loupeznik/strongswan-vpn
A docker image for hosting a dockerized Strongswan VPN server
932
loupeznik/strongswan-vpn repository overview
strongswan-vpn-docker
A docker image for hosting a dockerized Strongswan VPN server
Running
docker run --name vpn -d -e "[email protected]" \
--net=host --cap-add NET_ADMIN loupeznik/strongswan-vpn:latest
The default CIDR range for connecting clients will be 10.13.37.0/24, this can be changed by specifying -e "VPN_CLIENT_SUBNET=<cidr>" in the docker run command.
A default VPN user will be created with credentials test:test.
The IPSec CA certificate will be printed to stdout, to get it, run docker logs vpn.
In some cases, a Docker service restart is needed in order for the clients to have internet connection when connected to the VPN server.
Additional settings
Firewall also needs to be setup on the host in order for the VPN server to work correctly.
Example for uwf:
# /etc/ufw/before.rules
# ...
# Swap the 10.13.37.0/24 if you defined you own CIDR range in the docker run command
# Swap the eth0 interface if your default network interface has different name
*nat
-A POSTROUTING -s 10.13.37.0/24 -o eth0 -m policy --pol ipsec --dir out -j ACCEPT
-A POSTROUTING -s 10.13.37.0/24 -o eth0 -j MASQUERADE
COMMIT
*mangle
-A FORWARD --match policy --pol ipsec --dir in -s 10.13.37.0/24 -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT
*filter
# ...
-A ufw-before-forward --match policy --pol ipsec --dir in --proto esp -s 10.13.37.0/24 -j ACCEPT
-A ufw-before-forward --match policy --pol ipsec --dir out --proto esp -d 10.13.37.0/24 -j ACCEPT
# /etc/ufw/sysctl.conf
# ...
# append to the end of the file
net/ipv4/ip_forward=1
net/ipv4/conf/all/accept_redirects=0
net/ipv4/conf/all/send_redirects=0
net/ipv4/ip_no_pmtu_disc=1
Then run:
ufw reload
# or if ufw was disabled
ufw enable
Adding users
docker exec -i vpn bash -c "echo '<username> : EAP \"<password>\"' >> /etc/ipsec.secrets"
docker exec -i vpn bash -c "ipsec update && ipsec restart"
Tag summary
Content type
Image
Digest
sha256:7635d35b6…
Size
82.6 MB
Last updated
over 3 years ago
docker pull loupeznik/strongswan-vpn