https://wiki.jb-vpn.uk/index.php?action=history&feed=atom&title=OpenVPN%3AWeb_Admin
OpenVPN:Web Admin - Revision history
2026-10-16T18:47:48Z
Revision history for this page on the wiki
MediaWiki 1.44.5
https://wiki.jb-vpn.uk/index.php?title=OpenVPN:Web_Admin&diff=271&oldid=prev
Josh: Document OpenVPN VPN-only web admin and monitor UIs
2026-10-16T15:30:11Z
<p>Document OpenVPN VPN-only web admin and monitor UIs</p>
<p><b>New page</b></p><div>Two web UIs run on this VPS for managing and monitoring OpenVPN. Both listen only on the VPN address <code>10.8.0.1</code> — they are '''not''' exposed via Caddy or the public internet.<br />
<br />
== Access (connect to VPN first) ==<br />
<br />
{| class="wikitable"<br />
|-<br />
| UI || URL || Purpose<br />
|-<br />
| '''ovpn-admin''' || http://10.8.0.1:8085 || Create / revoke / download <code>.ovpn</code>, CCD/static IPs, live connection flags<br />
|-<br />
| '''openvpn-monitor''' || http://10.8.0.1:8086 || Live clients, session history, traffic charts<br />
|}<br />
<br />
There is '''no login''' on either UI. Anyone connected to the VPN can reach them.<br />
<br />
== Services ==<br />
<br />
{| class="wikitable"<br />
|-<br />
| Component || How it runs<br />
|-<br />
| ovpn-admin || systemd <code>ovpn-admin.service</code> → <code>/opt/ovpn-admin/ovpn-admin</code><br />
|-<br />
| openvpn-monitor || Docker Compose in <code>/var/www/openvpn-monitor</code> (<code>docker-compose.vpn-only.yml</code>)<br />
|-<br />
| OpenVPN management || <code>127.0.0.1:8989</code> (localhost only)<br />
|-<br />
| Status log || <code>/var/log/openvpn-status.log</code> (<code>status-version 1</code>)<br />
|-<br />
| Status log perms || <code>openvpn-status-perms.service</code> sets mode <code>644</code> after OpenVPN start<br />
|}<br />
<br />
Useful commands:<br />
<br />
<pre class="lang-bash"><br />
systemctl status ovpn-admin openvpn-server@server<br />
docker compose -f /var/www/openvpn-monitor/docker-compose.vpn-only.yml ps<br />
journalctl -u ovpn-admin -f<br />
tail -f /var/log/ovpn-admin-easyrsa.log<br />
</pre><br />
<br />
== Creating a client (preferred: UI) ==<br />
<br />
# Connect to VPN and open http://10.8.0.1:8085<br />
# '''Add user''' → enter a client name (letters, numbers, underscore)<br />
# Download the <code>.ovpn</code> (Show config / download)<br />
# Optional: set a static IP under CCD (see caveats below)<br />
<br />
Downloaded profiles are '''full-tunnel''' by default (<code>redirect-gateway</code> + host DNS), with <code>tls-crypt</code> matching the server.<br />
<br />
== Backup create path (CLI) ==<br />
<br />
[/root/openvpn-install.sh <code>/root/openvpn-install.sh</code>] remains available if the UI cannot create a cert:<br />
<br />
<pre class="lang-bash"><br />
bash /root/openvpn-install.sh<br />
# choose "Add a new client"<br />
</pre><br />
<br />
== CCD / static IPs ==<br />
<br />
Existing CCD files live in <code>/etc/openvpn/ccd/</code>:<br />
<br />
{| class="wikitable"<br />
|-<br />
| Client || Address<br />
|-<br />
| StrawberryNAS || <code>10.8.0.2</code><br />
|-<br />
| jb-rpi2-webserver || <code>10.8.0.3</code><br />
|-<br />
| jb-rpi-homeassistant || <code>10.8.0.4</code> (uses <code>push-reset</code> + custom routes)<br />
|}<br />
<br />
The UI CCD editor can rewrite these files to a simpler <code>ifconfig-push … 255.255.255.0</code> form. After editing NAS/Pi CCD in the UI, verify:<br />
<br />
* https://plex.jb-vpn.uk and https://dsm.jb-vpn.uk still work<br />
<br />
* Client still gets the expected <code>10.8.0.x</code> address<br />
<br />
Dynamic pool remains <code>10.8.0.51</code>–<code>10.8.0.254</code>.<br />
<br />
== Revoke ==<br />
<br />
Revoke in the UI. The Easy-RSA wrapper syncs <code>pki/crl.pem</code> → <code>/etc/openvpn/server/crl.pem</code>. Revoked clients fail on '''next reconnect''' (sessions are not force-killed).<br />
<br />
== Layout on disk ==<br />
<br />
<pre><br />
/opt/ovpn-admin/<br />
ovpn-admin # binary<br />
easyrsa-wrapper # injects --batch/--days=3650; syncs CRL<br />
templates/client.conf.tpl # tls-crypt full-tunnel client template<br />
<br />
/etc/openvpn/server/easy-rsa/pki/ta.key → symlink to ../tc.key (for ovpn-admin TLS template field)<br />
<br />
/var/www/openvpn-monitor/ # farggus/openvpn-monitor checkout + compose<br />
/root/backups/openvpn-*/ # PKI/CCD backups taken before install<br />
</pre><br />
<br />
== Related Documentation ==<br />
<br />
* [[OpenVPN:User Management|OpenVPN:User Management]]<br />
<br />
* [[OpenVPN:Server Configuration|OpenVPN:Server Configuration]]<br />
<br />
* [[Documentation:Certificate-Management|OpenVPN:Certificate Management]]<br />
<br />
* [[Services:Current Services|Services:Current Services]]<br />
<br />
== Do not ==<br />
<br />
* Add a public Caddy site for these ports<br />
<br />
* Bind the UIs to <code>0.0.0.0</code> / the public NIC<br />
<br />
* Remove <code>openvpn-install.sh</code> (kept as backup)<br />
<br />
== Smoke-check after OpenVPN restart ==<br />
<br />
<pre class="lang-bash"><br />
# Live clients via management<br />
(echo status; sleep 0.2; echo quit) | nc -w 2 127.0.0.1 8989<br />
<br />
# Admin + monitor<br />
curl -s http://10.8.0.1:8085/api/users/list | head<br />
curl -s http://10.8.0.1:8086/api/clients | head<br />
</pre><br />
<br />
[[Category:Documentation]]<br />
[[Category:Documentation/OpenVPN]]</div>
Josh