项目地址
https://github.com/hwdsl2/docker-ipsec-vpn-server


readme
https://github.com/hwdsl2/docker-ipsec-vpn-server/blob/master/README-zh.md



```
docker run \
    --name ipsec-vpn-server \
    --restart=always \
    -v ikev2-vpn-data:/etc/ipsec.d \
    -v /lib/modules:/lib/modules:ro \
    -p 500:500/udp \
    -p 4500:4500/udp \
    -d --privileged \
    hwdsl2/ipsec-vpn-server
```


安装以后，获取 VPN 登录信息
`docker logs ipsec-vpn-server`

配置vpn客户端查看此文档
https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients-zh.md

windows11
```
Windows 11
右键单击系统托盘中的无线/网络图标。
选择 网络和 Internet 设置，然后在打开的页面中单击 VPN。
单击 添加 VPN 按钮。
从 VPN 提供商 下拉菜单选择 Windows (内置)。
在 连接名称 字段中输入任意内容。
在 服务器名称或地址 字段中输入你的 VPN 服务器 IP。
从 VPN 类型 下拉菜单选择 使用预共享密钥的 L2TP/IPsec。
在 预共享密钥 字段中输入你的 VPN IPsec PSK。
在 用户名 字段中输入你的 VPN 用户名。
在 密码 字段中输入你的 VPN 密码。
选中 记住我的登录信息 复选框。
单击 保存 保存 VPN 连接的详细信息。
```

使用windows或其他客户端进行连接出现错误时

https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md#windows-error-809


windows：
请使用管理员权限安装此注册表并重启
`REG ADD HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f`


手动添加账户
https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/manage-users-zh.md#%E6%89%8B%E5%8A%A8%E7%AE%A1%E7%90%86-vpn-%E7%94%A8%E6%88%B7


记一次搭建ipsec-vpn

nextcloud 调用onlyoffice要求onlyoffice ssl

onlyoffice 
关闭jwt
```
sudo docker run -i -t -d -p 443:443 --restart=always \
-v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data  -e JWT_ENABLED=false onlyoffice/documentserver-de
```

开启jwt

```
sudo docker run -i -t -d -p 443:443 --restart=always \
-v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data -e JWT_ENABLED=true -e JWT_SECRET=【这里写自己的秘钥】 onlyoffice/documentserver-de
```

安装证书
```
openssl genrsa -out onlyoffice.key 2048
openssl req -new -key onlyoffice.key -out onlyoffice.csr
openssl x509 -req -days 365 -in onlyoffice.csr -signkey onlyoffice.key -out onlyoffice.crt
openssl dhparam -out dhparam.pem 2048
mkdir -p /app/onlyoffice/DocumentServer/data/certs
cp onlyoffice.key /app/onlyoffice/DocumentServer/data/certs/
cp onlyoffice.crt /app/onlyoffice/DocumentServer/data/certs/
cp dhparam.pem /app/onlyoffice/DocumentServer/data/certs/
chmod 400 /app/onlyoffice/DocumentServer/data/certs/onlyoffice.key
chmod -R 755 /app/onlyoffice/DocumentServer/data/certs
```
重启容器

nextcloud 调用onlyoffice


当docker ip暴露为0.0.0.0开头时，会无视ufw规则，外部就可以进行访问，如图
![feeb51b0-76bb-46d5-adac-9cfaf791840d.png](/static/img/9b53f7272adfbf4bfb4027cdc7e25389.feeb51b0-76bb-46d5-adac-9cfaf791840d.webp)
我设置了12345拒绝状态
![image.png](/static/img/6c297888569493addb42984ce5da4ecf.image.webp)

以下是telnet结果，说明端口已被打开
![image.png](/static/img/107fd25beef64e826346f84eb360e3b5.image.webp)

原因在于`iptable -L`中，docker规则高于ufw规则，导致请求直接被转发。所以ufw无用。

![image.png](/static/img/ec3a72635937a81ba2eb21f1869adc8c.image.webp)


## **解决方案**

`vi /etc/docker/daemon.json`

增加"iptables": false

```
{
        "registry-mirrors": [
                "https://docker.1panel.live"
        ],
        "iptables": false
}
```

重新检查

![ebed20a6-d583-4bac-8694-5bbebeeabc4d.png](/static/img/0b645c1775508b38471fcfdacc52af7f.ebed20a6-d583-4bac-8694-5bbebeeabc4d.webp)

当你打开ufw端口时，可以重新访问。

docker禁止修改iptables

以mcsmanager为例


### 新建目录`resourcepacks`

![9af3e273-2c73-488e-aa98-7ba5f4ace34b.png](/static/img/1c774f819e00710ee97920c6b3ca1f50.9af3e273-2c73-488e-aa98-7ba5f4ace34b.webp)

上传数据包文件（我这里是ChoppingBlock资源包配套的数据包ChoppingBlockResourcePack.zip）

![image.png](/static/img/6e68d57cedbc80aa096a300e725454ca.image.webp)
然后路径下

![image.png](/static/img/25249bf57957b85938772f553cdac06e.image.webp)

### 修改server.properties中的两个选项如图：

resource-pack 地址就是刚才上传文件的地址，如图`/
resourcepackse/ChoppingBlockResourcePack.zip`

![image.png](/static/img/7ae8fb2b399a39fee95cc0b05c4ab40b.image.webp)


### 上传地图
新建world文件夹，然后上传地图包并解压。

![image.png](/static/img/b98464916802fc35ba1ed8b5886dd7ea.image.webp)


启动服务器即可


mc开服加数据包教程

ssh 用root先登录vcenter
我这里是vcenter 6.7

```bash
root@momen-server [ /var/log/vmware/vsphere-ui/logs ]# /usr/lib/vmware-vmca/bin/certificate-manager
                 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
                |                                                                     |
                |      *** Welcome to the vSphere 6.7 Certificate Manager  ***        |
                |                                                                     |
                |                   -- Select Operation --                            |
                |                                                                     |
                |      1. Replace Machine SSL certificate with Custom Certificate     |
                |                                                                     |
                |      2. Replace VMCA Root certificate with Custom Signing           |
                |         Certificate and replace all Certificates                    |
                |                                                                     |
                |      3. Replace Machine SSL certificate with VMCA Certificate       |
                |                                                                     |
                |      4. Regenerate a new VMCA Root Certificate and                  |
                |         replace all certificates                                    |
                |                                                                     |
                |      5. Replace Solution user certificates with                     |
                |         Custom Certificate                                          |
                |                                                                     |
                |      6. Replace Solution user certificates with VMCA certificates   |
                |                                                                     |
                |      7. Revert last performed operation by re-publishing old        |
                |         certificates                                                |
                |                                                                     |
                |      8. Reset all Certificates                                      |
                |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 4
Do you wish to generate all certificates using configuration file : Option[Y/N] ? :
Please enter any value with in [Y/N]. : Option[Y/N] ? : y

Please provide valid SSO and VC privileged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:
Enter password:
certool.cfg file exists, Do you wish to reconfigure : Option[Y/N] ? : y

Press Enter key to skip optional parameters or use Previous value.

Enter proper value for 'Country' [Previous value : CN] :

Enter proper value for 'Name' [Previous value : CA] :

Enter proper value for 'Organization' [Previous value : VMware] :

Enter proper value for 'OrgUnit' [Previous value : VMware Engineering] :

Enter proper value for 'State' [Previous value : California] :

Enter proper value for 'Locality' [Previous value : Palo Alto] :

Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] :

Enter proper value for 'Email' [Previous value : email@acme.com] :

Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : momen-server.momen.world

Enter proper value for VMCA 'Name' :momen-server.momen.world

You are going to regenerate Root Certificate and all other certificates using VMCA
Continue operation : Option[Y/N] ? : y
Get site nameCompleted [Replacing Machine SSL Cert...]
default-site
Lookup all services
······
······
Updated 34 service(s)
Status : 85% Completed [starting services...]
Status : 100% Completed [All tasks completed successfully]

root@momen-server [ /var/log/vmware/vsphere-ui/logs ]#

```

新建目录resourcepacks

新建目录`resourcepacks`