azinchen/ocserv-server repository overview

⁠OpenConnect VPN Server Docker Container

OpenConnect VPN server (ocserv⁠) in a small self-configuring Docker container: it builds ocserv from source on Alpine, sets up NAT/forwarding automatically with nftables, and can disguise itself as an ordinary HTTPS website.

⁠✨ Key Features

• 🔐 Broad client support — openconnect, Cisco AnyConnect, mobile apps, Keenetic, OpenWrt (details⁠)
• 🚀 Self-configuring networking — NAT, forwarding and MSS clamping set up automatically (details⁠)
• 🕵️ Camouflage mode — looks like a plain HTTPS site; only clients with the secret get in (details⁠)
• 🚪 Gateway mode — route clients out through upstream VPN containers such as NordVPN (details⁠)
• 👥 Per-user routing — map each user to a different upstream exit, steered on connect (details⁠)
• 🎯 Destination bypass — per-destination routing: direct, via a chosen exit, or blocked (details⁠)
• 📥 Auto-fetched IP lists — country CIDR lists fetched on a schedule, swapped in atomically (details⁠)
• 🛡️ Fail-closed kill switch — if an upstream is down, clients lose internet rather than leak (details⁠)
• 🔄 Hot-reload everything — user maps, pools, gateways and certs reload live, sessions kept (details⁠)
• 🔒 Reverse-proxy & Let's Encrypt friendly — share SWAG's certs; renewals need no restart (details⁠)
• 📊 Session accounting — per-session times and traffic split per gateway and bypass pool (details⁠)
• 🩺 Opt-in health monitor — HEALTHCHECK for liveness, routing integrity and egress probes (details⁠)
• 📵 IPv6 without leaks — optional NAT66; dropped fail-closed when an upstream has no IPv6 (details⁠)
• 📦 Multi-arch, from source — amd64 / arm64 / riscv64, ocserv built from source, supervised by s6-overlay

⁠🚀 Quick Start

# docker-compose.yml
services:
  ocserv:
    image: azinchen/ocserv-server:latest
    container_name: ocserv-server
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    sysctls:
      - net.ipv4.ip_forward=1
    ports:
      - 443:443/tcp
      - 443:443/udp
    environment:
      - VPN_SUBNET=10.10.0.0/24
    volumes:
      - ./volumes/config:/etc/ocserv

docker compose up -d
# create a user
docker exec -it ocserv-server ocpasswd -c /etc/ocserv/ocpasswd alice
# connect
sudo openconnect https://vpn.example.com --user=alice

You provide an ocserv.conf and a certificate in the config volume — ready-to-use configurations are on the wiki: Basic⁠ · Self-Signed⁠ · SWAG / Let's Encrypt⁠. Start with Getting Started⁠.

⁠Requirements

⁠🧩 Common Setups

For example, chaining every client out through a NordVPN container is just:

    environment:
      - VPN_SUBNET=10.20.0.0/24
      - VPN_GATEWAY=172.28.0.2        # the nordvpn container, kill switch included

⁠⚙️ Environment Variables

Grouped by feature; every variable is one line here — the Configuration Reference⁠ has the full descriptions.

⁠Core networking

⁠IPv6

⁠Gateway mode — details⁠

⁠Destination bypass — details⁠

⁠Session accounting — details⁠

⁠Health monitor — details⁠

⁠Certificate hot-reload — details⁠

⁠🏗️ Build

docker build -t ocserv-server .

Base: Alpine Linux · Init: s6-overlay · VPN: ocserv (built from source) · Firewall: nftables

⁠🐛 Issues

If you have any problems with or questions about this image, please contact me through a GitHub issue⁠ or email⁠.

Check the Troubleshooting⁠ and FAQ⁠ wiki pages first — and attach the output of the built-in diagnostic to any report:

docker exec ocserv-server network-diagnostic

It prints server status, config sanity checks, certificate state (issuer + expiry), a camouflage self-test, gateway/bypass state with live egress probes (public IP through each gateway and bypass target), connected sessions with live traffic counters, routing and firewall state, and [ok]/[warn] verdicts (non-zero exit on warnings). --explain <user> <ip> tells you which path a destination takes; --json emits a machine-readable summary.

⁠📄 License

MIT — see LICENSE⁠.