lost with port configuration

[Louisdulac59]

Hi,
I can't reach Portainer on the 9000 port when the container docker-transmission-openVPN is started.
I'm using this conf :
LOCAL_NETWORK 192.168.0.0/24 UFW_EXTRA_PORTS 22,80,443,9000,8000,135,137,138,139,445 UFW_ALLOW_GW_NET true

SSH on 22 or Web server on 80 works, but not the 9000 ...
I probably do something wrong, can someone help me please ?

[Louisdulac59]

nobody can help me about the parameters of the FW ?

[pkishino]

Portainer has nothing to do with this container, I don’t see what you are trying to do by adding all those ports. Are you trying to put portainer behind the container vpn in the same network??

[Louisdulac59]

thanks for your reply

When i was trying to go on my server with SSH (22) or WebInterface (it's an OpenMediaVault port 80) , i was blocked when i activated the Haugene container.
With thoses parameters, i can access on 22 and 80 but 9000 is still blocked when i launch it ...
I'm doing it wrong ?

[pkishino]

I’ve never used omv but it sounds more like some bad setup then that this container breaks something.
You should probably check that the docker runtime is setup correctly etc and the networks are set correctly

[edgd1er]

I'm running this container on openmediavault without any problem, although I didn't activate firewall.
my Transmission container is running using bridge network drivers ? Are you using bridge, host, ipvlan, macvlan network drivers ?

Using bridge network, there is a firewall at host level (openmediavault) and at the container level (docker-haugene-transmission).
the posted conf seems to mix host level ports and docker container level ports. ( ssh, web, cifs/smb services are on the host, depending on your setup, portainer might be running in another network stack.)
Do you have iptables rules defined in openmediavault (System->network tab) ?
Have you tried to run transmission without the firewall being activated (ENABLE_UFW=false) ?

should you have a conflict in rules setup/order, you may setup an iptables log in order to debug iptables rules,

[Louisdulac59]

i'm running on "host" network.

I though i needed the FW to be sure transmission will use the VPN ... that's wrong ?

I don't have IPtables in OVM.

I've juste tested with ENABLE_UFW = false, it works. With this parameter, i can be sure the datas of transmission will pass through the openVPN ?
If yes ... i got a solution ;) thank you very much !

[edgd1er]

Openmediavault has an open vpn plugin, do you use at the same moment, transmission container and openmediavault openvpn ?
If you wish to route traffic through container vpn, there is a proxy that can be enabled with webproxy_enabled=true.

you don't have to use host network to run haugene transmission container. I run it on bridge network, portainer is running ok, yacht also.
Computers traffic may use the proxy to channel traffic through vpn. is there a specific need to run container on host network ? with bridge network, you have the docker network isolation in action, only exposed ports are accessibles.( not true when running in host mode)

Concerning traffic leaks, transmission is started only when the tunnel is up (no leak). As soon as the tunnel is down, openvpn fires an event that run tunnelDown.sh that kills transmission and the proxy if enabled. To be safe, through an ENV variable, the container can drop the default route (non vpn traffic) to avoid leaks. If I recall properly, DROP_DEFAULT_ROUTE=true drops default route.(need to be confirmed reading the docs)

docker-transmission-openvpn/transmission/start.sh

Line 70 in 76f7a2c

if [[ "true" = "$DROP_DEFAULT_ROUTE" ]]; then

Transmission may also use blocklists to ignore requests coming from unwanted hosts.

there is a script dnsleaktest that can be run from within the container to validate that there is no dns leak and what is your external ip.

[Louisdulac59]

i don't use the openmediavault plugin for openVPN. I configured the openVPN in the container setup.

I don't really understand all parameters, i use host just because it worked and it was by default ;) i should change it and turn on back the FW in the container ?

only the containers's(transmission) traffic have to use the vpn, that's why i've find this really nice container .

If i understand you well, i have to change the DROP_DEFAULT_ROUTE to true to be sure to have transmission traffic only up when the openVPN is ok ?

[edgd1er]

yes, drop default route will not allow to route traffic when vpn is down.
openvpn events should start and stop applications(transmission, privoxy) based on vpn connection status.
Transmission has a blocklist feature: https://github.com/transmission/transmission/wiki/Blocklists

[Louisdulac59]

thanks for the answers, i applyed all advices received here and all seems ok now ! TYVM