openvpn-pihole

KO | EN

gitlite — search

#javascript #typescript #llm #go #android #rust #deep-learning #macos #nodejs #windows #awesome-list #security #ios #open-source

(★ 79)

🕵️ Set up an OpenVPN with PiHole as backend to block ads and trackers anywhere you go.

openvpn-pihole 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h3 align="center">
    <a href="https://openvpn.net">OpenVPN</a> and <a href="https://pi-hole.net">PiHole</a> wrapped up in a docker-compose setup
</h3>

<br/>

## Overview

Run [OpenVPN](https://openvpn.net) and [Pi-hole](https://pi-hole.net) together with Docker Compose.
This repository gives you a small, ready-to-use setup where:

- OpenVPN listens on `1194/udp`
- Pi-hole is used as the DNS server for VPN clients
- the Pi-hole dashboard is only reachable from inside the VPN at [http://pi.hole](http://pi.hole)
- you can generate, revoke and manage certificates with a simple script

The main configuration for this is inspired by [mr-bolle/docker-openvpn-pihole](https://github.com/mr-bolle/docker-openvpn-pihole), [pknw1/openvpn-pihole-docker](https://github.com/pknw1/openvpn-pihole-docker)
and [kylemanna/docker-openvpn](https://github.com/kylemanna/docker-openvpn).

---

- [Quick start](#quick-start)
  - [Clone this repository](#clone-this-repository)
  - [Start the services](#start-the-services)
- [Managing certificates](#managing-certificates)
  - [Generating `.ovpn` files](#generating-ovpn-files)
  - [Revoking `.ovpn` files](#revoking-ovpn-files)
  - [Renewing certificates](#renewing-certificates)
- [Configuration](#configuration)
  - [OpenVPN](#openvpn)
  - [PiHole](#pihole)
- [FAQ & Recipes](#faq--recipes)
  - [Launching multiple OpenVPN instances](#launching-multiple-openvpn-instances)
- [Troubleshooting](#troubleshooting)
  - [Port 53 is already in use](#port-53-is-already-in-use)
- [Contributing](#contributing)

## Quick start

### Clone this repository:

```sh
git clone https://github.com/simonwep/openvpn-pihole.git
cd openvpn-pihole
```

> [!CAUTION]
> If you share your VPN with others, it's highly recommended changing the admin password for the PiHole dashboard in the [compose.yml](compose.yml) file now.
> Otherwise you can keep it at `password` as the PiHole is only reachable from inside the VPN.

### Start the services

> [!WARNING]
> If you're using a VPS make sure to open `1194/udp`.

After you've installed all the pre-requisites, you can run (make sure you're using the latest [docker](https://docs.docker.com/get-docker/) version):

```sh
sudo docker compose up -d
```

After this is done you'll find two new folders inside of this repository - the `/openvpn` folder will contain all of your certificates as well as an easy-rsa configuration file.
`/pihole` will contain the content of `/etc/pihole` and `/etc/dnsmasq.d`.

If you want to migrate settings or your query-database, you can now copy it into the corresponding folder in `/pihole` :)
You'll also be able to import your config as usual in the docker dashboard.

> [!NOTE]
> The PiHole admin dashboard can only be reached through the vpn under [http://pi.hole](http://pi.hole).

## Managing certificates

### Generating `.ovpn` files

> [!NOTE]
> Before you generate any client certificate, you must update the host in [client configuration](openvpn/config/client.conf) to the IP address to your public IP or domain name.
> This file will be used as base-configuration for each `.ovpn` file.

```sh
./clients.sh add <password> <names...>
```

### Revoking `.ovpn` files

```sh
./clients.sh remove <name>
```

> [!WARNING]
> Revoked certificates won't kill active connections, you'll have to restart the service if you want the user to immediately disconnect:

```sh
sudo docker compose restart openvpn
```

### Renewing certificates

Depending on the configuration of [easy-rsa](openvpn/config/easy-rsa.vars) the certificates will expire at some point.
By default, that is after two years, to renew it, you can simply remove the `pki` folder that contains the certificate authority.
After restarting the service, a new CA will be generated.

```sh
sudo docker compose down
sudo rm -rf ./openvpn/pki
sudo docker compose up -d
```

Keep in mind that after that you have to re-generate all `.ovpn`-files.

## Configuration

### OpenVPN

Configuration files (such as [`server.conf`](openvpn/config/server.conf) and [`client.conf`](openvpn/config/client.conf)) are stored in [openvpn/config](openvpn/config).
They are mounted into the container, so they can be changed without rebuilding the image.

### PiHole

The PiHole version is pinned to avoid unexpected breaking changes, but you can change the version in [compose.yml](compose.yml) if you want to update it.

## FAQ & Recipes

### Launching multiple OpenVPN instances

First copy the [openvpn](openvpn) directory including [openvpn/config](openvpn/config) (copy just the `config` folder!), then add another service to [compose.yml](compose.yml).

Example assuming we want to name our second OpenVPN instance `openvpn-tcp-443`:
```sh
mkdir openvpn-tcp-443
cp -r openvpn/config openvpn-tcp-443
```

You can now make changes to our new config files in `openvpn-tcp-443/config`. Change `proto` to `tcp` and `port` to `443`,
you'll also need to comment out `explicit-exit-notify 1` as this is only compatible with `proto udp` (update both `server.conf` and `client.conf`!).

Now add our new service:
```yaml
# ... other services
    openvpn-tcp-443:
        container_name: openvpn-tcp-443
        build: ./openvpn-docker
        ports:
            - 443:443/tcp
        volumes:
            - ./openvpn/pki:/etc/openvpn/pki # Keep the PKI
            - ./openvpn-tcp-443/clients:/etc/openvpn/clients
            - ./openvpn-tcp-443/config:/etc/openvpn/config # !! We're using our second configuration
        cap_add:
            - NET_ADMIN
        restart: unless-stopped
# ... other services
```

> Keep in mind that if you want to generate a client-config for that service we've just made you'll
> have to use the openvpn-tcp-443 container e.g. `sudo docker exec openvpn-tcp-443 bash /opt/app/bin/genclient.sh <name>`.

## Troubleshooting

### Port 53 is already in use

> ERROR: for pihole Cannot start service pihole: driver failed programming external connectivity on endpoint pihole (...): Error starting userland proxy: listen tcp 0.0.0.0:53: bind: address already in use

You'll need to disable the local dns-server, see [this](https://askubuntu.com/questions/907246/how-to-disable-systemd-resolved-in-ubuntu) and [this](https://askubuntu.com/questions/191226/dnsmasq-failed-to-create-listening-socket-for-port-53-address-already-in-use) ask ubuntu thread.
You can stop, disable and mask the `systemd-resolved` service using the following commands:

```sh
sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved
sudo systemctl mask systemd-resolved
```

## Contributing

Check out the [contribution guidelines](.github/CONTRIBUTING.md) :)

openvpn-pihole

openvpn-pihole 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

openvpn-pihole

openvpn-pihole 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README