(Not) Running on the Synology NAS #202
-
|
@bubuntux As suggested, I'm starting a discussion for running this image on a Synology NAS. Trying to run this image under the Docker ecosystem provided by Synology as a "package". Other images run, and this NordVPN one does too, but is unable to connect successfully. The image can be setup through the Wizard, but I've opted to use the command line for a little more control and reproducibility to contrast between the Synology platform (Device Under Test - "DUT" hereonin) and the test host I tried (Xubuntu 20.04 - works great - Control Device - "CD" hereonin). On both the CD and the DUT, I spun the image using this command (account credentials redacted, and note there is a Synology OS ( There is no The docker setup on the DUT is: Synology provices logs for it's Docker images as CSV file reversed chronologically (whatever) and this is what it reports: |
Beta Was this translation helpful? Give feedback.
Replies: 8 comments 25 replies
-
|
I also have this same problem, and haven't found a solution yet. It was working on the older version, but not any more. Would be grateful if anyone has a workaround here |
Beta Was this translation helpful? Give feedback.
-
|
I have the same problem as you @Subject2Risk As you mentioned Neither I didn't add logs since they seem to be identical to yours. The NordVPN-section of my docker-compose file below, with some stuff commented out that I have tried in testing: Docker environment version:
Can't come up with what else to test at the moment. |
Beta Was this translation helpful? Give feedback.
-
|
Version 3.9.1 still works. Ensure the latest images are deleted and use the following in the yaml or composer, preferably created a template in Portainer.
Here is a copy of my composer playbook for portainer:
In Portainer it is very important to ensure that other newer images are removed first. |
Beta Was this translation helpful? Give feedback.
-
|
This has worked for me! I pulled v3.9.5-1, which is a little newer and might be better than v3.9.1 |
Beta Was this translation helpful? Give feedback.
-
|
My NAS doesn't have the |
Beta Was this translation helpful? Give feedback.
-
|
I have a shell script I run at startup on the NAS (set as a scheduled task) |
Beta Was this translation helpful? Give feedback.
-
|
The answer, really is the shell script you posted above. That the |
Beta Was this translation helpful? Give feedback.
-
|
I ended up doing what @bbtufty just posted and added I think v3.9.1 is now up and running. Will test the latest version. |
Beta Was this translation helpful? Give feedback.
-
|
v3.9.1 is the only version I can get up and running. |
Beta Was this translation helpful? Give feedback.
-
|
@bubuntux Still not able to get anything past v3.9.1 to connect, but I am connecting with that prior version. |
Beta Was this translation helpful? Give feedback.
-
|
I can relate, same problem here. v3.9.1 and prior work, later don't. |
Beta Was this translation helpful? Give feedback.
-
|
have you guys tried ghcr.io/bubuntux/nordvpn:basic_ports give it a try |
Beta Was this translation helpful? Give feedback.
-
|
I tried |
Beta Was this translation helpful? Give feedback.
-
|
@ProjectVRD I have tried with So I don't think this is related to the network. It works in both specifying the bridge network and in letting docker create its own bridge network, for releases @bubuntux Same issues with not being able to connect is there with versions after As to what seems to be needed in the compose-file, I have come to these conclusions in my environemnt(At least for Looking into the logs I can see that I do get authenticated towards NordVPN. I see that the @bubuntux What is this trying to do? I'm average in iptables I would say. Would be interesting to know what this means. Haven't come across the It seems to fall back to open the necessary ports due to the group match failed. Before removal of Also, removed Seems that the NAS automatically created As can be seen, the tun module is loaded. Edit: Not below that |
Beta Was this translation helpful? Give feedback.
-
Is allowing any process executed by the group nordvpn access outside of the vpn, this is need it so the daemon can reach nordvpn endpoint and establish the connection, if this fails (since some kernels do not support it), it will open access to specific ports to establish the connection (dns, openvpn, wireguard, https), this is a little more insecure for a few milliseconds, there could be some dns leak, but is the best you can get with that kernel unfortunately. |
Beta Was this translation helpful? Give feedback.
-
|
i'm not familiar with Synology and can't really reproduce the issue, have you guys tried to execute nordvpn in the host itself (without containers), i can't find a significant change that could cause this issue between 3.9.1 and 3.10.0 the issue could be in nordpvn side. |
Beta Was this translation helpful? Give feedback.
-
|
do you guys have ipv6 enabled? if so try to disable it |
Beta Was this translation helpful? Give feedback.
-
|
@bubuntux Thanks for the explanation about I do not believe that it is possible to install the actual Nordvpn-package on the NAS. So can't really try that. That's one of the reasons to running it in a docker-container. Other than that it's fun dockerising and a slick way to get traffic routed via the container environment. I did do some testing regarding IPv6. I disabled it on the network interface for the NAS. It was set to auto before, and from what I could see it wasn't really used. I however do see that the interfaces get local IPv6 addresses regardless if it's enabled or not. I do however see this, both when it's disabled and enabled on the interface. Maybe this is done regardless? Seems to be adding the IPv4 rules though, so don't know if this should be a problem. But maybe something gets borked since the Edit: I noticed that all interfaces but eth0(my NAS actual physical interface). It is one of those derived from the MAC address. This due to some tips I found when searching. But alas, it didn't work. |
Beta Was this translation helpful? Give feedback.
-
|
@bubuntux |
Beta Was this translation helpful? Give feedback.
-
|
We can't say that the discussion is "answered" as using the version 3.9.1 is just a workaround ... |
Beta Was this translation helpful? Give feedback.
-
|
Hey all, So I finally managed to get this thing working! Note: this now works on the latest Version 3.10.0! First thing is the tun module needs to be enabled for this to work. So head over to https://memoryleak.dev/post/fix-tun-tap-not-available-on-a-synology-nas/ to get this enabled and to stick on reboots. Once you have checked tun is installed and rebooted, it's time to add your compose I have used portainer in a stack due to the fact we require NET_ADMIN ENV. Now use this compose only changing "changeme" variables. and you should be good. version: "3.5" vpn: Cheers! |
Beta Was this translation helpful? Give feedback.
-
Doesn’t work with the latest version only 9.x |
Beta Was this translation helpful? Give feedback.
-
|
@PhatTranceUK Thank you! New to docker, and I was struggling to even know what in the hell to look for. Following your post worked perfectly. |
Beta Was this translation helpful? Give feedback.
-
Hello @bubuntux maybe you could run some tests @https://demo.synology.com/en-uk/dsm this will allow you to run docker and deploy a test env. ;) |
Beta Was this translation helpful? Give feedback.
-
|
Any news on this? How unsafe is this setup with FYI, the following works on my synology with DSM 7 with the NORDVPN_USER/PWD variables defined in my .env: But I'm wondering about leaks? |
Beta Was this translation helpful? Give feedback.
-
|
Also, it seems to work seamlessly outside of docker-compose, see #202 (reply in thread). Any idea what's going on? |
Beta Was this translation helpful? Give feedback.
-
|
One thing that I find weird... On my synology with DSM 7, it works if I do: However, using docker-compose, I have to disable the firewall, see #202 (reply in thread) Any idea what might be going on? |
Beta Was this translation helpful? Give feedback.
Version 3.9.1 still works.
Ensure the latest images are deleted and use the following in the yaml or composer, preferably created a template in Portainer.
Here is a copy of my composer playbook for portainer: