vpn not working #1981

usma0118 · 2021-09-30T09:18:39Z

usma0118
Sep 30, 2021

Is there a pinned issue for this?

I have read the pinned issues and could not find my issue

Is there an existing or similar issue/discussion for this?

I have searched the existing issues
I have searched the existing discussions

Is there any comment in the documentation for this?

I have read the documentation, especially the FAQ and Troubleshooting parts

Is this related to a provider?

I have checked the provider repo for issues
My issue is NOT related to a provider

Are you using the latest release?

I am using the latest release

Have you tried using the dev branch latest?

I have tried using dev branch

Config used

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: transmission
    ver: v4
  name: transmission
  namespace: downloaders
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: transmission
      ver: v4
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: transmission
        ver: v4
    spec:
      containers:
      - env:
        - name: OPENVPN_PROVIDER
          value: vpnunlimited
        - name: OPENVPN_CONFIG
          value: fr
        - name: OPENVPN_USERNAME
          valueFrom:
            secretKeyRef:
              key: username
              name: "{redacted}"
        - name: OPENVPN_PASSWORD
          valueFrom:
            secretKeyRef:
              key: password
              name: "{redacted}"
        - name: TRANSMISSION_RPC_USERNAME
          value: "{redacted}"
        - name: TRANSMISSION_RPC_PASSWORD
          value: "{redacted}"
        - name: TRANSMISSION_RPC_AUTHENTICATION_REQUIRED
          value: "true"
        - name: TRANSMISSION_DOWNLOAD_DIR
          value: /downloads/transmission
        - name: PUID
          value: "1001"
        - name: PGID
          value: "1001"
        - name: TRANSMISSION_UMASK
          value: "18"
        - name: TRANSMISSION_RATIO_LIMIT
          value: "1"
        - name: TRANSMISSION_BLOCKLIST_ENABLED
          value: "true"
        - name: TRANSMISSION_BLOCKLIST_URL
          value: https://github.com/Naunter/BT_BlockLists/raw/master/bt_blocklists.gz
        - name: TRANSMISSION_ENCRYPTION
          value: "2"
        - name: TRANSMISSION_RATIO_LIMIT_ENABLED
          value: "true"
        - name: CREATE_TUN_DEVICE
          value: "true"
        - name: WEBPROXY_ENABLED
          value: "true"
        - name: WEBPROXY_PORT
          value: "8118"
        - name: TRANSMISSION_RPC_WHITELIST
          value: 10.1.183.*,127.0.0.1
        - name: TRANSMISSION_RPC_WHITELIST_ENABLED
          value: "true"
        - name: LOG_TO_STDOUT
          value: "true"
        - name: OPENVPN_OPTS
          value: --inactive 3600 --ping 10 --ping-exit 60
        - name: LOCAL_NETWORK
          value: 10.1.183.0/24
        image: haugene/transmission-openvpn:latest
        imagePullPolicy: Always
        name: transmission
        ports:
        - containerPort: 9091
          name: http
          protocol: TCP
        - containerPort: 8081
          name: webproxy
          protocol: TCP          
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            add:
            - NET_ADMIN
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /data
          name: transmission
          subPath: configs
        - mountPath: /downloads/transmission
          name: transmission
          subPath: downloads
        - mountPath: /etc/openvpn/vpnunlimited/fr.ovpn
          name: config
          subPath: fr.vpnunlimited.ovpn
      restartPolicy: Always
      securityContext: {}
      terminationGracePeriodSeconds: 30
      volumes:
      - name: transmission
        persistentVolumeClaim:
          claimName: transmissionv2
      - configMap:
          defaultMode: 420
          name: openvpn-common-config
        name: config

Current Behavior

VPN not functioning properly, resolv.config doesn't contain any dns entry
DNS resolution not working

i can see tun0 created.
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.200.0.62 peer 10.200.0.61/32 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::d44:f1fe:f2f0:a3e4/64 scope link stable-privacy
valid_lft forever preferred_lft forever

Expected Behavior

Connect to vpn provider successfully and system should be able to access internet
.

How have you tried to solve the problem?

I have a container with v3.x running with same configs without any failuers.

Log output

Starting container with revision: 6ee67f8210d7f9ca17677c2b108390acc91ec5ab
Creating TUN device /dev/net/tun
Using OpenVPN provider: VPNUNLIMITED
Running with VPN_CONFIG_SOURCE auto
No bundled config script found for VPNUNLIMITED. Defaulting to external config
Downloading configs from https://github.com/haugene/vpn-configs-contrib/archive/main.zip into /tmp/tmp.IfxRIXdxyW
Extracting configs to /tmp/tmp.QdzuRKy5n8
Found configs for VPNUNLIMITED in /tmp/tmp.QdzuRKy5n8/vpn-configs-contrib-main/openvpn/vpnunlimited, will replace current content in /etc/openvpn/vpnunlimited
rm: cannot remove '/etc/openvpn/vpnunlimited/fr.ovpn': Device or resource busy
Cleanup: deleting /tmp/tmp.IfxRIXdxyW and /tmp/tmp.QdzuRKy5n8
Starting OpenVPN using config fr.ovpn
Modifying /etc/openvpn/vpnunlimited/fr.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
sed: cannot rename /etc/openvpn/vpnunlimited/sedfAYJsj: Device or resource busy
Modification: Change ca certificate path
sed: cannot rename /etc/openvpn/vpnunlimited/sedhPIqUu: Device or resource busy
Modification: Change ping options
sed: cannot rename /etc/openvpn/vpnunlimited/sedlJA5Nv: Device or resource busy
sed: cannot rename /etc/openvpn/vpnunlimited/sedimYjRC: Device or resource busy
sed: cannot rename /etc/openvpn/vpnunlimited/sed2eFFhG: Device or resource busy
sed: cannot rename /etc/openvpn/vpnunlimited/sedDxlb0J: Device or resource busy
/etc/openvpn/modify-openvpn-config.sh: line 49: /etc/openvpn/vpnunlimited/fr.ovpn: Read-only file system
/etc/openvpn/modify-openvpn-config.sh: line 50: /etc/openvpn/vpnunlimited/fr.ovpn: Read-only file system
/etc/openvpn/modify-openvpn-config.sh: line 51: /etc/openvpn/vpnunlimited/fr.ovpn: Read-only file system

Environment

- OS:Ubuntu 20.04
- Docker: Kubernetes
- tag: latest
- vpn config mounted.

Anything else?

I have a release running on v3.x without any issues.

I am deploying new instance to migrate from v3 to v4.

Answered by pkishino

Sep 30, 2021

Doesn’t make sense that you are mounting a vpn config AND specifying the provider.. either specify provider and let the container auto load or OR set provider as CUSTOM and mount the config profile as default (see documentation on custom provider)
DNS resolution worked because it was able to download the profiles..
This doesn’t really look like a bug but more like config problems.. please fix above then update if there is a bug, otherwise this is better suited to discussions

View full answer

usma0118 · 2021-09-30T09:32:48Z

usma0118
Sep 30, 2021
Author

after some investigation i can see it's not able to connect to cluster or network dns. instead if i use public dns by overriding dns policy. than it works.
but is it possible to use my local dns instead?

0 replies

pkishino · 2021-09-30T10:52:54Z

pkishino
Sep 30, 2021
Collaborator

You haven’t posted your container config..
Ideally it should use the vpn dns it received through the PUSH.. why do you need to use local dns?
Please edit your post and show config.
Are you using :4.0 or : latest?

0 replies

usma0118 · 2021-09-30T10:59:40Z

usma0118
Sep 30, 2021
Author

updated.
I am using :latest tag

0 replies

pkishino · 2021-09-30T11:17:37Z

pkishino
Sep 30, 2021
Collaborator

Doesn’t make sense that you are mounting a vpn config AND specifying the provider.. either specify provider and let the container auto load or OR set provider as CUSTOM and mount the config profile as default (see documentation on custom provider)
DNS resolution worked because it was able to download the profiles..
This doesn’t really look like a bug but more like config problems.. please fix above then update if there is a bug, otherwise this is better suited to discussions

5 replies

usma0118 Sep 30, 2021
Author

tried with custom but issue persists:
vpn is connected but dns server pushed by vpn is not added.

as an extra test: a simple dig from container times out.

If i override dns than everything starts to work.

pkishino Sep 30, 2021
Collaborator

In your container, can you check output of “env” ? Are PEER_DNS and PEER_DNS_PIN_ROUTES true?
Try running on :dev channel instead.. merged this in recently to address DNS bug
#1973

pkishino Sep 30, 2021
Collaborator

I will merge it into master soon though

usma0118 Sep 30, 2021
Author

Both were set to true

PEER_DNS=true
PEER_DNS_PIN_ROUTES=true

switched to :dev and it works fine.

pkishino Sep 30, 2021
Collaborator

yeah, great. I'll merge in that fix to master today

Uh oh!

vpn not working #1981

Uh oh!

Uh oh!

usma0118 Sep 30, 2021

Is there a pinned issue for this?

Is there an existing or similar issue/discussion for this?

Is there any comment in the documentation for this?

Is this related to a provider?

Are you using the latest release?

Have you tried using the dev branch latest?

Config used

Current Behavior

Expected Behavior

How have you tried to solve the problem?

Log output

Environment

Anything else?

Replies: 4 comments · 5 replies

Uh oh!

usma0118 Sep 30, 2021 Author

Uh oh!

pkishino Sep 30, 2021 Collaborator

Uh oh!

usma0118 Sep 30, 2021 Author

Uh oh!

Uh oh!

pkishino Sep 30, 2021 Collaborator

Uh oh!

usma0118 Sep 30, 2021 Author

Uh oh!

pkishino Sep 30, 2021 Collaborator

Uh oh!

pkishino Sep 30, 2021 Collaborator

Uh oh!

usma0118 Sep 30, 2021 Author

Uh oh!

pkishino Sep 30, 2021 Collaborator

usma0118
Sep 30, 2021

Replies: 4 comments 5 replies

usma0118
Sep 30, 2021
Author

pkishino
Sep 30, 2021
Collaborator

usma0118
Sep 30, 2021
Author

pkishino
Sep 30, 2021
Collaborator

usma0118 Sep 30, 2021
Author

pkishino Sep 30, 2021
Collaborator

pkishino Sep 30, 2021
Collaborator

usma0118 Sep 30, 2021
Author

pkishino Sep 30, 2021
Collaborator