mirror of
https://github.com/angristan/openvpn-install.git
synced 2026-08-11 09:08:13 +02:00
StanislasandGitHub
d2fc6d444b
## Summary - add independent install options for internet routing, client-to-client access, and explicit server-side networks - enforce the selected policy across firewalld, nftables, and iptables, including DCO traffic - use destination-scoped NAT for home LAN access and preserve client routes and DNS in split-tunnel mode - document the new defaults and add focused Docker policy coverage Defaults remain internet access enabled, client-to-client access disabled, and server-side network access disabled. Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213 #147
28 lines
795 B
Docker
28 lines
795 B
Docker
# checkov:skip=CKV_DOCKER_2:Test container doesn't need healthcheck
|
|
# checkov:skip=CKV_DOCKER_3:OpenVPN client requires root for NET_ADMIN
|
|
FROM ubuntu:26.04
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Install OpenVPN client and testing tools
|
|
# dnsutils provides dig for DNS testing with Unbound
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
openvpn \
|
|
iproute2 \
|
|
iputils-ping \
|
|
procps \
|
|
dnsutils \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Create TUN device directory (device will be mounted at runtime)
|
|
RUN mkdir -p /dev/net
|
|
|
|
# Copy test scripts
|
|
COPY test/client-entrypoint.sh /entrypoint.sh
|
|
COPY test/policy-peer-entrypoint.sh /policy-peer-entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh /policy-peer-entrypoint.sh
|
|
|
|
WORKDIR /etc/openvpn
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|