{"id":53240,"date":"2019-11-27T00:00:00","date_gmt":"2019-11-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/zapuskaem-openvpn-v-dokere-za-2-sekundy"},"modified":"2020-02-18T14:01:07","modified_gmt":"2020-02-18T11:01:07","slug":"zapuskaem-openvpn-v-dokere-za-2-sekundy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","title":{"rendered":"Za\u017eenemo OpenVPN v Dockerju v 2 sekundah","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zdravo, \u010dlanovi Habra! Da li ste se ikada suo\u010dili sa situacijom kada ste zaista \u017eeleli da se virtuelno preselite u neki drugi grad, zemlju ili \u010dak na drugi kontinent? Meni je ta potreba \u010desto prisutna, zbog \u010dega je mogu\u0107nost imanja svog VPN servera, koji se mo\u017ee pokrenuti bilo gde u samo nekoliko sekundi, bila veoma va\u017ena. U ovom \u010dlanku \u017eelim da vas upoznam sa svojim projektom, koji sam osmislio dok sam tra\u017eio re\u0161enje, u ovom slu\u010daju Docker sliku koja bi omogu\u0107ila brzo podizanje OpenVPN servera, uz minimum pode\u0161avanja i prihvatljiv nivo sigurnosti.<\/p>\n

\"Za\u017eenemo<\/a><\/noindex><\/p>\n

\n<\/a><\/noindex><\/p>\n

Pozadina<\/h3>\n

Mogu\u0107nost pokretanja servisa na bilo kojoj ma\u0161ini: bilo da je re\u010d o fizi\u010dkom serveru, virtuelnom privatnom serveru ili \u010dak kontejnerskom prostoru unutar drugog sistema za upravljanje kontejnerima \u2014 bila je od su\u0161tinskog zna\u010daja. Moj fokus odmah je bio na Docker-u. Prvo, ova usluga dobija na popularnosti, a to zna\u010di da sve vi\u0161e i vi\u0161e provajdera nudi gotova re\u0161enja sa njegovom instalacijom; drugo \u2014 postoji centralizovano skladi\u0161te slika iz kojeg se mo\u017ee preuzeti i pokrenuti usluga jednom komandom u terminalu. Mislio sam da ovakav projekat ve\u0107 mora postojati i uporno sam tra\u017eio. Me\u0111utim, ve\u0107ina projekata koje sam na\u0161ao bila je ili previ\u0161e obimna (potrebno je bilo kreirati kontejner za trajno skladi\u0161tenje podataka i vi\u0161e puta pokrenuti kontejner sa aplikacijom sa razli\u010ditim parametrima), ili nije imala odgovaraju\u0107u dokumentaciju, ili su bile potpuno napu\u0161tene. Ne nalaze\u0107i ni\u0161ta prihvatljivo, po\u010deo sam rad na svom projektu. Ispred su bile besane no\u0107i prou\u010davanja dokumentacije, pisanja koda i otklanjanja gre\u0161aka, ali na kraju je moj servis ugledao svetlost dana i zasvetleo svim bojama monohromatske LED panela rutera. Dakle, molim vas da prihvatite \u2014 Docker-OpenVPN<\/a><\/noindex>. Naredil sem celo logotip (zgoraj, pred prehodom), a ne sodite ga strogo, ker nisem oblikovalec (\u017ee). Ko sem izvajal ta projekt, sem postavil hitrost namestitve, minimalne nastavitve in sprejemljivo raven varnosti na prvo mesto. S poskusi in napakami sem na\u0161el optimalno ravnote\u017eje med temi kriteriji, vendar sem nekje moral \u017ertvovati hitrost namestitve za varnost, minimalne nastavitve pa so pla\u010dale ceno prenosljivosti: v trenutni konfiguraciji enkrat ustvarjenega kontejnerja na enem stre\u017eniku ni mogo\u010de prenesti in zagnati na drugem. Na primer, vsi klientski in stre\u017eni\u0161ki certifikati se generirajo ob zagonu storitve in to traja okoli 2 sekundi. Kljub temu sem moral ustvarjanje datoteke Diffie-Hellman prenesti v \u010das gradnje: ta se ustvari med gradnjo Docker slike in lahko traja do 10 minut. Zelo bi rad prejel varnostni audit takega re\u0161enja od ugledne skupnosti.<\/p>\n

Pokretanje<\/h3>\n

Za zagon storitve potrebujemo nekaj stvari:<\/p>\n

    \n
  1. Stre\u017enik: fizi\u010dni ali virtualni. Teoreti\u010dno je mo\u017eno zagnati v na\u010dinu docker-v-docker, a te mo\u017enosti nisem obse\u017eno testiral;<\/li>\n
  2. Sama Docker. Veliko ponudnikov gostovanja ponuja pripravljene re\u0161itve z Dockerjem 'na krovu';<\/li>\n
  3. Javni IP naslov.<\/li>\n<\/ol>\n

    \u010ce so vsi podatki na mestu, nam ostane le \u0161e zagnati naslednji ukaz v konzoli va\u0161ega stre\u017enika:<\/p>\n

    docker run --cap-add=NET_ADMIN \n-it -p 1194:1194\/udp -p 80:8080\/tcp \n-e HOST_ADDR=$(curl -s https:\/\/api.ipify.org) \nalekslitvinenk\/openvpn<\/code><\/pre>\n
    Pozoren bralec bi lahko opazil, da se IP naslov stre\u017enika samodejno dolo\u010di s pomo\u010djo ipify.org<\/i>. \u010ce iz kakr\u0161negakoli razloga to ne deluje, lahko naslov vnesete ro\u010dno. \u010ce so vsi prej\u0161nji koraki pravilno izvedeni, bi morali v konzoli videti nekaj takega:<\/p>\n
    Sun Jun  9 08:56:11 2019 Inicializacijska sekvenca zaklju\u010dena\nSun Jun  9 08:56:12 2019 Datoteka Client.ovpn je bila ustvarjena\nSun Jun  9 08:56:12 2019 Konfiguracija stre\u017enika je za\u010dela, prenesite svojo konfiguracijo client.ovpn na http:\/\/example.com\/\nSun Jun  9 08:56:12 2019 OPOMBA: Po prenosu va\u0161e konfiguracije klienta, se bo HTTP stre\u017enik izklopil!<\/code><\/pre>\n
    Bli\u017eamo se cilju: zdaj moramo kopirati example.com<\/a><\/noindex><\/i> (v va\u0161em primeru bo to naslov va\u0161ega stre\u017enika) in ga prilepite v naslovno vrstico brskalnika. Ko pritisnete Enter, se bo datoteka client.ovpn nalo\u017eila, http stre\u017enik pa bo izginil. \u010ce imate dvome o tem re\u0161itvi, lahko uporabite naslednji trik: za\u017eene prej\u0161nji ukaz in dodate zastavice zp<\/i> in geslo. Zdaj, \u010de prilepite ustvarjeno povezavo v okno brskalnika \u2014 boste prejeli zip arhiv z geslom. Ko imate datoteko s konfiguracijo odjemalca, lahko uporabite katerikoli ustrezen odjemalec. Jaz uporabljam Tunnelblick za Mac.<\/p>\n
    Video tutrial<\/h3>\n
    Ta video tutrial vsebuje podrobna navodila za uvajanje storitve na DigitalOcean.
    \r\n        \"Predvajaj\r\n        
    <\/div>\r\n    <\/div><\/center>P.S.<\/b> \u010ce menite, da je ta projekt koristen, prosim, dajte mu zvezdico na GitHubu, naredite fork in poveste prijateljem. Prispevki in varnostne revizije so prav tako zelo dobrodo\u0161li.P.P.S.<\/b> \u010ce ta \u010dlanek pride na Habr, nameravam napisati naslednjega o tem, kako sem zagnal Docker-v-Docker in Docker-v-Docker-v-Docker, zakaj sem to delal in kaj je iz tega iz\u0161lo.
    \nEDIT1:<\/b> <\/p>\n
      \n
    1. Popravil napake v objavi,<\/li>\n
    2. Odgovarjaju\u0107i na komentare, odlu\u010dio sam da ovu informaciju iznesem ovde: zastavica —privileged je potrebna za rad sa iptables.<\/li>\n<\/ol>\n
      \nEDIT2:<\/b> <\/p>\n
        \n
      1. Pobolj\u0161ao sam komandu za pokretanje slike: sada ne zahteva zastavicu —privileged.<\/li>\n
      2. Dodano poveznico na video priro\u010dnik v ru\u0161\u010dini: youtu.be\/A8zvrHsT9A0<\/a><\/noindex><\/li>\n<\/ol>\n
        Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
        \u041f\u0440\u0438\u0432\u0435\u0442, \u0445\u0430\u0431\u0440\u043e\u0432\u0447\u0430\u043d\u0435! \u0421\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0432\u044b \u043a\u043e\u0433\u0434\u0430-\u043b\u0438\u0431\u043e \u0441 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438\u0441\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u043e\u0440\u043e\u0434, \u0441\u0442\u0440\u0430\u043d\u0443 \u0438\u043b\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u043a\u043e\u043d\u0442\u0438\u043d\u0435\u043d\u0442? \u0423 \u043c\u0435\u043d\u044f \u0442\u0430\u043a\u0430\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0447\u0430\u0441\u0442\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u043c\u0435\u0442\u044c \u0441\u0432\u043e\u0439 VPN \u0441\u0435\u0440\u0432\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0433\u0434\u0435 \u0443\u0433\u043e\u0434\u043d\u043e, \u0437\u0430 \u043f\u0430\u0440\u0443 \u0441\u0435\u043a\u0443\u043d\u0434, \u0441\u0442\u043e\u044f\u043b \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0441\u0442\u0440\u043e.\u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0445\u043e\u0447\u0443 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043f\u0440\u043e \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":53241,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zaganjamo OpenVPN v Dockerju v 2 sekundah | ProHoster","description":"\u017divijo, Habr uporabniki! Ste se kdaj soo\u010dili s situacijo, ko ste si \u017eeleli virtualno preseliti v drugo mesto, dr\u017eavo ali na drug kontinent?","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c OpenVPN \u0432 \u0414\u043e\u043a\u0435\u0440\u0435 \u0437\u0430 2 \u0441\u0435\u043a\u0443\u043d\u0434\u044b | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442, \u0445\u0430\u0431\u0440\u043e\u0432\u0447\u0430\u043d\u0435! \u0421\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0432\u044b \u043a\u043e\u0433\u0434\u0430-\u043b\u0438\u0431\u043e \u0441 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0435\u0439, \u043a\u043e\u0433\u0434\u0430 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438\u0441\u044c \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u0433\u043e\u0440\u043e\u0434, \u0441\u0442\u0440\u0430\u043d\u0443 \u0438\u043b\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u043a\u043e\u043d\u0442\u0438\u043d\u0435\u043d\u0442?","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/zapuskaem-openvpn-v-dokere-za-2-sekundy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-26T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53240","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:37:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:28:50","updated":"2026-01-24 06:37:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/53240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=53240"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/53240\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/53241"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=53240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=53240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=53240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}