{"id":53240,"date":"2019-11-27T00:00:00","date_gmt":"2019-11-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/zapuskaem-openvpn-v-dokere-za-2-sekundy"},"modified":"2020-02-18T14:01:07","modified_gmt":"2020-02-18T11:01:07","slug":"zapuskaem-openvpn-v-dokere-za-2-sekundy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","title":{"rendered":"Pokre\u0107emo OpenVPN u Dockeru za 2 sekunde","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pozdrav, Habrani! Jeste li ikada do\u017eivjeli situaciju kada biste \u017eeljeli virtualno preseliti u drugi grad, zemlju ili \u010dak na drugi kontinent? Ta mi se potreba \u010desto javlja, pa mi je mogu\u0107nost da imam svoj VPN server, koji mogu pokrenuti bilo gdje u nekoliko sekundi, bila od velike va\u017enosti. U ovom \u010dlanku \u017eelim pri\u010dati o svom projektu koji sam osmislio dok sam tra\u017eio rje\u0161enje, u ovom slu\u010daju Docker sliku, koja bi brzo podigla OpenVPN server s minimalnim postavkama i prihvatljivim razinama sigurnosti.<\/p>\n

\"Pokre\u0107emo<\/a><\/noindex><\/p>\n

\n<\/a><\/noindex><\/p>\n

Povijest<\/h3>\n

Mogu\u0107nost pokretanja usluge na bilo kojoj ma\u0161ini: bilo da je to fizi\u010dki server, virtualni privatni server ili \u010dak kontejnerski prostor unutar drugog sustava za upravljanje kontejnerima \u2014 bila je od kriti\u010dne va\u017enosti. Moj je pogled odmah pao na Docker. Prvo, ova usluga stje\u010de popularnost, a stoga sve vi\u0161e i vi\u0161e pru\u017eatelja nudi gotova rje\u0161enja s njegovom predinstalacijom; drugo \u2014 postoji centralizirano skladi\u0161te slika s kojeg mo\u017eete preuzeti i pokrenuti uslugu pomo\u0107u jedne naredbe u terminalu. Mislio sam da bi takav projekt ve\u0107 trebao postojati i neprestano sam tra\u017eio. No, ve\u0107ina projekata koje sam na\u0161ao bila su ili previ\u0161e zamorna (trebalo je stvoriti kontejner za trajno pohranjivanje podataka i nekoliko puta pokrenuti kontejner s aplikacijom s razli\u010ditim parametrima), ili bez razumnog dokumenata, ili jednostavno napu\u0161tena. Ne pronalaze\u0107i ni\u0161ta prikladno, zapo\u010deo sam rad na svom projektu. Pred sobom sam imao besane no\u0107i prou\u010davanja dokumentacije, pisanja koda i ispravljanja gre\u0161aka, ali na kraju je moja usluga ugledala svjetlo dana i zasjala svim bojama monokromatske LED plo\u010de rutera. Dakle, molim vas, dobrodo\u0161li \u2014 Docker-OpenVPN<\/a><\/noindex>. Smislio sam logo (gore, prije odjeljka), ali nemojte ga previ\u0161e kritizirati, jer nisam dizajner (vi\u0161e). Kada sam realizirao ovaj projekt, brzina implementacije, minimalna pode\u0161avanja i prihvatljiva razina sigurnosti bili su mi na prvom mjestu. Metodom poku\u0161aja i pogre\u0161aka prona\u0161ao sam optimalnu ravnote\u017eu ovih kriterija, iako sam nekad morao \u017ertvovati brzinu implementacije zbog sigurnosti, a za minimalna pode\u0161avanja platiti prenosivosti: u trenutnoj konfiguraciji, jednom stvoreni kontejner na jednom poslu\u017eitelju ne mo\u017ee se prenijeti i pokrenuti na drugom. Na primjer, svi klijentski i serverski certifikati generiraju se prilikom pokretanja usluge, i to traje oko 2 sekunde. Me\u0111utim, generaciju Defi-Hellman datoteke morao sam prebaciti u vrijeme gradnje: ona se stvara tijekom izgradnje Docker slike i mo\u017ee trajati do 10 minuta. Bio bih vrlo zahvalan za sigurnosni audit takvog rje\u0161enja od ugledne zajednice.<\/p>\n

Pokretanje<\/h3>\n

Da pokrenemo uslugu, potrebne su nam sljede\u0107e stvari:<\/p>\n

    \n
  1. Poslu\u017eitelj: fizi\u010dki ili virtualni. Teoretski je mogu\u0107e pokretati u na\u010dinu Docker-u-u-Dockeru, ali nisam provodio opse\u017eno testiranje te opcije;<\/li>\n
  2. Zapravo Docker. Mnogi pru\u017eatelji hosting usluga nude gotova rje\u0161enja s Docker-om 'na brodu';<\/li>\n
  3. Javni IP adresa.<\/li>\n<\/ol>\n

    Ako su svi podaci na mjestu, sljede\u0107e nam je samo pokrenuti sljede\u0107u naredbu u konzoli va\u0161eg poslu\u017eitelja:<\/p>\n

    docker run --cap-add=NET_ADMIN \n-it -p 1194:1194\/udp -p 80:8080\/tcp \n-e HOST_ADDR=$(curl -s https:\/\/api.ipify.org) \nalekslitvinenk\/openvpn<\/code><\/pre>\n
    Pa\u017eljivi \u010ditatelj mogao je primijetiti da se IP adresa poslu\u017eitelja automatski odre\u0111uje putem ipify.org<\/i>. Ako iz nekog razloga to ne funkcionira, adresa se mo\u017ee navesti ru\u010dno. Ako su svi prethodni koraci ispravno izvr\u0161eni, trebali bismo vidjeti ne\u0161to sli\u010dno u konzoli:<\/p>\n
    Sun Jun  9 08:56:11 2019 Inicijalizacija zavr\u0161ena\nSun Jun  9 08:56:12 2019 Datoteka Client.ovpn je generirana\nSun Jun  9 08:56:12 2019 Config server pokrenut, preuzmite svoju client.ovpn konfiguraciju na http:\/\/example.com\/\nSun Jun  9 08:56:12 2019 NAPOMENA: Nakon preuzimanja va\u0161e klijentske konfiguracije, HTTP poslu\u017eitelj \u0107e se isklju\u010diti!<\/code><\/pre>\n
    Blizu smo cilju: sada trebamo kopirati example.com<\/a><\/noindex><\/i> (u va\u0161em slu\u010daju \u0107e to biti adresa va\u0161eg poslu\u017eitelja) i umetnite je u adresnu traku preglednika. Nakon \u0161to pritisnete Enter, client.ovpn datoteka \u0107e se preuzeti, a sam HTTP poslu\u017eitelj \u0107e nestati. Ako ovo rje\u0161enje izaziva sumnju, mo\u017eete isprobati sljede\u0107i trik: pokrenuti prethodnu naredbu i dodati oznake zp<\/i> i lozinku. Sada, ako umetnete generiranu vezu u prozor preglednika \u2014 dobit \u0107ete zip arhivu s lozinkom. Kada imate datoteku s klijentskom konfiguracijom, mo\u017eete koristiti bilo kojeg pogodnog klijenta. Ja koristim Tunnelblick za Mac.<\/p>\n
    Video tutorial<\/h3>\n
    Ovaj video tutorial sadr\u017ei detaljne upute za postavljanje usluge na DigitalOcean.
    \r\n        \"Pogledajte\r\n        
    <\/div>\r\n    <\/div><\/center>P.S.<\/b> Ako smatrate da je ovaj projekt koristan, molimo vas da mu date zvjezdicu na GitHubu, napravite fork i ispri\u010dajte prijateljima. Donatori i revizori sigurnosti su tako\u0111er vrlo dobrodo\u0161li.P.S.<\/b> Ako ovaj \u010dlanak dospije na Habr, planiram napisati sljede\u0107i o tome kako sam pokrenuo docker-u-docker i docker-u-docker-u-docker, za\u0161to sam to radio i \u0161to je iz toga proiza\u0161lo.
    \nEDIT1:<\/b> <\/p>\n
      \n
    1. Ispravio sam gre\u0161ke u objavi,<\/li>\n
    2. Odgovaraju\u0107i na komentare, odlu\u010dio sam prenijeti ove informacije ovdje: zastavica --privileged je potrebna za rad s iptables.<\/li>\n<\/ol>\n
      \nEDIT2:<\/b> <\/p>\n
        \n
      1. Pobolj\u0161ao sam naredbu za pokretanje slike: sada ne zahtijeva zastavicu --privileged.<\/li>\n
      2. Dodao sam vezu na video vodi\u010d na ruskom jeziku: youtu.be\/A8zvrHsT9A0<\/a><\/noindex><\/li>\n<\/ol>\n
        Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u041f\u0440\u0438\u0432\u0435\u0442, \u0445\u0430\u0431\u0440\u043e\u0432\u0447\u0430\u043d\u0435! \u0421\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0432\u044b \u043a\u043e\u0433\u0434\u0430-\u043b\u0438\u0431\u043e \u0441 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438\u0441\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u043e\u0440\u043e\u0434, \u0441\u0442\u0440\u0430\u043d\u0443 \u0438\u043b\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u043a\u043e\u043d\u0442\u0438\u043d\u0435\u043d\u0442? \u0423 \u043c\u0435\u043d\u044f \u0442\u0430\u043a\u0430\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0447\u0430\u0441\u0442\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u043c\u0435\u0442\u044c \u0441\u0432\u043e\u0439 VPN \u0441\u0435\u0440\u0432\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0433\u0434\u0435 \u0443\u0433\u043e\u0434\u043d\u043e, \u0437\u0430 \u043f\u0430\u0440\u0443 \u0441\u0435\u043a\u0443\u043d\u0434, \u0441\u0442\u043e\u044f\u043b \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0441\u0442\u0440\u043e.\u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0445\u043e\u0447\u0443 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043f\u0440\u043e \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":53241,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pokre\u0107emo OpenVPN u Dockeru za 2 sekunde | ProHoster","description":"Pozdrav, Habr korisnici! Jeste li ikada nai\u0161li na situaciju kada ste stvarno \u017eeljeli virtualno preseliti u drugi grad, dr\u017eavu ili na drugi kontinent?","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c OpenVPN \u0432 \u0414\u043e\u043a\u0435\u0440\u0435 \u0437\u0430 2 \u0441\u0435\u043a\u0443\u043d\u0434\u044b | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0445\u0430\u0431\u0440\u043e\u0432\u0447\u0430\u043d\u0435! \u0421\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0432\u044b \u043a\u043e\u0433\u0434\u0430-\u043b\u0438\u0431\u043e \u0441 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438\u0441\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u043e\u0440\u043e\u0434, \u0441\u0442\u0440\u0430\u043d\u0443 \u0438\u043b\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u043a\u043e\u043d\u0442\u0438\u043d\u0435\u043d\u0442?","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-26T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53240","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:37:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:28:50","updated":"2026-01-24 06:37:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/53240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=53240"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/53240\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/53241"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=53240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=53240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=53240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}