allanger
/
container-openvpn
1
0
Fork 0
Code Issues 4 Pull Requests Packages Projects Releases Activity

Add dual protocol documentation

This commit is contained in:
Dave Burke 2016-05-31 21:09:41 -05:00
parent 5d436643b2
commit a5b9ade314
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
docs/tcp.md
View File

@ -5,6 +5,8 @@ By default, OpenVPN is configured to use the UDP protocol. Because UDP incurs m
As an example, users connecting from an airplane wifi network may experience high packet drop rates, where the error detection and sliding window control of TCP can more readily adjust to the inconsistent connection.
Another example would be trying to open a VPN connection from within a very restrictive network. In some cases port 1194, or even UDP traffic on any port, may be restricted by network policy. Because TCP traffic on port 443 is used for normal TLS (https) web browsing, it is very unlikely to be blocked.
## Using TCP
Those requiring TCP connections should initialize the data container by specifying the TCP protocol and port number:
@ -16,3 +18,14 @@ specified protocol, adjust the mapping appropriately:
docker run --volumes-from $OVPN_DATA -d -p 443:1194/tcp --cap-add=NET_ADMIN kylemanna/openvpn
## Running a Second Fallback TCP Container
Instead of choosing between UDP and TCP, you can use both. A single instance of OpenVPN can only listen for a single protocol on a single port, but this image makes it easy to run two instances simultaneously. After building, configuring, and starting a standard container listening for UDP traffic on 1194, you can start a second container listening for tcp traffic on port 443:
docker run --volumes-from $OVPN_DATA --rm -p 443:1194/tcp --privileged kylemanna/openvpn ovpn_run --proto tcp
`ovpn_run` will load all the values from the default config file, and `--proto tcp` will override the protocol setting.
This allows you to use UDP most of the time, but fall back to TCP on the rare occasion that you need it.
Note that you will need to configure client connections manually. At this time it is not possible to generate a client config that will automatically fall back to the TCP connection.