docker-ocserv is a Docker image for running an OpenConnect VPN server (ocserv). This project is a fork of the original work by Tommy Lau and Amin Vakil, with additional enhancements.

OpenConnect Server (ocserv) is an SSL VPN server. It implements the OpenConnect SSL VPN protocol and offers experimental compatibility with clients using the AnyConnect SSL VPN protocol.

1. Install Docker:

   curl -L https://get.docker.com | sh && sudo usermod -aG docker $USER

2. Pull the Docker Image:

   docker pull eukhlg/ocserv

3. Start an ocserv Instance:

   docker run \
     --name ocserv \
     --detach \
     --sysctl net.ipv4.ip_forward=1 \
     --cap-add NET_ADMIN \
     --security-opt no-new-privileges \
     --publish 443:443 \
     --publish 443:443/udp \
     eukhlg/ocserv

   This command starts an instance without any pre-configured users.

The following environment variables can be used to customize the ocserv instance:

To update to the latest version of the image:

docker stop ocserv && docker rm ocserv && docker image prune --all -f && docker pull eukhlg/ocserv

Then restart the container with your desired options (see examples below).

Start an instance with a default user test and a random password:

docker run \
  --name ocserv \
  --detach \
  --sysctl net.ipv4.ip_forward=1 \
  --cap-add NET_ADMIN \
  --security-opt no-new-privileges \
  --publish 443:443 \
  --publish 443:443/udp \
  --env USER_NAME=test \
  eukhlg/ocserv

To retrieve the generated password for user 'test':

docker exec it ocserv cat /etc/.test

Start an instance with organization name My Test, server name my.test.com, and CA/server certificates valid for 365 days:

docker run \
  --name ocserv \
  --detach \
  --sysctl net.ipv4.ip_forward=1 \
  --cap-add NET_ADMIN \
  --security-opt no-new-privileges \
  --publish 443:443 \
  --publish 443:443/udp \
  --env USER_NAME=test \
  --env ORG_NAME="My Test" \
  --env HOST_NAME="my.test.com" \
  --env CA_DAYS=365 \
  --env SRV_DAYS=365 \
  eukhlg/ocserv

Start an instance without creating a default user:

docker run \
  --name ocserv \
  --detach \
  --sysctl net.ipv4.ip_forward=1 \
  --cap-add NET_ADMIN \
  --security-opt no-new-privileges \
  --publish 443:443 \
  --publish 443:443/udp \
  --env ORG_NAME="My Test" \
  --env HOST_NAME="my.test.com" \
  --env CA_DAYS=365 \
  --env SRV_DAYS=365 \
  eukhlg/ocserv

To run docker-ocserv with Docker Compose, you need the following files:

• docker-compose.yml – the main Compose file
• .env – defines environment variables for Docker Compose itself
• ocserv.env – contains environment variables specific to ocserv

Using the default .env and ocserv.env files allows you to start the latest version of docker-ocserv with a simple command:

docker compose up -d

It’s easy to run multiple ocserv instances on the same host (e.g., dev and prod) by using separate .env and ocserv.env files for each environment.

Create the following files:

OCSERV_IMAGE_VER=dev
OCSERV_CONTAINER_NAME=ocserv-dev
OCSERV_CONTAINER_HOSTNAME=ocserv-dev
UDP_PORT=9443
TCP_PORT=9443
HOST_BIND=./ocserv-dev
CONTAINER_BIND=/etc/ocserv
OCSERV_ENV_FILE=ocserv.dev.env

ORG_NAME="BigCorp DEV Inc"
HOST_NAME="vpndev.bigcorp.com"
AUTH="cert"
IPV4_NETWORK="172.20.10.0"
USER_NAME="devtest"
USER_PASSWORD="devtest"

Then start the dev instance with:

docker compose --env-file dev.env up -d

All user operations are performed while the container is running. If you used a container name other than ocserv, replace ocserv with your container name.

docker exec -it ocserv cut -d: -f1 /etc/ocserv/ocpasswd

To create a user named test:

docker exec -it ocserv ocpasswd -c /etc/ocserv/ocpasswd test

You will be prompted to enter and confirm the password.

To delete a user:

docker exec -it ocserv ocpasswd -c /etc/ocserv/ocpasswd -d test

To change a user's password, use the same command as adding a user:

docker exec -it ocserv ocpasswd -c /etc/ocserv/ocpasswd test

If cert authentication metod is set and USER_PASSWORD variable is not set, then random PKCS#12 (.p12) import password is set.

To retrieve the generated PKCS#12 (.p12) import password for user 'test':

docker exec -it ocserv cat /etc/.test

To create a certificate for user test with a password (testpass):

docker exec -it ocserv occert test testpass

By default, the certificate is valid for 365 days.

To create the same user with certificate validity of 30 days:

docker exec -it ocserv occert test testpass 30