Hi, after spending quite some time on getting my openVPN server to work within a LXD managed Ubuntu:18.04 container, I wanted to share my insights.
I followed instructions from:
https://gist.github.com/wastrachan/8d75ecf39db1fc25ae73c93989a8df11
and with the bash installer obtained via:
wget https://git.io/vpn -O openvpn-install.sh
Problem I encountered was that
systemctl start openvpn@server
did not startup due to an issue that seemed similar to this:
https://askubuntu.com/questions/747023/systemd-fails-to-start-openvpn-in-lxd-managed-16-04-container
What worked for me:
1. Setup regular LXC container
a. Create a new container
lxc launch ubuntu:18.04 vpnserver
b. Create new user for LXC container
lxc exec vpnserver -- adduser NAME
lxc exec vpnserver -- usermod -a -G sudo NAME
2. Install OpenVPN following instructions:
# On the host
=============
lxc config set openvpn raw.lxc 'lxc.cgroup.devices.allow = c 10:200 rwm'
lxc config device add openvpn tun unix-char path=/dev/net/tun
# In the container
==================
1. mknod /dev/net/tun c 10 200
2. install OpenVPN (https://github.com/Nyr/openvpn-install or manual)
3. edit /lib/systemd/system/openvpn@.service -- comment out/remove `LimitNPROC=10`
4. systemctl daemon-reload or reboot container
3. Move server files <- the location of server.conf file was wrong for my installer. NOTE: Maybe the path can be edited somewhere.
Move everything in /etc/openvpn/server folder to /etc/openvpn/
#in container
sudo mv /etc/openvpn/server/* /etc/openvpn/
4. update LimitNPROC value in config file.
sudo nano /lib/systemd/system/openvpn@.service
Comment out line LimitNPROC
5. route traffic to tun device <- this was required for my setup to work <- maybe there is a more elegant way?
# on the host (outside container)
lxc config show
Check IP of vpnserver's TUN device and note it down -> CONTAINERIP
lxc config device add vpnserver DEVICENAME proxy listen=udp:0.0.0.0:YOURVPNPORTconnect=udp:CONTAINERIP:YOURVPNPORT
6. copy clientname.ovpn file from container to host and then to local client computer to config openVPN on client.
