How to Setup OpenVPN on EC2 with Docker

Introduction

OpenVPN is a widely used open-source VPN solution that enables secure remote network access. This guide will provide step-by-step instructions for setting up OpenVPN on an AWS EC2 instance using Docker. This containerized approach simplifies the deployment of OpenVPN, making it easier to manage and maintain.

Prerequisites

• An AWS EC2 instance (Ubuntu recommended)
• SSH access to the instance
• Open Port 1149
• Docker installed on the instance

Step 1: Update the System

Before installing OpenVPN, update the system packages:

$ sudo apt update && sudo apt upgrade -y

Step 2: Install Docker

Install Docker to run OpenVPN in a containerized environment:

$ sudo apt install docker.io -y

Step 3: Pull OpenVPN Docker Image

Download the OpenVPN Docker image from Docker Hub:

$ docker pull kylemanna/openvpn

Step 4: Create OpenVPN Data Volume

Create a Docker volume to store OpenVPN configuration data:

$ sudo docker volume create — name openvpn-data

Step 5: Generate OpenVPN Configuration

Run the following command to generate the OpenVPN configuration:

$ docker run -v openvpn-data:/etc/openvpn — rm kylemanna/openvpn ovpn_genconfig -u udp://<your-server-ip>

Replace <your-server-ip> with the public IP of your EC2 instance.

Step 6: Initialize Public Key Infrastructure (PKI)

Set up certificates and keys for VPN security:

$ sudo docker run -v openvpn-data:/etc/openvpn — rm -it kylemanna/openvpn ovpn_initpki

Follow the prompts to set up the security credentials.

Step 7: Start OpenVPN Server

Run the following command to start the OpenVPN server:

$ docker run -v openvpn-data:/etc/openvpn -d -p 1194:1194/udp — cap-add=NET_ADMIN kylemanna/openvpn

Step 8: Add a VPN User

To add a new user to the VPN, create a script:

$ sudo nano add-user.sh

Paste the following script into the file:

!/bin/bash

Ask for the client name

read -p “Enter VPN client name: “ CLIENT_NAME

Set OpenVPN data volume

OVPN_DATA=”openvpn-data”

Generate client certificate

docker run -v $OVPN_DATA:/etc/openvpn — rm -it kylemanna/openvpn easyrsa build-client-full $CLIENT_NAME

Generate client configuration file

docker run -v $OVPN_DATA:/etc/openvpn — rm kylemanna/openvpn ovpn_getclient $CLIENT_NAME > $CLIENT_NAME.ovpn

echo “Client configuration file created: $CLIENT_NAME.ovpn”

Save and exit the file (CTRL + X, then Y, then Enter).

Run the script to add a user:

$ sudo bash add-user.sh

Step 9: Remove a VPN User

To revoke a user’s access, create another script:

$ sudo nano delete-user.sh

Paste the following script:

!/bin/bash

Ask for the client name

read -p “Enter VPN client name to revoke: “ CLIENT_NAME

Set OpenVPN data volume

OVPN_DATA=”openvpn-data”

Revoke the client certificate

docker run -v $OVPN_DATA:/etc/openvpn — rm -it kylemanna/openvpn easyrsa revoke $CLIENT_NAME

Remove the client configuration file

rm -f $CLIENT_NAME.ovpn

echo “Client $CLIENT_NAME has been revoked and configuration file removed.”

Save and exit (CTRL + X, then Y, then Enter).

Run the script to delete a user:

$ sudo bash delete-user.sh

Conclusion

Deploying OpenVPN on an AWS EC2 instance using Docker simplifies both installation and management. By following the steps outlined above, you can quickly set up a secure VPN server, easily add or remove users, and ensure secure access to your private network.