u043d\u0443 \u0438\u043b\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u043a\u043e\u043d\u0442\u0438\u043d\u0435\u043d\u0442? \u0423 \u043c\u0435\u043d\u044f \u0442\u0430\u043a\u0430\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0447\u0430\u0441\u0442\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u043c\u0435\u0442\u044c \u0441\u0432\u043e\u0439 VPN \u0441\u0435\u0440\u0432\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0433\u0434\u0435 \u0443\u0433\u043e\u0434\u043d\u043e, \u0437\u0430 \u043f\u0430\u0440\u0443 \u0441\u0435\u043a\u0443\u043d\u0434, \u0441\u0442\u043e\u044f\u043b \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0441\u0442\u0440\u043e.\u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0445\u043e\u0447\u0443 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043f\u0440\u043e \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":53241,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Spou\u0161t\u00edme OpenVPN v Dockeru za 2 sekundy | ProHoster","description":"Ahoj, habrovatel\u00e9! Stali jste se n\u011bkdy ve situaci, kdy jste m\u011bli moc chu\u0165 virtu\u00e1ln\u011b se p\u0159en\u00e9st do jin\u00e9ho m\u011bsta, zem\u011b nebo na jin\u00fd kontinent?","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c OpenVPN \u0432 \u0414\u043e\u043a\u0435\u0440\u0435 \u0437\u0430 2 \u0441\u0435\u043a\u0443\u043d\u0434\u044b | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0445\u0430\u0431\u0440\u043e\u0432\u0447\u0430\u043d\u0435! \u0421\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0432\u044b \u043a\u043e\u0433\u0434\u0430-\u043b\u0438\u0431\u043e \u0441 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438\u0441\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u043e\u0440\u043e\u0434, \u0441\u0442\u0440\u0430\u043d\u0443 \u0438\u043b\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u043a\u043e\u043d\u0442\u0438\u043d\u0435\u043d\u0442?","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-26T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53240","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:37:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:28:50","updated":"2026-01-24 06:37:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=53240"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53240\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/53241"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=53240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=53240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=53240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}