mirror of
https://github.com/funkypenguin/geek-cookbook/
synced 2025-12-24 15:11:38 +00:00
Travis build: 27
This commit is contained in:
@@ -10,7 +10,7 @@ In my case, I needed each docker node to connect via [OpenVPN](http://www.openvp
|
||||
|
||||
Yes, SELinux. Install a custom policy permitting a docker container to create tun interfaces, like this:
|
||||
|
||||
````
|
||||
```
|
||||
cat << EOF > docker-openvpn.te
|
||||
module docker-openvpn 1.0;
|
||||
|
||||
@@ -27,7 +27,7 @@ EOF
|
||||
checkmodule -M -m -o docker-openvpn.mod docker-openvpn.te
|
||||
semodule_package -o docker-openvpn.pp -m docker-openvpn.mod
|
||||
semodule -i docker-openvpn.pp
|
||||
````
|
||||
```
|
||||
|
||||
## Insert the tun module
|
||||
|
||||
@@ -35,25 +35,25 @@ Even with the SELinux policy above, I still need to insert the "tun" module into
|
||||
|
||||
Run the following to auto-insert the tun module on boot:
|
||||
|
||||
````
|
||||
```
|
||||
cat << EOF >> /etc/rc.d/rc.local
|
||||
# Insert the "tun" module so that the vpn-client container can access /dev/net/tun
|
||||
/sbin/modprobe tun
|
||||
EOF
|
||||
chmod 755 /etc/rc.d/rc.local
|
||||
````
|
||||
```
|
||||
|
||||
## Connect the VPN
|
||||
|
||||
Finally, for each node, I exported client credentials, and SCP'd them over to the docker node, into /root/my-vpn-configs-here/. I also had to use the NET_ADMIN cap-add parameter, as illustrated below:
|
||||
|
||||
````
|
||||
```
|
||||
docker run -d --name vpn-client \
|
||||
--restart=always --cap-add=NET_ADMIN --net=host \
|
||||
--device /dev/net/tun \
|
||||
-v /root/my-vpn-configs-here:/vpn:z \
|
||||
ekristen/openvpn-client --config /vpn/my-host-config.ovpn
|
||||
````
|
||||
```
|
||||
|
||||
Now every time my node boots, it establishes a VPN tunnel back to my pfsense host and (_by using custom configuration directives in OpenVPN_) is assigned a static VPN IP.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user