--- title: "Fundamentals of Running OpenVPN in Docker on Ubuntu" description: "Learn to run an OpenVPN in Docker container and unlock an easy-to-install and configure secure VPN solution for your network needs!" canonical: "https://adamtheautomator.com/openvpn-in-docker/" --- # Fundamentals of Running OpenVPN in Docker on Ubuntu > Learn to run an OpenVPN in Docker container and unlock an easy-to-install and configure secure VPN solution for your network needs! Source: https://adamtheautomator.com/openvpn-in-docker/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Fundamentals of Running OpenVPN in Docker on Ubuntu](https://adamtheautomator.com/wp-content/uploads/2022/08/Leverage-Podman-for-Windows-to-Efficiently-Manage-Containers-1200-×-675-px.jpg) # Fundamentals of Running OpenVPN in Docker on Ubuntu [![](https://secure.gravatar.com/avatar/04025eca38bf59973f7838d8d4e79b34a3e3ef587ec879ee63f80149ff9be11b?s=192&d=mm&r=g)Verah Ombui](https://adamtheautomator.com/author/verah-ombui/)7 September 20228 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Docker](/tag/docker/)[OpenVPN](/tag/openvpn/) Table of Contents * [Prerequisites](#prerequisites) * [Creating a Docker Container for OpenVPN](#creating-a-docker-container-for-openvpn) * [Securing OpenVPN Client with Certificates](#securing-openvpn-client-with-certificates) * [Accessing the OpenVPN Web UI](#accessing-the-openvpn-web-ui) * [Configuring DNS For Faster and Secure Connection](#configuring-dns-for-faster-and-secure-connection) * [Conclusion](#conclusion) Are you worried about how you can freely access the internet without many involved restrictions and data insecurities? Worry no more! Start hosting your VPN server using OpenVPN in Docker. With Docker and [OpenVPN](https://openvpn.net/) technologies, you can set up and run your VPN server in no time. And in this tutorial, you’ll learn the basic fundamentals of running an OpenVPN server hosted in a Docker container. Stay tuned and keep your VPN server secure with OpenVPN Docker! Running OpenVPN in Docker secures a network path, but it does not reduce personal records listed by data brokers. If that is part of the privacy work, compare [MyDataRemoval privacy monitoring and data broker removal workflows](https://goto.mydataremoval.com/c/1454808/2928977/34569) before choosing a paid data removal service. ## Prerequisites This tutorial will be a hands-on demonstration. If you follow along, you’ll need the following: * A Linux-based operating system (OS) – This tutorial uses [Ubuntu v22.04](https://releases.ubuntu.com/22.04/), but other Linux distributions will work. Related:[How to Install Ubuntu 20.04 \[Step-by-Step\]](https://adamtheautomator.com/install-ubuntu/) * Docker installed and running – This tutorial uses Docker v20.10.17. Related:[How to Install and Use Docker on Ubuntu (In the Real World)](https://adamtheautomator.com/docker-ubuntu/) * An Android device with the OpenVPN Connect app installed – This tutorial uses [Android v11](https://www.android.com/android-11/) and [OpenVPN Connect v3.2.7](https://openvpn.net/vpn-client/). ## **Creating a Docker Container for OpenVPN** Containerizing is like packaging up code and all its dependencies as a standard software unit to quickly and reliably run your application. There are several ways of creating an OpenVPN Docker container. You can either build the container from scratch or pull a ready-made container from the [Docker Hub](https://hub.docker.com/). But in this tutorial, you’ll use an existing OpenVPN Docker image file. Ready-made containers offer several benefits as they are thoroughly tested against various vulnerabilities with a backing of a vast community of developers. Furthermore, these containers help you save time and eliminate the need to reinvent the wheel. To create an OpenVPN Docker container: 1\. Open your terminal and run the below OVPN\_DATA command, which doesn’t provide output but sets a data volume name to ovpn-data-test to the OVPN\_DATA variable. ```bash OVPN_DATA="ovpn-data-test" ``` 2\. Next, run the following docker volume create command to create a data volume with the –name you set in the $OVPN\_DATA variable. This command doesn’t provide output but creates a data volume container for OpenVPN where all data, configuration files, and certificates are stored. ```bash docker volume create --name $OVPN_DATA ``` 3\. Lastly, run the following [docker run](https://docs.docker.com/engine/reference/commandline/run/) command to download and install the OpenVPN Docker image with the following: * Specify the storage space (`-v`) inside the container that is separate from the rest of the container file system. In this case, the OpenVPN Docker image is stored in the `/etc/openvpn` directory. * Specify the logging mechanism (`--log-driver`) that keeps the running containers and services information (`none`). * Instructs Docker to automatically remove (–rm) the container when it already exists. Be sure to replace (YourPublicIP.com) with your server’s (host) public IP or domain name (if you have one) via UDP protocol. But note that you can also use TCP protocol. > _TCP is a connection-oriented protocol, whereas UDP is a connectionless protocol_ ```bash docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm kylemanna/openvpn ovpn_genconfig -u udp://YourPublicIP.com ``` ![Installing OpenVPN on Docker container](https://adamtheautomator.com/wp-content/uploads/2022/08/image-533.png) _Installing OpenVPN on Docker container_ > _Note that if you intend to use self-hosting or public IP, you must do port forwarding on your router/modem._ ## Securing OpenVPN Client with Certificates You’ve successfully installed the [OpenVPN](https://adamtheautomator.com/openvpn-on-window/) Docker client on your machine, so yay! But before using OpenVPN, you must first set up the OpenVPN client’s configuration. Related:[How to Create a VPN with OpenVPN On Window Server](https://adamtheautomator.com/openvpn-on-window/) Just because you’re working on OpenVPN doesn’t mean you must open your VPN server to the world. You’ll need certificates to secure your OpenVPN client: 1\. Run the below docker run command to generate and retrieve the CA and client certificates. This command creates running OpenVPN containers (–it) from the image specified inside the main container. In most cases, generating CA server certificates takes time, depending on the resources of the machine you are using. ```bash docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm -it kylemanna/openvpn ovpn_initpki ``` Type yes, and press Enter, as shown below, to initiate the OpenVPN [PKI](https://www.keyfactor.com/resources/what-is-pki/) system. ![Initiating the OpenVPN PKI system](https://adamtheautomator.com/wp-content/uploads/2022/08/image-534.png) Initiating the OpenVPN PKI system 2\. Next, provide and confirm a new CA certificate password, and press Enter. Note the password somewhere safe as you need it later while setting up and generating a client certificate. ![Setting a new CA certificate password](https://adamtheautomator.com/wp-content/uploads/2022/08/image-535.png) Setting a new CA certificate password 3\. Set a unique name for your CA certificate, and press Enter. ![Naming the new CA certificate](https://adamtheautomator.com/wp-content/uploads/2022/08/image-536.png) Naming the new CA certificate 4\. Now, enter the CA passphrase you set in step two to check that the request matches the signature. ![Checking \\the request matches the signature](https://adamtheautomator.com/wp-content/uploads/2022/08/image-537.png) Checking \\the request matches the signature 5\. Enter your passphrase again to generate a private key. ![Generate a private key by entering the CA passphrase](https://adamtheautomator.com/wp-content/uploads/2022/08/image-538.png) Generate a private key by entering the CA passphrase 6\. Next, run the below command to start the OpenVPN server service on Docker to set up an OpenVPN client, where: * The -p option sets the port (1194) that listens and initiates the connection between the server and the client. You can change port 1194 to fit your preferences if you’re not comfortable using the default OpenVPN port. * The –cap-add=NET\_ADMIN argument applies the additional Linux capabilities by modifying the network interfaces that Docker does not grant by default. ```bash docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn ``` ![Setting the port OpenVPN will listen to](https://adamtheautomator.com/wp-content/uploads/2022/08/image-539.png) _Setting the port OpenVPN will listen to_ 7\. Once the port is set, run the below `docker run` command to perform the following: * Generate the client certificate and download the client configuration file (_.ovpn_) from the Docker container to the host server. The generated certificate is password-less, as specified in the no-pass argument in the command. * Set the name of the file of the OpenVPN certificate and client identification to CLIENTAPP. The certificate is stored in the host’s user directory, not the Docker container. ```bash docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm -it kylemanna/openvpn easyrsa build-client-full CLIENTAPP nopass ``` Enter your passphrase, as shown below, to complete generating the certificate. ![Generating the VPN client certificate](https://adamtheautomator.com/wp-content/uploads/2022/08/image-540.png) _Generating the VPN client certificate_ 8\. Next, run the command below to generate and download the OpenVPN connection (ovpn\_getclient) config file from the container to the host server. ```bash docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm kylemanna/openvpn ovpn_getclient CLIENTAPP > CLIENTAPP.ovpn ``` 9\. Navigate to the _user/home_ directory in your host server (Linux machine), and transfer the _.ovpn_ file (_CLIENTAPP.ovpn_) to your Android device. Related:[Securely Copy Files With the SCP Command](https://adamtheautomator.com/scp-command/) 10\. Finally, launch your OpenVPN Connect client app on your Android device. Tap on BROWSE under the FILE tab, and select the _.ovpn_ file (_CLIENTAPP.ovpn_) you transferred to your Android device. Doing so adds a new profile to the OpenVPN Connect client. ![Importing the .ovpn file to the OpenVPN Connect client](https://adamtheautomator.com/wp-content/uploads/2022/08/image-12.jpeg) Importing the _.ovpn_ file to the OpenVPN Connect client Upon successful connection, you’ll see the result below. ![Verifying successful connection to the VPN server](https://adamtheautomator.com/wp-content/uploads/2022/08/image-13.jpeg) Verifying successful connection to the VPN server ## **Accessing the OpenVPN Web UI** Are you worried about the number of commands you had to cover to access your VPN server? Why not try a simple web-based UI? OpenVPN offers a web-based installation and configuration toolset that enables fast VPN remote access solutions deployment. The tool kit comes in a single package called the OpenVPN access server. To access the OpenVPN web UI, you must install the package: 1\. Run the following [docker pull](https://docs.docker.com/engine/reference/commandline/pull/) command to download and install the latest OpenVPN Docker container (openvpn-as) from the [Linux Server Docker Hub](https://hub.docker.com/r/linuxserver/openvpn-as) (linuxserver). ```bash docker pull linuxserver/openvpn-as ``` ![Downloading OpenVPN Access Server Docker container](https://adamtheautomator.com/wp-content/uploads/2022/08/image-541.png) Downloading OpenVPN Access Server Docker container 2\. Once downloaded, run the [docker create](https://docs.docker.com/engine/reference/commandline/create/) command below to create a new Docker container named openvpn-as with the following: * `-v /home/docker/openvpn-as/config: /config` – Sets the directory to store the config files. * `--restart=always` – Ensures the container always starts on system boot. You can opt not to add this argument if you don’t want the container to restart. * `-e PGID=1001 -e PUID=1001` – Sets the user ID to eliminate permission issues between the host server and the container. * `-e TZ=Africa/Nairobi` – Specifies the [time zone information](http://www.timezoneconverter.com/cgi-bin/findzone.tzc). * –net=host –privileged – Dictates how OpenVPN Access Server runs in the container. ```bash docker create --name=openvpn-as --restart=always -v /home/docker/openvpn-as/config:/config -e INTERFACE=eth0 -e PGID=1001 -e PUID=1001 -e TZ=Africa/Nairobi --net=host --privileged linuxserver/openvpn-as ``` ![Creating a new Docker container (openvpn-as)](https://adamtheautomator.com/wp-content/uploads/2022/08/image-542.png) Creating a new Docker container (openvpn-as) 3\. Next, run the below [docker start](https://docs.docker.com/engine/reference/commandline/start/) command to access the OpenVPN web UI via the OpenVPN Access Server Docker container you created in step two. ```bash docker start openvpn-as ``` ![Starting the OpenVPN access server Docker container](https://adamtheautomator.com/wp-content/uploads/2022/08/image-543.png) Starting the OpenVPN access server Docker container 4\. Lastly, open your favorite web browser and navigate to the OpenVPN web UI with your local IP address (e.g., _https://YourIP:943/admin_). Replace _YourIP_ with your actual server’s IP address. You’ll be greeted with OpenVPN Access Server’s login page if all goes well, as shown below. Input admin and password for the Username and Password, and click Sign in to access the OpenVPN Access Server dashboard. > _Note that the default username and password are admin and password, respectively. You can change the credentials as per your preferences._ ![Accessing the OpenVPN Access Server web UI](https://adamtheautomator.com/wp-content/uploads/2022/08/image-544.png) Accessing the OpenVPN Access Server web UI After logging in, you’ll see the OpenVPN Access Server dashboard below. ![Accessing the OpenVPN Access Server dashboard](https://adamtheautomator.com/wp-content/uploads/2022/08/image-545.png) Accessing the OpenVPN Access Server dashboard ## **Configuring DNS For Faster and Secure Connection** At this point, you’re OpenVPN Access Server is working correctly. But to improve your VPN server’s performance, you must configure the DNS. To configure DNS, you must access the OpenVPN server web UI and update the DNS settings with Google or your preferred DNS addresses. Google offers the fastest DNS servers available, which you’ll use in your OpenVPN Access Server. 1\. Click VPN Settings (left panel) under the CONFIGURATION tab on your OpenVPN Access Server dashboard. Scroll down to the DNS Settings section, and enable the Have clients use Specific DNS servers option, as shown below. ![](https://adamtheautomator.com/wp-content/uploads/2022/08/image-546-1024x550.png) Enabling custom OpenVPN DNS addresses 2\. Next, update the Primary (8.8.8.8) and Secondary DNS Server (8.8.8.4) with Google DNS addresses as below, and click on Save Settings to save the changes. ![Setting custom OpenVPN DNS addresses](https://adamtheautomator.com/wp-content/uploads/2022/08/image-547.png) Setting custom OpenVPN DNS addresses 3\. After saving the changes, click on Update Running Server to restart the server for the changes to take effect. ![Updating the server settings](https://adamtheautomator.com/wp-content/uploads/2022/08/image-548.png) Updating the server settings 4\. Now, navigate to the OpenVPN Access Server (e.g., _https://YourIP:943/admin_) on your Linux machine. Replace _YourIP_ with your server’s IP address. If the configuration works correctly, you’ll see the same page below. Login with the default credentials (admin and password) for username and password. ![Logging in to OpenVPN Access Server](https://adamtheautomator.com/wp-content/uploads/2022/08/image-549.png) Logging in to OpenVPN Access Server 5\. Click on any platform icons to download the client application and click Yourself (user-locked profile) to download the client _.ovpn_ file. ![Downloading the .ovpn config file and client app](https://adamtheautomator.com/wp-content/uploads/2022/08/image-550.png) Downloading the _.ovpn_ config file and client app 6\. Finally, launch the OpenVPN Client you downloaded and import the _.ovpn_ file as you did in the last step of the “Securing OpenVPN Client with Certificates,” as shown below. ![Connecting to the OpenVPN server](https://adamtheautomator.com/wp-content/uploads/2022/08/image-551.png) Connecting to the OpenVPN server ## Conclusion Hosting your VPN server should never be a complex task, let alone securing your server connection. Luckily, OpenVPN Docker is just around the corner to save the day. And in this tutorial, you’ve learned to install, set up, and configure OpenVPN using Docker in Ubuntu. You’ve also touched on securing access to OpenVPN in a Docker container with OpenVPN CA and client certificates. Apart from accessing your OpenVPN server via a command-line interface, you now have a visual way to do so via the OpenVPN Access Server web UI. You’ve realized a rapid VPN deployment by generating client configuration files for the OpenVPN client apps. Why not build upon this newfound knowledge by creating VPN tunnel services for your applications using WireGuard VPN? Explore the world of unlimited possibilities using self-hosted VPN services! Related:[How To Set Up WireGuard VPN on Linux](https://adamtheautomator.com/wireguard-vpn/) Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fopenvpn-in-docker%2F&text=Fundamentals%20of%20Running%20OpenVPN%20in%20Docker%20on%20Ubuntu)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fopenvpn-in-docker%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fopenvpn-in-docker%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2023/12/buildah.jpg) ### [Building OCI Images with Buildah](/buildah/) Master the art of crafting OCI images with buildah for seamless containerization—flexible, efficient, and tailored to your container needs. ![](https://adamtheautomator.com/wp-content/uploads/2023/06/docker-raspberry-pi.jpg) ### [How to Install Docker on Raspberry Pi 4](/docker-on-raspberry-pi/) Excerpt: Learn how to get started with installing Docker on Raspberry Pi 4 and offload development to a small flexible system. ![](https://adamtheautomator.com/wp-content/uploads/2023/01/openvpn-cloud.jpg) ### [Getting Started with OpenVPN Cloud](/openvpn-cloud/) Simplify your VPN experience with the OpenVPN Cloud and take advantage of a comprehensive online tool for VPN deployments in this ATA Learning tutorial! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)