{"id":53240,"date":"2019-11-27T00:00:00","date_gmt":"2019-11-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/zapuskaem-openvpn-v-dokere-za-2-sekundy"},"modified":"2020-02-18T14:01:07","modified_gmt":"2020-02-18T11:01:07","slug":"zapuskaem-openvpn-v-dokere-za-2-sekundy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","title":{"rendered":"Lans\u0103m OpenVPN \u00een Docker \u00een 2 secunde","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Salut, comunitatea Habr! V-a\u021bi confruntat vreodat\u0103 cu situa\u021bia \u00een care v-a\u021bi dori foarte mult s\u0103 c\u0103l\u0103tori\u021bi virtual \u00eentr-un alt ora\u0219, \u021bar\u0103 sau chiar pe un alt continent? Aceast\u0103 nevoie \u00eemi apare destul de des, a\u0219a c\u0103 posibilitatea de a avea propriul server VPN, pe care s\u0103-l pot porni de oriunde, \u00een c\u00e2teva secunde, a fost destul de acut\u0103. \u00cen acest articol vreau s\u0103 v\u0103 povestesc despre proiectul meu, pe care l-am g\u00e2ndit atunci c\u00e2nd c\u0103utam o solu\u021bie gata f\u0103cut\u0103, \u00een acest caz imaginea Docker, care s\u0103 permit\u0103 ridicarea rapid\u0103 a unui server OpenVPN, cu un minim de set\u0103ri \u0219i un nivel acceptabil de securitate.<\/p>\n

\"Lans\u0103m<\/a><\/noindex><\/p>\n

\n<\/a><\/noindex><\/p>\n

Povestea<\/h3>\n

Posibilitatea de a rula serviciul pe orice ma\u0219in\u0103: fie c\u0103 este vorba de un server fizic, un server privat virtual sau, pur \u0219i simplu, un spa\u021biu de containere \u00eentr-un alt sistem de gestionare a containerelor \u2014 a fost critic\u0103. \u00cen prima faz\u0103, aten\u021bia mea a fost atras\u0103 de Docker. \u00cen primul r\u00e2nd, acest serviciu c\u00e2\u0219tig\u0103 popularitate, ceea ce \u00eenseamn\u0103 c\u0103 din ce \u00een ce mai mul\u021bi furnizori ofer\u0103 solu\u021bii gata preg\u0103tite cu instalarea sa; \u00een al doilea r\u00e2nd, exist\u0103 un depozit centralizat de imagini, de unde po\u021bi desc\u0103rca \u0219i rula serviciul cu un singur comanda \u00een terminal. G\u00e2ndul c\u0103 un astfel de proiect ar trebui s\u0103 existe deja m-a vizitat \u0219i am c\u0103utat insistent. Dar majoritatea proiectelor pe care le-am g\u0103sit erau fie prea voluminoase (era nevoie s\u0103 creezi un container pentru stocarea permanent\u0103 a datelor \u0219i s\u0103 lansezi containerul cu aplica\u021bia de mai multe ori cu diferite parametrii), fie f\u0103r\u0103 o documenta\u021bie rezonabil\u0103, fie complet abandonate. Neav\u00e2nd g\u0103sit nimic acceptabil, am \u00eenceput s\u0103 lucrez la propriul meu proiect. \u00cen fa\u021ba mea erau nop\u021bi nedormite de studiu al documenta\u021biei, scriere de cod \u0219i depanare, dar, \u00een cele din urm\u0103, serviciul meu a v\u0103zut lumina zilei \u0219i a \u00eenceput s\u0103 str\u0103luceasc\u0103 cu toate culorile panoului LED monochrom al routerului. A\u0219adar, v\u0103 rog s\u0103-l primi\u021bi cu bra\u021bele deschise \u2014 Docker-OpenVPN<\/a><\/noindex>. Am creat chiar un logo (deasupra, \u00eenainte de cat), dar nu-l judeca\u021bi prea aspru, deoarece nu sunt designer (\u00eenc\u0103). C\u00e2nd am realizat acest proiect, am pus pe primul loc viteza de desf\u0103\u0219urare, un minim de set\u0103ri \u0219i un nivel acceptabil de securitate. Prin \u00eencerc\u0103ri \u0219i erori, am g\u0103sit un echilibru optim \u00eentre aceste criterii, de\u0219i \u00een unele locuri a fost necesar s\u0103 sacrific viteza de desf\u0103\u0219urare pentru securitate, iar pentru un minim de set\u0103ri a fost necesar\u0103 o plat\u0103 \u00een portabilitate: \u00een configura\u021bia actual\u0103, un container creat pe un server nu poate fi mutat \u0219i lansat pe altul. De exemplu, toate certificatele client \u0219i server sunt generate la pornirea serviciului \u0219i acest proces dureaz\u0103 aproximativ 2 secunde. Totu\u0219i, generarea fi\u0219ierului Diffie-Hellman a fost mutat\u0103 \u00een timpul compil\u0103rii: acesta se creeaz\u0103 \u00een timpul construirii imaginii Docker \u0219i poate dura p\u00e2n\u0103 la 10 minute. Mi-ar pl\u0103cea foarte mult s\u0103 ob\u021bin un audit de securitate al unei asemenea solu\u021bii din partea comunit\u0103\u021bii foarte respectate.<\/p>\n

Pornire<\/h3>\n

Pentru a porni serviciul, avem nevoie de c\u00e2teva lucruri:<\/p>\n

    \n
  1. Server: fizic sau virtual. Teoretic, se poate rula \u00een modul Docker-in-Docker, dar nu am efectuat teste la scar\u0103 larg\u0103 pentru aceast\u0103 op\u021biune;<\/li>\n
  2. Docker propriu-zis. Mul\u021bi furnizori de servicii de g\u0103zduire ofer\u0103 solu\u021bii gata f\u0103cute cu Docker \u201ela bord\u201d;<\/li>\n
  3. O adres\u0103 IP public\u0103.<\/li>\n<\/ol>\n

    Dac\u0103 toate datele sunt \u00een ordine, trebuie doar s\u0103 rul\u0103m urm\u0103toarea comand\u0103 \u00een consola serverului dumneavoastr\u0103:<\/p>\n

    docker run --cap-add=NET_ADMIN \n-it -p 1194:1194\/udp -p 80:8080\/tcp \n-e HOST_ADDR=$(curl -s https:\/\/api.ipify.org) \nalekslitvinenk\/openvpn<\/code><\/pre>\n
    Cineva atent ar fi putut observa c\u0103 adresa IP a serverului este determinat\u0103 automat folosind ipify.org<\/i>. Dac\u0103 din anumite motive acest lucru nu func\u021bioneaz\u0103, se poate specifica manual adresa. Dac\u0103 toate pa\u0219ii anteriori au fost efectua\u021bi corect, ar trebui s\u0103 vedem \u00een consol\u0103 ceva de genul:<\/p>\n
    Sun Jun  9 08:56:11 2019 Secven\u021b\u0103 de ini\u021bializare completat\u0103\nSun Jun  9 08:56:12 2019 Fi\u0219ierul Client.ovpn a fost generat\nSun Jun  9 08:56:12 2019 Serverul de configura\u021bie a fost pornit, desc\u0103rca\u021bi configura\u021bia client.ovpn de la http:\/\/example.com\/\nSun Jun  9 08:56:12 2019 NOT\u0102: Dup\u0103 ce desc\u0103rca\u021bi configura\u021bia client, serverul HTTP va fi oprit!<\/code><\/pre>\n
    Suntem aproape de \u021bint\u0103: acum trebuie s\u0103 copiem example.com<\/a><\/noindex><\/i> (\u00een cazul dumneavoastr\u0103 va fi adresa serverului dvs.) \u0219i introduce\u021bi \u00een bara de adrese a browserului. Dup\u0103 ce ap\u0103sa\u021bi Enter, fi\u0219ierul client.ovpn va fi desc\u0103rcat, iar serverul http va disp\u0103rea. Dac\u0103 aceast\u0103 solu\u021bie ridic\u0103 semne de \u00eentrebare, pute\u021bi folosi urm\u0103torul truc: rula\u021bi comanda anterioar\u0103 \u0219i ad\u0103uga\u021bi flgile zp<\/i> \u0219i parola. Acum, dac\u0103 introduce\u021bi linkul generat \u00een fereastra browserului, ve\u021bi ob\u021bine un arhiv\u0103 zip cu parola. C\u00e2nd ave\u021bi fi\u0219ierul cu configura\u021bia clientului, pute\u021bi folosi orice client potrivit. Eu folosesc Tunnelblick pentru Mac.<\/p>\n
    Tutorial video<\/h3>\n
    Acest tutorial video con\u021bine instruc\u021biuni detaliate pentru implementarea serviciului pe DigitalOcean.
    \r\n        \"Reda\u021bi\r\n        
    <\/div>\r\n    <\/div><\/center>P.S.<\/b> Dac\u0103 considera\u021bi c\u0103 acest proiect este util, v\u0103 rug\u0103m s\u0103 \u00eei da\u021bi o stea pe GitHub, s\u0103 face\u021bi fork \u0219i s\u0103 povesti\u021bi prietenilor. Contribuitorii \u0219i auditul de securitate sunt, de asemenea, binevenite.P.P.S.<\/b> Dac\u0103 acest articol va ajunge pe Habr, inten\u021bionez s\u0103 scriu urm\u0103torul despre cum am rulat docker-din-docker \u0219i docker-din-docker-din-docker, de ce am f\u0103cut acest lucru \u0219i ce a ie\u0219it.
    \nEDIT1:<\/b> <\/p>\n
      \n
    1. Am corectat erorile din publica\u021bie,<\/li>\n
    2. R\u0103spunz\u00e2nd la comentarii, am decis s\u0103 scot aceste informa\u021bii aici: flag-ul —privileged este necesar pentru a lucra cu iptables<\/li>\n<\/ol>\n
      \nEDIT2:<\/b> <\/p>\n
        \n
      1. Am \u00eembun\u0103t\u0103\u021bit comanda de lansare a imaginii: acum nu mai necesit\u0103 flag-ul —privileged<\/li>\n
      2. Am ad\u0103ugat un link la un ghid video \u00een limba rom\u00e2n\u0103: youtu.be\/A8zvrHsT9A0<\/a><\/noindex><\/li>\n<\/ol>\n
        Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u041f\u0440\u0438\u0432\u0435\u0442, \u0445\u0430\u0431\u0440\u043e\u0432\u0447\u0430\u043d\u0435! \u0421\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0432\u044b \u043a\u043e\u0433\u0434\u0430-\u043b\u0438\u0431\u043e \u0441 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438\u0441\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u043e\u0440\u043e\u0434, \u0441\u0442\u0440\u0430\u043d\u0443 \u0438\u043b\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u043a\u043e\u043d\u0442\u0438\u043d\u0435\u043d\u0442? \u0423 \u043c\u0435\u043d\u044f \u0442\u0430\u043a\u0430\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0447\u0430\u0441\u0442\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u043c\u0435\u0442\u044c \u0441\u0432\u043e\u0439 VPN \u0441\u0435\u0440\u0432\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0433\u0434\u0435 \u0443\u0433\u043e\u0434\u043d\u043e, \u0437\u0430 \u043f\u0430\u0440\u0443 \u0441\u0435\u043a\u0443\u043d\u0434, \u0441\u0442\u043e\u044f\u043b \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0441\u0442\u0440\u043e.\u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0445\u043e\u0447\u0443 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043f\u0440\u043e \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":53241,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rul\u0103m OpenVPN \u00een Docker \u00een 2 secunde | ProHoster","description":"Salut, habrani! A\u021bi dat vreodat\u0103 peste o situa\u021bie \u00een care a\u021bi dori foarte mult s\u0103 v\u0103 muta\u021bi virtual \u00eentr-un alt ora\u0219, o alt\u0103 \u021bar\u0103 sau pe un alt continent?","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c OpenVPN \u0432 \u0414\u043e\u043a\u0435\u0440\u0435 \u0437\u0430 2 \u0441\u0435\u043a\u0443\u043d\u0434\u044b | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0445\u0430\u0431\u0440\u043e\u0432\u0447\u0430\u043d\u0435! \u0421\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0432\u044b \u043a\u043e\u0433\u0434\u0430-\u043b\u0438\u0431\u043e \u0441 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438\u0441\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u043e\u0440\u043e\u0434, \u0441\u0442\u0440\u0430\u043d\u0443 \u0438\u043b\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u043a\u043e\u043d\u0442\u0438\u043d\u0435\u043d\u0442?","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-26T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53240","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:37:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:28:50","updated":"2026-01-24 06:37:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=53240"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53240\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/53241"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=53240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=53240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=53240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}