Hi guys, I’ve been trying to get openvpn client set up in an LXC container. Initially, I ran into a problem, error: cannot open TUN/TAP device. I’ve got an ubuntu container, and I figured I’d post this in case someone has the same issue. To get around it, you have to:
- edit /srv/lxc/[containername]/config as follows:
systemd within the lxc
lxc.autodev = 1
lxc.hook.autodev = /srv/lxc/[containername]/autodev
lxc.pts = 1024
lxc.kmsg = 0
for openvpn
lxc.cgroup.devices.allow = c 10:200 rwm
Then you need to create, in that same directory (/srv/lxc/[containername]/) a script called ‘autodev’ (which was referred to in the above changes):
#!/bin/bash
cd ${LXC_ROOTFS_MOUNT}/dev
mkdir net
mknod net/tun c 10 200
chmod 0666 net/tun
Finally, you need to make that script executable by chmod +x autodev.
By the way, I’ve noticed that the posting window makes a line like #!/bin/bash appear bold, and eliminates the “#”–you’re going to need to put it back in on all of these bolded lines. Sorry.
Don’t forget to reboot your container for this to take effect.
Anyway, that’s what I’ve got so far–it’s running. Now I need to actually test to make sure it’s working and not dns leaking. I’ll update this thread as I progress, but others are welcome to join in. I’m pretty sure that I’m not the only one who’d like to be able to run openvpn in a container, but I couldn’t find any other topics on point.
To do: configure to autostart and run in background (as daemon, or something)
Cheers!
Chris
Update
To autostart openvpn (at least on Ubuntu 16, which uses systemd), do the following:
First of all, copy the .ovpn that you’re going to use over to /etc/openvpn/[whatever-name-you-want].conf (note the change in extension–you’re copying but renaming the file to whatever.conf).
For example, rename it /etc/openvpn/turris.conf
Secondly, edit /etc/default/openvpn and either add or change an AUTOSTART line to read AUTOSTART=“turris” (if you use the example above)
Third, you’re going to want to edit turris.conf to change the line that reads auth-users-pass to auth-users-pass .secrets (or .banana if you want, just pick a file name, and it doesn’t have to be hidden with the “.”, but hey, we’re holding secret passwords here.)
In that same directory, create your file .secrets (or .banana 
) and on the first line have your login, and on the second line your password. Save and exit. Probably want to chmod 600 .secrets.
You can then reboot your container, or if you don’t want to for some reason, make systemd reload settings by entering systemctl daemon-reload, then service openvpn restart.
If you run into trouble, call the script by entering openvpn --config /etc/openvpn/turris.conf directly, and it should give you some indication what’s going wrong.
Fix DNS leak: append the following lines to the end of turris.conf (or whatever you called it), and the VPN’s DNS servers should be used, instead of yours:
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
IPtables to ensure that if VPN is down, network doesn’t revert to local network for internet:
Create a script in /root directory, call it firewall-setup.sh, as follows:
#!/bin/bash
Clear any existing iptables rules
iptables -F
Allow anything in and out the vpn interface
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPTAllow in and out traffic from the VPN endpoint.
Replace aaa.bbb.ccc.ddd with the IP endpoint of the VPN
this can be taken from the ovpn file.
iptables -A INPUT -s aaa.bbb.ccc.ddd -j ACCEPT
iptables -A OUTPUT -d aaa.bbb.ccc.ddd -j ACCEPTAllow in and out traffic to localhost
iptables -A INPUT -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -d 127.0.0.1 -j ACCEPTAllow DHCP traffic
iptables -A OUTPUT -p UDP --dport 67:68 -j ACCEPT
Allow in and out traffic to a tcp port from the host’s LAN subnetwork
iptables -A INPUT -s 10.0.0.0/24 -p tcp --dport XX -j ACCEPT
iptables -A OUTPUT -d 10.0.0.0/24 -p tcp --sport XX -j ACCEPT
Reject anything else
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROPReject any IPv6 traffic
ip6tables -A OUTPUT -j DROP
ip6tables -A INPUT -j DROP
ip6tables -A FORWARD -j DROP
Remember, see my note about the bolded lines, above.
Anyway, once that script is created, add the following line at the end of your /etc/network/interfaces file (in the container, not the host):
post-up /root/firewall-setup.sh.
This post updated to reflect DNS leaking tips (seen above, involves adding lines to “turris.conf”, as in our example.)