Giter VIP home page Giter VIP logo

docker-ovpn's Introduction

OpenVPN Server in Docker Container

Builds an OpenVPN server that uses Freeradius/MySQL for backend authentication. Server listens for connections on both UDP 1194 and TCP 443. The server will look for key material in '$PWD/config/ovpn'

Build Status Docker Stars Docker Pulls Build Details

Supported tags

The following key materials are required to launch the server.

  • ca.crt
  • site.crt
  • site.dh
  • site.key
  • ta.key

A very basic shell script has been included to generate a set of key material using EasyRSA. This key material uses the EasyRSA package default configuration and is not suitable for use in production. To generate the keys as well as an example of how to use the keys in a client configuration run the following;

docker run -it --rm -v /$PWD/configs/ovpn:/etc/openvpn 2stacks/docker-ovpn gen-keys

All files will be copied to the the local volume mapped to /etc/openvpn.

Environment Variables

  • RADIUS_HOST=freeradius
  • RADIUS_KEY=testing123
  • DNS_HOST1=1.1.1.1
  • DNS_HOST2=1.0.0.1
  • OVPN_DEBUG=yes

Note: Setting OVPN_DEBUG ENV to anything will enable server logging to /tmp

Build the OpenVPN Container

docker build --pull -t 2stacks/docker-ovpn .

Run the OpenVPN Container

docker run -itd \
  -h openvpn \
  --restart=always \
  --name openvpn \
  --cap-add=NET_ADMIN \
  -e "RADIUS_HOST=freeradius" \
  -e "RADIUS_KEY=testing123" \
  -e "DNS_HOST1=1.1.1.1" \
  -e "DNS_HOST2=1.0.0.1" \
  -p 1194:1194/udp \
  -p 443:443 \
  -v /$PWD/configs/ovpn:/etc/openvpn \
  2stacks/docker-ovpn

Run using Docker Compose (can be used to launch freeradius and mysql)

docker-compose -f docker-compose.yml up -d

Testing

If you launch the stack using the included docker-compose file you should be able to test that everything is working with;

docker run -it --rm -v $PWD/configs/ovpn/client.conf:/etc/openvpn/client.conf --device /dev/net/tun:/dev/net/tun --net=docker-ovpn_backend --cap-add=NET_ADMIN 2stacks/ovpn-client client.conf
  • Enter Auth Username: testing
  • Enter Auth Password: password

Example 'docker-compose.yml' File

version: '3.2'

services:
  ovpn:
    image: "2stacks/docker-ovpn:latest"
    ports:
      - "443:443"
      - "1194:1194/udp"
    volumes:
      - "./configs/ovpn:/etc/openvpn"
    environment:
      #- RADIUS_HOST=freeradius
      #- RADIUS_KEY=testing123
      #- DNS_HOST1=1.1.1.1
      #- DNS_HOST2=1.0.0.1
      - OVPN_DEBUG=yes
    cap_add:
      - NET_ADMIN
    restart: always
    networks:
      - backend

  freeradius:
    image: "2stacks/freeradius"
    #ports:
      #- "1812:1812/udp"
      #- "1813:1813/udp"
    #volumes:
      #- "./configs/radius/users:/etc/raddb/users"
    environment:
      #- DB_NAME=radius
      - DB_HOST=mysql
      #- DB_USER=radius
      #- DB_PASS=radpass
      #- DB_PORT=3306
      #- RADIUS_KEY=testing123
      #- RAD_CLIENTS=10.0.0.0/24
      - RAD_DEBUG=yes
    depends_on:
      - mysql
    links:
      - mysql
    restart: always
    networks:
      - backend

  mysql:
    image: "mysql:5.7"
    command: mysqld
    #ports:
      #- "3306:3306"
    volumes:
      - "./configs/mysql/master/data:/var/lib/mysql"
      - "./configs/mysql/master/conf.d:/etc/mysql/conf.d"
      - "./configs/mysql/radius.sql:/docker-entrypoint-initdb.d/radius.sql"
    environment:
      - MYSQL_ROOT_PASSWORD=radius
      - MYSQL_USER=radius
      - MYSQL_PASSWORD=radpass
      - MYSQL_DATABASE=radius
    restart: always
    networks:
      - backend

networks:
  backend:
    ipam:
      config:
        - subnet: 10.0.0.0/24

docker-ovpn's People

Contributors

2stacks avatar dependabot-preview[bot] avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar

Forkers

ahmadnemati vidsgr zasimovich 13051699665 hamidrezahy smoothapps saurabharch dev-daniil mohseni1983

docker-ovpn's Issues

Sorry,I am not auth successfull in my test,counld you plz help me?

I launch the enviroment in my machine,all of the three containers run successfully.But when I used openvpn-client and the client.ovpn to auth the service,I got auth-failed.I collected the logs as follow:

ovpn_1        | 192.168.124.16:32965 TLS: Initial packet from [AF_INET]192.168.124.16:32965, sid=7e8e40ea 1c49bffe
ovpn_1        | 192.168.124.16:32965 peer info: IV_VER=2.4.6
ovpn_1        | 192.168.124.16:32965 peer info: IV_PLAT=linux
ovpn_1        | 192.168.124.16:32965 peer info: IV_PROTO=2
ovpn_1        | 192.168.124.16:32965 peer info: IV_NCP=2
ovpn_1        | 192.168.124.16:32965 peer info: IV_LZ4=1
ovpn_1        | 192.168.124.16:32965 peer info: IV_LZ4v2=1
ovpn_1        | 192.168.124.16:32965 peer info: IV_LZO=1
ovpn_1        | 192.168.124.16:32965 peer info: IV_COMP_STUB=1
ovpn_1        | 192.168.124.16:32965 peer info: IV_COMP_STUBv2=1
ovpn_1        | 192.168.124.16:32965 peer info: IV_TCPNL=1
ovpn_1        | Tue Mar  5 17:06:04 2019 RADIUS-PLUGIN: FOREGROUND THREAD: New user.
ovpn_1        | Tue Mar  5 17:06:04 2019 RADIUS-PLUGIN: Fail to set value ATTRIB_NAS_Ip_Address.
ovpn_1        | Tue Mar  5 17:06:04 2019 RADIUS-PLUGIN: No attributes Acct Interim Interval or bad length.
ovpn_1        | Tue Mar  5 17:06:04 2019 RADIUS-PLUGIN: Client config file was not written, overwriteccfiles is false 
ovpn_1        | .Tue Mar  5 17:06:04 2019 RADIUS-PLUGIN: FOREGROUND THREAD: Add user to map.
ovpn_1        | 192.168.124.16:32965 PLUGIN_CALL: POST /usr/lib/openvpn/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
ovpn_1        | 192.168.124.16:32965 TLS: Username/Password authentication succeeded for username 'testing' [CN SET]
ovpn_1        | 192.168.124.16:32965 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES128-SHA256
ovpn_1        | 192.168.124.16:32965 [testing] Peer Connection Initiated with [AF_INET]192.168.124.16:32965
ovpn_1        | testing/192.168.124.16:32965 MULTI_sva: pool returned IPv4=10.43.94.6, IPv6=(Not enabled)
ovpn_1        | Tue Mar  5 17:06:04 2019 RADIUS-PLUGIN: BACKGROUND-ACCT:  Fail to set value ATTRIB_NAS_Ip_Address.
ovpn_1        | No value in the Attribute!
ovpn_1        | Tue Mar  5 17:06:04 2019 RADIUS-PLUGIN: BACKGROUND-ACCT:  Fail to add attribute ATTRIB_NAS_Ip_Address.
freeradius_1  | (12) Received Accounting-Request Id 44 from 10.0.0.130:47546 to 10.0.0.132:1813 length 124
freeradius_1  | (12)   User-Name = "testing"
freeradius_1  | (12)   NAS-Port = 1
freeradius_1  | (12)   Service-Type = Outbound-User
freeradius_1  | (12)   Framed-Protocol = PPP
freeradius_1  | (12)   Framed-IP-Address = 10.43.94.6
freeradius_1  | (12)   Calling-Station-Id = "192.168.124.16"
freeradius_1  | (12)   NAS-Identifier = "OpenVpn"
freeradius_1  | (12)   Acct-Status-Type = Start
freeradius_1  | (12)   Acct-Session-Id = "0154C4970869412AADDCB31682B0BCAE"
freeradius_1  | (12)   NAS-Port-Type = Virtual
freeradius_1  | (12) # Executing section preacct from file /etc/raddb/sites-enabled/default
freeradius_1  | (12)   preacct {
freeradius_1  | (12)     policy mask_accounting_data {
freeradius_1  | (12)       if ( yes == "no" ) {
freeradius_1  | (12)       if ( yes == "no" )  -> FALSE
freeradius_1  | (12)     } # policy mask_accounting_data = noop
freeradius_1  | (12)     [preprocess] = ok
freeradius_1  | (12)     policy acct_unique {
freeradius_1  | (12)       if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) {
freeradius_1  | (12)       EXPAND %{string:Class}
freeradius_1  | (12)          --> 
freeradius_1  | (12)       if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i)  -> FALSE
freeradius_1  | (12)       else {
freeradius_1  | (12)         update request {
freeradius_1  | (12)           EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
freeradius_1  | (12)              --> 20053898ef643316d6ad912998984bfd
freeradius_1  | (12)           &Acct-Unique-Session-Id := 20053898ef643316d6ad912998984bfd
freeradius_1  | (12)         } # update request = noop
freeradius_1  | (12)       } # else = noop
freeradius_1  | (12)     } # policy acct_unique = noop
freeradius_1  | (12) suffix: Checking for suffix after "@"
freeradius_1  | (12) suffix: No '@' in User-Name = "testing", looking up realm NULL
freeradius_1  | (12) suffix: No such realm "NULL"
freeradius_1  | (12)     [suffix] = noop
freeradius_1  | (12)     [files] = noop
freeradius_1  | (12)   } # preacct = ok
freeradius_1  | (12) # Executing section accounting from file /etc/raddb/sites-enabled/default
freeradius_1  | (12)   accounting {
freeradius_1  | (12) sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query}
freeradius_1  | (12) sql:    --> type.start.query
freeradius_1  | (12) sql: Using query template 'query'
freeradius_1  | rlm_sql (sql): Reserved connection (16)
freeradius_1  | (12) sql: EXPAND %{User-Name}
freeradius_1  | (12) sql:    --> testing
freeradius_1  | (12) sql: SQL-User-Name set to 'testing'
freeradius_1  | (12) sql: EXPAND %{User-Name}
freeradius_1  | (12) sql:    --> testing
freeradius_1  | (12) sql: SQL-User-Name set to 'testing'
freeradius_1  | rlm_sql (sql): Reserved connection (15)
freeradius_1  | (12) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = "testing" ORDER BY priority LIMIT 1
freeradius_1  | rlm_sql (sql): Released connection (15)
freeradius_1  | Need 1 more connections to reach min connections (3)
freeradius_1  | rlm_sql (sql): Opening additional connection (17), 1 of 30 pending slots used
freeradius_1  | rlm_sql_mysql: Starting connect to MySQL server
freeradius_1  | rlm_sql_mysql: Connected to database 'radius' on mysql via TCP/IP, server version 5.7.22, protocol version 10
freeradius_1  | (12) sql: EXPAND INSERT INTO radacct (acctsessionid,		acctuniqueid,		username, groupname, realm,			nasipaddress,		nasportid, nasporttype,		acctstarttime,		acctupdatetime, acctstoptime,		acctsessiontime, 	acctauthentic, connectinfo_start,	connectinfo_stop, 	acctinputoctets, acctoutputoctets,	calledstationid, 	callingstationid, acctterminatecause,	servicetype,		framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{sql:SELECT groupname FROM radusergroup WHERE username = "%{SQL-User-Name}" ORDER BY priority LIMIT 1}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')
freeradius_1  | (12) sql:    --> INSERT INTO radacct (acctsessionid,		acctuniqueid,		username, groupname, realm,			nasipaddress,		nasportid, nasporttype,		acctstarttime,		acctupdatetime, acctstoptime,		acctsessiontime, 	acctauthentic, connectinfo_start,	connectinfo_stop, 	acctinputoctets, acctoutputoctets,	calledstationid, 	callingstationid, acctterminatecause,	servicetype,		framedprotocol, framedipaddress) VALUES ('0154C4970869412AADDCB31682B0BCAE', '20053898ef643316d6ad912998984bfd', 'testing', 'test', '', '10.0.0.130', '1', 'Virtual', FROM_UNIXTIME(1551805567), FROM_UNIXTIME(1551805567), NULL, '0', '', '', '', '0', '0', '', '192.168.124.16', '', 'Outbound-User', 'PPP', '10.43.94.6')
freeradius_1  | (12) sql: Executing query: INSERT INTO radacct (acctsessionid,		acctuniqueid,		username, groupname, realm,			nasipaddress,		nasportid, nasporttype,		acctstarttime,		acctupdatetime, acctstoptime,		acctsessiontime, 	acctauthentic, connectinfo_start,	connectinfo_stop, 	acctinputoctets, acctoutputoctets,	calledstationid, 	callingstationid, acctterminatecause,	servicetype,		framedprotocol, framedipaddress) VALUES ('0154C4970869412AADDCB31682B0BCAE', '20053898ef643316d6ad912998984bfd', 'testing', 'test', '', '10.0.0.130', '1', 'Virtual', FROM_UNIXTIME(1551805567), FROM_UNIXTIME(1551805567), NULL, '0', '', '', '', '0', '0', '', '192.168.124.16', '', 'Outbound-User', 'PPP', '10.43.94.6')
freeradius_1  | (12) sql: ERROR: rlm_sql_mysql: ERROR 1054 (Unknown column 'groupname' in 'field list'): 42S22
freeradius_1  | (12) sql: SQL query returned: server error
freeradius_1  | rlm_sql (sql): Released connection (16)
freeradius_1  | (12)     [sql] = fail
freeradius_1  | (12)   } # accounting = fail
freeradius_1  | (12) Not sending reply to client.
freeradius_1  | (12) Finished request
freeradius_1  | (12) Cleaning up request packet ID 44 with timestamp +650
freeradius_1  | Waking up in 1.9 seconds.
freeradius_1  | (10) Cleaning up request packet ID 60 with timestamp +647
freeradius_1  | Ready to process requests
freeradius_1  | (13) Received Accounting-Request Id 44 from 10.0.0.130:55561 to 10.0.0.132:1813 length 124
freeradius_1  | (13)   User-Name = "testing"
freeradius_1  | (13)   NAS-Port = 1
freeradius_1  | (13)   Service-Type = Outbound-User
freeradius_1  | (13)   Framed-Protocol = PPP
freeradius_1  | (13)   Framed-IP-Address = 10.43.94.6
freeradius_1  | (13)   Calling-Station-Id = "192.168.124.16"
freeradius_1  | (13)   NAS-Identifier = "OpenVpn"
freeradius_1  | (13)   Acct-Status-Type = Start
freeradius_1  | (13)   Acct-Session-Id = "0154C4970869412AADDCB31682B0BCAE"
freeradius_1  | (13)   NAS-Port-Type = Virtual
freeradius_1  | (13) # Executing section preacct from file /etc/raddb/sites-enabled/default
freeradius_1  | (13)   preacct {
freeradius_1  | (13)     policy mask_accounting_data {
freeradius_1  | (13)       if ( yes == "no" ) {
freeradius_1  | (13)       if ( yes == "no" )  -> FALSE
freeradius_1  | (13)     } # policy mask_accounting_data = noop
freeradius_1  | (13)     [preprocess] = ok
freeradius_1  | (13)     policy acct_unique {
freeradius_1  | (13)       if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) {
freeradius_1  | (13)       EXPAND %{string:Class}
freeradius_1  | (13)          --> 
freeradius_1  | (13)       if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i)  -> FALSE
freeradius_1  | (13)       else {
freeradius_1  | (13)         update request {
freeradius_1  | (13)           EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
freeradius_1  | (13)              --> 20053898ef643316d6ad912998984bfd
freeradius_1  | (13)           &Acct-Unique-Session-Id := 20053898ef643316d6ad912998984bfd
freeradius_1  | (13)         } # update request = noop
freeradius_1  | (13)       } # else = noop
freeradius_1  | (13)     } # policy acct_unique = noop
freeradius_1  | (13) suffix: Checking for suffix after "@"
freeradius_1  | (13) suffix: No '@' in User-Name = "testing", looking up realm NULL
freeradius_1  | (13) suffix: No such realm "NULL"
freeradius_1  | (13)     [suffix] = noop
freeradius_1  | (13)     [files] = noop
freeradius_1  | (13)   } # preacct = ok
freeradius_1  | (13) # Executing section accounting from file /etc/raddb/sites-enabled/default
freeradius_1  | (13)   accounting {
freeradius_1  | (13) sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query}
freeradius_1  | (13) sql:    --> type.start.query
freeradius_1  | (13) sql: Using query template 'query'
freeradius_1  | rlm_sql (sql): Reserved connection (16)
freeradius_1  | (13) sql: EXPAND %{User-Name}
freeradius_1  | (13) sql:    --> testing
freeradius_1  | (13) sql: SQL-User-Name set to 'testing'
freeradius_1  | (13) sql: EXPAND %{User-Name}
freeradius_1  | (13) sql:    --> testing
freeradius_1  | (13) sql: SQL-User-Name set to 'testing'
freeradius_1  | rlm_sql (sql): Reserved connection (15)
freeradius_1  | (13) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = "testing" ORDER BY priority LIMIT 1
freeradius_1  | rlm_sql (sql): Released connection (15)
freeradius_1  | Need 8 more connections to reach 10 spares
freeradius_1  | rlm_sql (sql): Opening additional connection (18), 1 of 29 pending slots used
freeradius_1  | rlm_sql_mysql: Starting connect to MySQL server
freeradius_1  | rlm_sql_mysql: Connected to database 'radius' on mysql via TCP/IP, server version 5.7.22, protocol version 10
freeradius_1  | (13) sql: EXPAND INSERT INTO radacct (acctsessionid,		acctuniqueid,		username, groupname, realm,			nasipaddress,		nasportid, nasporttype,		acctstarttime,		acctupdatetime, acctstoptime,		acctsessiontime, 	acctauthentic, connectinfo_start,	connectinfo_stop, 	acctinputoctets, acctoutputoctets,	calledstationid, 	callingstationid, acctterminatecause,	servicetype,		framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{sql:SELECT groupname FROM radusergroup WHERE username = "%{SQL-User-Name}" ORDER BY priority LIMIT 1}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')
freeradius_1  | (13) sql:    --> INSERT INTO radacct (acctsessionid,		acctuniqueid,		username, groupname, realm,			nasipaddress,		nasportid, nasporttype,		acctstarttime,		acctupdatetime, acctstoptime,		acctsessiontime, 	acctauthentic, connectinfo_start,	connectinfo_stop, 	acctinputoctets, acctoutputoctets,	calledstationid, 	callingstationid, acctterminatecause,	servicetype,		framedprotocol, framedipaddress) VALUES ('0154C4970869412AADDCB31682B0BCAE', '20053898ef643316d6ad912998984bfd', 'testing', 'test', '', '10.0.0.130', '1', 'Virtual', FROM_UNIXTIME(1551805570), FROM_UNIXTIME(1551805570), NULL, '0', '', '', '', '0', '0', '', '192.168.124.16', '', 'Outbound-User', 'PPP', '10.43.94.6')
freeradius_1  | (13) sql: Executing query: INSERT INTO radacct (acctsessionid,		acctuniqueid,		username, groupname, realm,			nasipaddress,		nasportid, nasporttype,		acctstarttime,		acctupdatetime, acctstoptime,		acctsessiontime, 	acctauthentic, connectinfo_start,	connectinfo_stop, 	acctinputoctets, acctoutputoctets,	calledstationid, 	callingstationid, acctterminatecause,	servicetype,		framedprotocol, framedipaddress) VALUES ('0154C4970869412AADDCB31682B0BCAE', '20053898ef643316d6ad912998984bfd', 'testing', 'test', '', '10.0.0.130', '1', 'Virtual', FROM_UNIXTIME(1551805570), FROM_UNIXTIME(1551805570), NULL, '0', '', '', '', '0', '0', '', '192.168.124.16', '', 'Outbound-User', 'PPP', '10.43.94.6')
freeradius_1  | (13) sql: ERROR: rlm_sql_mysql: ERROR 1054 (Unknown column 'groupname' in 'field list'): 42S22
freeradius_1  | (13) sql: SQL query returned: server error
freeradius_1  | rlm_sql (sql): Released connection (16)
freeradius_1  | (13)     [sql] = fail
freeradius_1  | (13)   } # accounting = fail
freeradius_1  | (13) Not sending reply to client.
freeradius_1  | (13) Finished request
freeradius_1  | (13) Cleaning up request packet ID 44 with timestamp +653
freeradius_1  | Ready to process requests
freeradius_1  | (14) Received Accounting-Request Id 44 from 10.0.0.130:42505 to 10.0.0.132:1813 length 124
freeradius_1  | (14)   User-Name = "testing"
freeradius_1  | (14)   NAS-Port = 1
freeradius_1  | (14)   Service-Type = Outbound-User
freeradius_1  | (14)   Framed-Protocol = PPP
freeradius_1  | (14)   Framed-IP-Address = 10.43.94.6
freeradius_1  | (14)   Calling-Station-Id = "192.168.124.16"
freeradius_1  | (14)   NAS-Identifier = "OpenVpn"
freeradius_1  | (14)   Acct-Status-Type = Start
freeradius_1  | (14)   Acct-Session-Id = "0154C4970869412AADDCB31682B0BCAE"
freeradius_1  | (14)   NAS-Port-Type = Virtual
freeradius_1  | (14) # Executing section preacct from file /etc/raddb/sites-enabled/default
freeradius_1  | (14)   preacct {
freeradius_1  | (14)     policy mask_accounting_data {
freeradius_1  | (14)       if ( yes == "no" ) {
freeradius_1  | (14)       if ( yes == "no" )  -> FALSE
freeradius_1  | (14)     } # policy mask_accounting_data = noop
freeradius_1  | (14)     [preprocess] = ok
freeradius_1  | (14)     policy acct_unique {
freeradius_1  | (14)       if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) {
freeradius_1  | (14)       EXPAND %{string:Class}
freeradius_1  | (14)          --> 
freeradius_1  | (14)       if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i)  -> FALSE
freeradius_1  | (14)       else {
freeradius_1  | (14)         update request {
freeradius_1  | (14)           EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
freeradius_1  | (14)              --> 20053898ef643316d6ad912998984bfd
freeradius_1  | (14)           &Acct-Unique-Session-Id := 20053898ef643316d6ad912998984bfd
freeradius_1  | (14)         } # update request = noop
freeradius_1  | (14)       } # else = noop
freeradius_1  | (14)     } # policy acct_unique = noop
freeradius_1  | (14) suffix: Checking for suffix after "@"
freeradius_1  | (14) suffix: No '@' in User-Name = "testing", looking up realm NULL
freeradius_1  | (14) suffix: No such realm "NULL"
freeradius_1  | (14)     [suffix] = noop
freeradius_1  | (14)     [files] = noop
freeradius_1  | (14)   } # preacct = ok
freeradius_1  | (14) # Executing section accounting from file /etc/raddb/sites-enabled/default
freeradius_1  | (14)   accounting {
freeradius_1  | (14) sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query}
freeradius_1  | (14) sql:    --> type.start.query
freeradius_1  | (14) sql: Using query template 'query'
freeradius_1  | rlm_sql (sql): Reserved connection (17)
freeradius_1  | (14) sql: EXPAND %{User-Name}
freeradius_1  | (14) sql:    --> testing
freeradius_1  | (14) sql: SQL-User-Name set to 'testing'
freeradius_1  | (14) sql: EXPAND %{User-Name}
freeradius_1  | (14) sql:    --> testing
freeradius_1  | (14) sql: SQL-User-Name set to 'testing'
freeradius_1  | rlm_sql (sql): Reserved connection (16)
freeradius_1  | (14) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = "testing" ORDER BY priority LIMIT 1
freeradius_1  | rlm_sql (sql): Released connection (16)
freeradius_1  | Need 7 more connections to reach 10 spares
freeradius_1  | rlm_sql (sql): Opening additional connection (19), 1 of 28 pending slots used
freeradius_1  | rlm_sql_mysql: Starting connect to MySQL server
freeradius_1  | rlm_sql_mysql: Connected to database 'radius' on mysql via TCP/IP, server version 5.7.22, protocol version 10
freeradius_1  | (14) sql: EXPAND INSERT INTO radacct (acctsessionid,		acctuniqueid,		username, groupname, realm,			nasipaddress,		nasportid, nasporttype,		acctstarttime,		acctupdatetime, acctstoptime,		acctsessiontime, 	acctauthentic, connectinfo_start,	connectinfo_stop, 	acctinputoctets, acctoutputoctets,	calledstationid, 	callingstationid, acctterminatecause,	servicetype,		framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{sql:SELECT groupname FROM radusergroup WHERE username = "%{SQL-User-Name}" ORDER BY priority LIMIT 1}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')
freeradius_1  | (14) sql:    --> INSERT INTO radacct (acctsessionid,		acctuniqueid,		username, groupname, realm,			nasipaddress,		nasportid, nasporttype,		acctstarttime,		acctupdatetime, acctstoptime,		acctsessiontime, 	acctauthentic, connectinfo_start,	connectinfo_stop, 	acctinputoctets, acctoutputoctets,	calledstationid, 	callingstationid, acctterminatecause,	servicetype,		framedprotocol, framedipaddress) VALUES ('0154C4970869412AADDCB31682B0BCAE', '20053898ef643316d6ad912998984bfd', 'testing', 'test', '', '10.0.0.130', '1', 'Virtual', FROM_UNIXTIME(1551805573), FROM_UNIXTIME(1551805573), NULL, '0', '', '', '', '0', '0', '', '192.168.124.16', '', 'Outbound-User', 'PPP', '10.43.94.6')
freeradius_1  | (14) sql: Executing query: INSERT INTO radacct (acctsessionid,		acctuniqueid,		username, groupname, realm,			nasipaddress,		nasportid, nasporttype,		acctstarttime,		acctupdatetime, acctstoptime,		acctsessiontime, 	acctauthentic, connectinfo_start,	connectinfo_stop, 	acctinputoctets, acctoutputoctets,	calledstationid, 	callingstationid, acctterminatecause,	servicetype,		framedprotocol, framedipaddress) VALUES ('0154C4970869412AADDCB31682B0BCAE', '20053898ef643316d6ad912998984bfd', 'testing', 'test', '', '10.0.0.130', '1', 'Virtual', FROM_UNIXTIME(1551805573), FROM_UNIXTIME(1551805573), NULL, '0', '', '', '', '0', '0', '', '192.168.124.16', '', 'Outbound-User', 'PPP', '10.43.94.6')
freeradius_1  | (14) sql: ERROR: rlm_sql_mysql: ERROR 1054 (Unknown column 'groupname' in 'field list'): 42S22
freeradius_1  | (14) sql: SQL query returned: server error
freeradius_1  | rlm_sql (sql): Released connection (17)
freeradius_1  | (14)     [sql] = fail
freeradius_1  | (14)   } # accounting = fail
freeradius_1  | (14) Not sending reply to client.
freeradius_1  | (14) Finished request
freeradius_1  | (14) Cleaning up request packet ID 44 with timestamp +656
freeradius_1  | Ready to process requests
ovpn_1        | Tue Mar  5 17:06:13 2019 RADIUS-PLUGIN: BACKGROUND ACCT: Error: Start packet couldn't send.
ovpn_1        | 
ovpn_1        | !
ovpn_1        | Tue Mar  5 17:06:13 2019 Error: RADIUS-PLUGIN: FOREGROUND: Accounting failed for user:testing!
ovpn_1        | 
ovpn_1        | testing/192.168.124.16:32965 PLUGIN_CALL: POST /usr/lib/openvpn/radiusplugin.so/PLUGIN_CLIENT_CONNECT status=1
ovpn_1        | testing/192.168.124.16:32965 PLUGIN_CALL: plugin function PLUGIN_CLIENT_CONNECT failed with status 1: /usr/lib/openvpn/radiusplugin.so
ovpn_1        | testing/192.168.124.16:32965 WARNING: client-connect plugin call failed
ovpn_1        | testing/192.168.124.16:32965 PUSH: Received control message: 'PUSH_REQUEST'
ovpn_1        | testing/192.168.124.16:32965 Delayed exit in 5 seconds
ovpn_1        | testing/192.168.124.16:32965 SENT CONTROL [testing]: 'AUTH_FAILED' (status=1)
ovpn_1        | testing/192.168.124.16:32965 PUSH: Received control message: 'PUSH_REQUEST'
ovpn_1        | testing/192.168.124.16:32965 Delayed exit in 5 seconds
ovpn_1        | testing/192.168.124.16:32965 SENT CONTROL [testing]: 'AUTH_FAILED' (status=1)
ovpn_1        | testing/192.168.124.16:32965 SIGTERM[soft,delayed-exit] received, client-instance exiting

I noticed that there are some errors between freeradius and mysql query.Have you got the error in your testing?

ovpn AUTH_FAILED

Hi i have problem ovpn can not authenticate can help me
freeradius is work openvpn not connect to radius for authenticate
AR@system:~/docker-ovpn$ docker run -it --rm -v ./configs/ovpn/client.conf:/etc/openvpn/client.conf --device /dev/net/tun:/dev/net/tun --net=docker-ovpn_backend --cap-add=NET_ADMIN 2stacks/ovpn-client client.conf Tue Apr 18 17:43:14 2023 OpenVPN 2.4.6 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jul 8 2018 Tue Apr 18 17:43:14 2023 library versions: LibreSSL 2.7.4, LZO 2.10 Enter Auth Username:testing Enter Auth Password: Tue Apr 18 17:43:18 2023 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Tue Apr 18 17:43:18 2023 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication Tue Apr 18 17:43:18 2023 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication Tue Apr 18 17:43:18 2023 TCP/UDP: Preserving recently used remote address: [AF_INET]10.0.0.3:1194 Tue Apr 18 17:43:18 2023 Socket Buffers: R=[212992->200000] S=[212992->200000] Tue Apr 18 17:43:18 2023 UDP link local: (not bound) Tue Apr 18 17:43:18 2023 UDP link remote: [AF_INET]10.0.0.3:1194 Tue Apr 18 17:43:18 2023 TLS: Initial packet from [AF_INET]10.0.0.3:1194, sid=4f976d33 665f4310 Tue Apr 18 17:43:18 2023 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=nopass, name=EasyRSA, [email protected] Tue Apr 18 17:43:18 2023 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=site, name=EasyRSA, [email protected] Tue Apr 18 17:43:18 2023 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES128-SHA256, 2048 bit RSA Tue Apr 18 17:43:18 2023 [site] Peer Connection Initiated with [AF_INET]10.0.0.3:1194 Tue Apr 18 17:43:19 2023 SENT CONTROL [site]: 'PUSH_REQUEST' (status=1) Tue Apr 18 17:43:19 2023 AUTH: Received control message: AUTH_FAILED Tue Apr 18 17:43:19 2023 SIGTERM[soft,auth-failure] received, process exiting

My compose

`
ovpn:
image: "2stacks/docker-ovpn:latest"
ports:
- "443:443"
- "1194:1194/udp"
volumes:
- "${PWD}/configs/ovpn:/etc/openvpn"
environment:
- RADIUS_HOST=freeradius
- RADIUS_KEY=testing123
- DNS_HOST1=1.1.1.1
- DNS_HOST2=1.0.0.1
- OVPN_DEBUG=yes
cap_add:
- NET_ADMIN
restart: always
networks:
- backend

freeradius:
image: "2stacks/freeradius"
ports:
- "1812/udp"
- "1813/udp"
#volumes:
#- "./configs/radius/users:/etc/raddb/users"
environment:
- DB_NAME=radius
- DB_HOST=mysql
- DB_USER=radius
- DB_PASS=radpass
- DB_PORT=3306
- RADIUS_KEY=testing123
- RAD_CLIENTS=10.0.0.0/24
- RAD_DEBUG=yes
depends_on:
- mysql
links:
- mysql
restart: always
networks:
- backend

mysql:
image: "mysql:5.7"
command: mysqld
ports:
- "3306:3306"
volumes:
- "${PWD}/configs/mysql/master/data:/var/lib/mysql"
- "${PWD}/configs/mysql/master/conf.d:/etc/mysql/conf.d"
- "${PWD}/configs/mysql/radius.sql:/docker-entrypoint-initdb.d/radius.sql"
environment:
- MYSQL_ROOT_PASSWORD=radius
- MYSQL_USER=radius
- MYSQL_PASSWORD=radpass
- MYSQL_DATABASE=radius
restart: always
networks:
- backend

networks:
backend:
ipam:
config:
- subnet: 10.0.0.0/24
-
`

openvpn server ip is?

Hi,bro:
I get some problem, i don't konw what is the openvpn server ip?
it'is not 10.43.95.1

Image Update - ubuntu

ubuntu
SHA: 0f6b9174123857b7d668f8f43e0ee3e946723d3439235fd3dee5ff3c907ef061
tag: 16.04

SHA: 0f6b9174123857b7d668f8f43e0ee3e946723d3439235fd3dee5ff3c907ef061
tag: xenial-20190122

SHA: 0f6b9174123857b7d668f8f43e0ee3e946723d3439235fd3dee5ff3c907ef061
tag: xenial

SHA: abfb681a13dc9c2fd3bf11a7adef3477d248eb232228d4aec1d0946e91459ee4
tag: 18.10

SHA: abfb681a13dc9c2fd3bf11a7adef3477d248eb232228d4aec1d0946e91459ee4
tag: cosmic-20190122

SHA: abfb681a13dc9c2fd3bf11a7adef3477d248eb232228d4aec1d0946e91459ee4
tag: cosmic

SHA: abfb681a13dc9c2fd3bf11a7adef3477d248eb232228d4aec1d0946e91459ee4
tag: rolling

SHA: bd5033cef9983b8117a1d58c1175bbd650e9d91858b066cf1086612fce501400
tag: 18.04

SHA: bd5033cef9983b8117a1d58c1175bbd650e9d91858b066cf1086612fce501400
tag: bionic-20190122

SHA: bd5033cef9983b8117a1d58c1175bbd650e9d91858b066cf1086612fce501400
tag: bionic

SHA: bd5033cef9983b8117a1d58c1175bbd650e9d91858b066cf1086612fce501400
tag: latest

SHA: c38099cb67681ca54650fff48f3ed7f5d50c35a5cdd266bb8f1ee308de300bb8
tag: 19.04

SHA: c38099cb67681ca54650fff48f3ed7f5d50c35a5cdd266bb8f1ee308de300bb8
tag: devel

SHA: c38099cb67681ca54650fff48f3ed7f5d50c35a5cdd266bb8f1ee308de300bb8
tag: disco-20190118

SHA: c38099cb67681ca54650fff48f3ed7f5d50c35a5cdd266bb8f1ee308de300bb8
tag: disco

SHA: 3bbf46de5ee0328ae7497e6b355fb2e16e6cf2aaaeb47f0cdb4249a8f29cad90
tag: 14.04

SHA: 3bbf46de5ee0328ae7497e6b355fb2e16e6cf2aaaeb47f0cdb4249a8f29cad90
tag: trusty-20190122

SHA: 3bbf46de5ee0328ae7497e6b355fb2e16e6cf2aaaeb47f0cdb4249a8f29cad90
tag: trusty

MicroBadger: Docker Hub image ubuntu has changed https://microbadger.com/images/ubuntu

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.