openvpn-ui:
       container_name: openvpn-ui
       image: d3vilh/openvpn-ui:latest
       environment:
           - OPENVPN_ADMIN_USERNAME={{ ovpnui_user }}
           - OPENVPN_ADMIN_PASSWORD={{ ovpnui_password }}
       privileged: true
       ports:
           - "8080:8080/tcp"
       volumes:
           - ./:/etc/openvpn
           - ./db:/opt/openvpn-ui/db
           - ./pki:/usr/share/easy-rsa/pki
           - /var/run/docker.sock:/var/run/docker.sock:ro
       restart: always

You can couple OpenVPN-UI with recommended d3vilh/openvpn-server image and here is updated docker-compose.yml for it:

---
version: "3.5"

services:
    openvpn:
       container_name: openvpn
       image: d3vilh/openvpn-server:latest
       privileged: true
       ports: 
          - "1194:1194/udp"
       environment:
           TRUST_SUB: 10.0.70.0/24
           GUEST_SUB: 10.0.71.0/24
           HOME_SUB: 192.168.88.0/24
       volumes:
           - ./pki:/etc/openvpn/pki
           - ./clients:/etc/openvpn/clients
           - ./config:/etc/openvpn/config
           - ./staticclients:/etc/openvpn/staticclients
           - ./log:/var/log/openvpn
           - ./fw-rules.sh:/opt/app/fw-rules.sh
           - ./server.conf:/etc/openvpn/server.conf
       cap_add:
           - NET_ADMIN
       restart: always

    openvpn-ui:
       container_name: openvpn-ui
       image: d3vilh/openvpn-ui:latest
       environment:
           - OPENVPN_ADMIN_USERNAME=admin
           - OPENVPN_ADMIN_PASSWORD=gagaZush
       privileged: true
       ports:
           - "8080:8080/tcp"
       volumes:
           - ./:/etc/openvpn
           - ./db:/opt/openvpn-ui/db
           - ./pki:/usr/share/easy-rsa/pki
           - /var/run/docker.sock:/var/run/docker.sock:ro
       restart: always

Where:

• TRUST_SUB is Trusted subnet, from which OpenVPN server will assign IPs to trusted clients (default subnet for all clients)
• GUEST_SUB is Gusets subnet for clients with internet access only
• HOME_SUB is subnet where the VPN server is located, thru which you get internet access to the clients with MASQUERADE
• fw-rules.sh is bash file with additional firewall rules you would like to apply during container start

docker_entrypoint.sh will apply following Firewall rules:

IPT MASQ Chains:
MASQUERADE  all  --  ip-10-0-70-0.ec2.internal/24  anywhere
MASQUERADE  all  --  ip-10-0-71-0.ec2.internal/24  anywhere
IPT FWD Chains:
       0        0 DROP       1    --  *      *       10.0.71.0/24         0.0.0.0/0            icmptype 8
       0        0 DROP       1    --  *      *       10.0.71.0/24         0.0.0.0/0            icmptype 0
       0        0 DROP       0    --  *      *       10.0.71.0/24         192.168.88.0/24

Here is possible content of fw-rules.sh file to apply additional rules:

~/openvpn-server $ cat fw-rules.sh
iptables -A FORWARD -s 10.0.70.88 -d 10.0.70.77 -j DROP
iptables -A FORWARD -d 10.0.70.77 -s 10.0.70.88 -j DROP

Run the OpenVPN-UI image

docker run \
-v /home/pi/openvpn:/etc/openvpn \
-v /home/pi/openvpn/db:/opt/openvpn-ui/db \
-v /home/pi/openvpn/pki:/usr/share/easy-rsa/pki \
-v /home/pi/openvpn/log:/var/log/openvpn \
-v /var/run/docker.sock:/var/run/docker.sock \
-e OPENVPN_ADMIN_USERNAME='admin' \
-e OPENVPN_ADMIN_PASSWORD='gagaZush' \
-p 8080:8080/tcp \
--privileged d3vilh/openvpn-ui:latest

Run the OpenVPN Server image:

cd ~/openvpn-server/ && 
docker run  --interactive --tty --rm \
  --name=openvpn-server \
  --cap-add=NET_ADMIN \
  -p 1194:1194/udp \
  -e TRUST_SUB=10.0.70.0/24 \
  -e GUEST_SUB=10.0.71.0/24 \
  -e HOME_SUB=192.168.88.0/24 \
  -v ./pki:/etc/openvpn/pki \
  -v ./clients:/etc/openvpn/clients \
  -v ./config:/etc/openvpn/config \
  -v ./staticclients:/etc/openvpn/staticclients \
  -v ./log:/var/log/openvpn \
  -v ./fw-rules.sh:/opt/app/fw-rules.sh \
  -v ./server.conf:/etc/openvpn/server.conf \
  --privileged d3vilh/openvpn-server:latest

As prerequisite, you need to have Docker and GoLang to be installed and running:

sudo apt-get install docker.io -y
sudo systemctl restart docker

To install Golang go to https://go.dev/dl and copy download URL for Go1.20.X version of your arch and follow the instructions below.

Example for ARM64:

wget https://golang.org/dl/go1.20.linux-arm64.tar.gz
sudo tar -C /usr/local -xzf go1.20.linux-arm64.tar.gz
echo "export PATH=$PATH:/usr/local/go/bin" >> /etc/profile
source /etc/profile
go version 

To build the OpenVPN-UI image:

cd build; ./build_openvpn-ui.sh

The new image will have openvpn-ui name.

If you have your OpenVPN server up and running on the same host, you can install OpenVPN-UI as standalone application. For this you need to have GoLang installed on your host to build all the necessary binaries on the server itself.

To make installation easier, version 0.9.5 now includes a standalone-install.sh script. This script helps you step by step, starting with downloading and installing GoLang, and ending with building the binaries.

At the moment script supports Debian based systems only.

Here is installation process example:

superdude@bookworm64:~/build/openvpn-ui/build$ ./standalone-install.sh
This script will install OpenVPN-UI and all the dependencies on your local environment. No containers will be used.
Do you want to continue? (y/n)y
Golang version 1.21 is not installed.
Would you like to install it? (y/n) y
--2024-02-20 16:37:47--  https://golang.org/dl/go1.21.5.linux-amd64.tar.gz
go1.21.5.linux-amd64.tar.gz      100%[========================================================>]  63.53M  3.01MB/s    in 20s
2024-02-20 16:38:08 (3.23 MB/s) - 'go1.21.5.linux-amd64.tar.gz' saved [66618285/66618285]
Would you like to run apt-get update? (y/n) y
Updating current environment with apt-get update
[sudo] password for superdude:
No VM guests are running outdated hypervisor (qemu) binaries on this host.
Would you like to download all necessary Go modules? (y/n) y
Downloading all Go modules (go mod download)
Would you like to install Beego v2? (y/n) y
Installing BeeGo v2
go: downloading github.com/beego/bee/v2 v2.0.2-0.20230830024958-01d397161933
go: downloading github.com/matttproud/golang_protobuf_extensions v1.0.4
Would you like to build OpenVPN-UI and install qrencode? (y/n) y
Installing OpenVPN-UI and qrencode
Cloning qrencode into build directory
Cloning into 'qrencode'...
remote: Enumerating objects: 35, done.
Resolving deltas: 100% (8/8), done.
Building and packing OpenVPN-UI
2024/02/20 17:15:07 INFO     ▶ 0001 Getting bee latest version...
2024/02/20 17:15:08 INFO     ▶ 0002 Your bee are up to date
______
| ___ \
| |_/ /  ___   ___
| ___ \ / _ \ / _ \
| |_/ /|  __/|  __/
\____/  \___| \___| v2.1.0
2024/02/20 17:20:55 SUCCESS  ▶ 0004 Build Successful!
2024/02/20 17:21:02 SUCCESS  ▶ 0009 Application packed!
Building qrencode
Moving qrencode to GOPATH
All done.
superdude@bookworm64:~/build/openvpn-ui/build$ 

After build and installation is complete:

1. Put archive openvpn-ui.tar.gz with binaries to the desired directory where you would like to run OpenVPN-UI from.
2. Uncompress it with tar -xzf openvpn-ui.tar.gz.
3. Double check openvpn-ui binary has +x permissions for your user.
4. Create db directory in the same directory where openvpn-ui binary is located.
5. Update OpenVpnPath and EasyRsaPath with real location of your OpenVPN server config (/etc/openvpn) and EasyRSA (/usr/share/easy-rsa) in main application config file - ./conf/app.conf file.
6. Set EnableAdmin = false and RunMode = prod in the same file, if you don't need to run BeeGo in development mode and don't need BeeGo admin console to run (in most cases you don't need it).
7. On the first run set OPENVPN_ADMIN_USERNAME and OPENVPN_ADMIN_PASSWORD environment variables to create admin user with secret password:

export OPENVPN_ADMIN_USERNAME=admin
export OPENVPN_ADMIN_PASSWORD=$3kR3tPa$Sw0rd

8. doublecheck enviroment variables are set properly:

echo $OPENVPN_ADMIN_USERNAME
echo $OPENVPN_ADMIN_PASSWORD

This should return your username and password you will use for the first login into UI. It is mandatory to set this vars on the first application start only. So OpenVPN-UI will create your Admin user with your own credentials.

9. Run ./openvpn-ui binary and login with your new credentials.

10. Go to Configuration > OpenVPN Server and update all the fields with your current server.conf options.

11. For security reasons you have to unset vars after successful login, so it will be removed from the local server environment:

unset OPENVPN_ADMIN_USERNAME
unset OPENVPN_ADMIN_PASSWORD

To backup your PKI infrastructure, server, client configuration files and OpenVPN-UI DB you can use backup.sh script which is in build/assets directory (since the release 0.6), it is also part of openvpn-aws and Raspberry-Gateway projects (right in openvpn-server directory).

Copy the script in your home directory(any directory in fact):

cp -p build/assets/backup.sh ~/

Then run the script:

sudo ./backup.sh -b ~/openvpn-server backup/openvpn-server-030923-1

this will create backup of all necessary files, from ~/openvpn-server to ~/backup/openvpn-server-030923-1.

You can confirm all files are backed up and go to the "Upgrade" step.

To upgrade OpenVPN-UI to the latest version, you have to save old container image, remove old container and deploy new container with upgraded image.

1. Check which OpenVPN-UI version image is currently used:

docker inspect --format='{{json .Config.Labels}}' d3vilh/openvpn-ui:latest
{"maintainer":"Mr.Philipp <[email protected]>","version":"0.5"}

Note: Old container versions (below ver 0.5) does not have "version" tag.

2. Tag current container image with backup tag:

docker tag d3vilh/openvpn-ui:latest local/openvpn-ui:backup

3. Make sure your docker-compose.yml file is up to date with desired new version of image. Our assumption that desired is the latest version:

admin@aws3:~/openvpn $ cat docker-compose.yml | grep image
       image: d3vilh/openvpn-ui:latest
admin@aws3:~/openvpn $

During the next container start, docker will use image tag from this file to deploy new container.

1. Pull new image to your host. Old image will be replaced:

docker pull d3vilh/openvpn-ui:latest

2. Confirm new image is pulled with desired version:

docker inspect --format='{{json .Config.Labels}}' d3vilh/openvpn-ui:latest
{"maintainer":"Mr.Philipp <[email protected]>","version":"0.9.4"}

3. Stop and remove old container:

docker rm openvpn-ui --force

4. Deploy new container with updated image:

cd ~/openvpn-server
docker-compose up -d

5. Verify both containers are up and running:

admin@aws3:~/openvpn $ docker logs openvpn-ui
...
2023/09/03 12:38:50.650 [I] [server.go:280]  http server Running on https://:8080
admin@aws3:~/openvpn $

admin@aws3:~/openvpn $ docker logs openvpn
...
Start openvpn process...
admin@aws3:~/openvpn $

Now when new OpenVPN-UI version is deployed, the DB schema were updated to the latest version automatically during the container start.

• All tables were updated with new fields, existed fields in those tables were not touched to be sure you won't loose any data.
• New tables were created with default values.

Now you need to go to Configuration > OpenVPN Server in OpenVPN UI webpage and review and update all options fields very carefully.

Here is example of Server configuration page with new fields after the upgrade from version 0.3 to 0.9:

You have to update empty fields with options from your current server.conf and only then press Save Config button.

All fields to review are marked with ! sign:

Here is how it should looks like:

Important Note!: In version 0.6 format of some fields has been changed! Please pay attention that before saving config you have to update all the fields with new format, otherwise OpenVPN Server will not start.

New server.conf file will be applied immedeately, after you press Save Config button.

Next, you have to update OpenVPN UI, OpenVPN Client and EasyRSA vars pages the same way.

And you are done with the upgrade process.

If for some reason you would like to fallback to the previous version, you need to stop container, restore image, then restore all the files from backup you did before and finally run container with previous image.

1. Stop and remove updated openvpn-ui container:

docker rm openvpn-ui --force

2. Remove updated openvpn-ui image:

docker image rm d3vilh/openvpn-ui:latest

3. Restore old openvpn-ui image:

docker tag local/openvpn-ui:backup d3vilh/openvpn-ui:latest

4. Confirm you have old image version:

docker inspect --format='{{json .Config.Labels}}' d3vilh/openvpn-ui:latest
{"maintainer":"Mr.Philipp <[email protected]>","version":"0.5"}

1. Run restore script:

sudo ./backup.sh -r ~/openvpn-server backup/openvpn-server-030923-1

This will restore all the enviroment files from backup directory to ~/openvpn-server directory.

Note v.0.3: There was bug in version 0.3 where data.db file were not shared over the volume, so you have to restore it manually: docker cp backup/data.0.3.db openvpn-ui:/opt/openvpn-ui/data.db

1. Run docker-compose up to deploy new container with old image:

cd ~/openvpn-server
docker-compose up -d

2. Verify both containers are up and running:

admin@aws3:~/openvpn $ docker logs openvpn-ui
...
2023/09/03 12:38:50.650 [I] [server.go:280]  http server Running on https://:8080
admin@aws3:~/openvpn $

admin@aws3:~/openvpn $ docker logs openvpn
...
Start openvpn process...
admin@aws3:~/openvpn $

Thats it you are back to the previous version.

For this go to "Configuration > OpenVPN Client":

And then update "Connection Address" and "Connection Port" fields with your external Internet IP and Port.

To generate new Client Certificate go to "Certificates", then press "Create Certificate" button, enter new VPN client name, complete all the rest fields and press "Create" to generate new Client certificate:

To download .OVPN client configuration file, press on the Client Name you just created:

Install Official OpenVPN client to your client device.

Deliver .OVPN profile to the client device and import it as a FILE, then connect with new profile to enjoy your free VPN:

Right after this step new Certificate will be genrated and it will appear as new client profile with the same Client name. At this point both client profiles will have updated Certificate when you try to download it.

Once you will deliver new client profile with renewed Certificate to you client, press "Revoke" button for old profile to revoke old Certificate, old client profile will be deleted from the list.

If, for some reason you still would like to keep old certificate you have to "Revoke" new profile, old certificate will be rolled back and new profile will be deleted from the list.

Renewal process will not affect active VPN connections, old client will be disconnected only after you revoke old certificate or certificate term of use will expire.

If you would like to prevent client to use yor VPN connection, you have to revoke client certificate and restart the OpenVPN daemon. You can do it via OpenVPN UI "Certificates" menue, by pressing `"Revoke"`` amber button:

Certificate revoke won't kill active VPN connections, you'll have to restart the service if you want the user to immediately disconnect. It can be done from the same "Certificates" page, by pressing Restart red button:

You can do the same from the "Maintenance" page.

After Revoking and Restarting the service, the client will be disconnected and will not be able to connect again with the same certificate. To delete the certificate from the server, you have to press "Remove" button.

Procedure for 2FA generation is the same as for regular certificate, but you have to use the uniq 2FA Name in the email-kind format:

Note: For Multifactor Authentication (MFA), you can add one more password by completing Passphrase option.

Both Passphrase and Client Static IP are optional parameters.

When you complete all the fields, click on Create and your new 2FA Certificate will be ready.

Once this done, you can click on the new certificate in the Certificates page to see all the details including QR code for 2FA token:

You can copy or email this information directly to happy 2FA certificate owner.

To use 2FA certificate you have to install 2FA app on your device (Google Authenticator iOS, Android, Microsoft Authenticator iOS, Android, etc) and scan QR code from the Certificates details page.

After scanning QR-code, new Authenticator profile will be created in your 2FA app with the same name as your 2FA Certificate name:

Then you have to download and deliver .OVPN profile to OpenVPN Connect app and open it as a file. Following window appear:

Click Add to add new profile to OpenVPN Connect. Then you will be asked to enter your Username. As username use 2FA Name which you used during Certificate/profile generation (as precisely as you can. 2FA Name is part of authentication process):

When you'll be prompted to Enter the password, you have to enter your 2FA token from your 2FA app:

Connection will be suceeded if you entered 2FA Name and 2FA token correctly.

For MFA authentication you can use optional Passphrase when generating new Client certificate, to protect your 2FA token with additional password. In this case you have to enter your Passphrase as a Private Key Password and 2FA token as Password:

This functionality available via "Users Profiles" page:

Then, if your user have enough privilegies you can Create new profile or manage profiles of other users: