Can't access WebUI and RPC on a dedicated remote server (hetzner) #2175

enchained · 2022-02-02T15:06:54Z

enchained
Feb 2, 2022

I'm trying to access transmission_openvpn on remote server from a home PC.
My server host OS is Arch Linux.
Web UI says ERR_CONNECTION_TIMED_OUT, RPC (Transmission Remote GUI) says Host not found. Documentation only mentions LAN and setting up router, I found nothing about remote setups.

I'm not sure what to put in LOCAL_NETWORK with a remote server, I don't know what LAN IP range my server is using (is there a proper way to find out? ifconfig gives quite a lot of different IPs), and I am not on the same LAN as the server anyway.

Compose:

version: '3.3'
services:
    transmission-openvpn:
        cap_add:
            - NET_ADMIN
        container_name: transmission-openvpn
        volumes:
            - '/docker/appdata/transmission-openvpn:/data'
        environment:
            - PUID=850
            - PGID=850
            - GLOBAL_APPLY_PERMISSIONS=false
            - OPENVPN_PROVIDER=NORDVPN
            - OPENVPN_USERNAME=***
            - OPENVPN_PASSWORD=***
            - NORDVPN_COUNTRY=CH
            - NORDVPN_CATEGORY=legacy_p2p
            - LOCAL_NETWORK=192.168.0.0/16
        logging:
            driver: json-file
            options:
                max-size: 10m
        ports:
            - '9091:9091'
        image: haugene/transmission-openvpn

Container logs:

Starting container with revision: 20877f1b168b6ff27fc58aeef40756572c562d47
Creating TUN device /dev/net/tun
Using OpenVPN provider: NORDVPN
Running with VPN_CONFIG_SOURCE auto
Provider NORDVPN has a bundled setup script. Defaulting to internal config
Executing setup script for NORDVPN
2022-02-02 17:53:11 Checking curl installation
2022-02-02 17:53:11 Removing existing configs
2022-02-02 17:53:11 Selecting the best server...
2022-02-02 17:53:11 Searching for technology: openvpn_udp
2022-02-02 17:53:11 Best server : fi161.nordvpn.com
2022-02-02 17:53:11 Downloading config: default.ovpn
2022-02-02 17:53:11 Downloading from: https://downloads.nordcdn.com/configs/files/ovpn_udp/servers/fi161.nordvpn.com.udp.ovpn
2022-02-02 17:53:11 Selecting the best server...
2022-02-02 17:53:11 Searching for country : CH (209)
2022-02-02 17:53:11 Searching for technology: openvpn_udp
2022-02-02 17:53:11 Best server : ch340.nordvpn.com
2022-02-02 17:53:11 Downloading config: ch340.nordvpn.com.ovpn
2022-02-02 17:53:11 Downloading from: https://downloads.nordcdn.com/configs/files/ovpn_udp/servers/ch340.nordvpn.com.udp.ovpn
Starting OpenVPN using config ch340.nordvpn.com.ovpn
Modifying /etc/openvpn/nordvpn/ch340.nordvpn.com.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Setting OpenVPN credentials...
Wed Feb  2 17:53:14 2022 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 19 2021
Wed Feb  2 17:53:14 2022 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Wed Feb  2 17:53:14 2022 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Feb  2 17:53:14 2022 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Feb  2 17:53:14 2022 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Feb  2 17:53:14 2022 TCP/UDP: Preserving recently used remote address: [AF_INET]178.239.165.26:1194
Wed Feb  2 17:53:14 2022 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Feb  2 17:53:14 2022 UDP link local: (not bound)
Wed Feb  2 17:53:14 2022 UDP link remote: [AF_INET]178.239.165.26:1194
Wed Feb  2 17:53:14 2022 TLS: Initial packet from [AF_INET]178.239.165.26:1194, sid=25edf2a6 f39cc338
Wed Feb  2 17:53:14 2022 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Feb  2 17:53:14 2022 VERIFY OK: depth=2, C=PA, O=NordVPN, CN=NordVPN Root CA
Wed Feb  2 17:53:14 2022 VERIFY OK: depth=1, C=PA, O=NordVPN, CN=NordVPN CA6
Wed Feb  2 17:53:14 2022 VERIFY KU OK
Wed Feb  2 17:53:14 2022 Validating certificate extended key usage
Wed Feb  2 17:53:14 2022 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Feb  2 17:53:14 2022 VERIFY EKU OK
Wed Feb  2 17:53:14 2022 VERIFY OK: depth=0, CN=ch340.nordvpn.com
Wed Feb  2 17:53:14 2022 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 4096 bit RSA
Wed Feb  2 17:53:14 2022 [ch340.nordvpn.com] Peer Connection Initiated with [AF_INET]178.239.165.26:1194
Wed Feb  2 17:53:15 2022 SENT CONTROL [ch340.nordvpn.com]: 'PUSH_REQUEST' (status=1)
Wed Feb  2 17:53:15 2022 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 103.86.96.100,dhcp-option DNS 103.86.99.100,sndbuf 524288,rcvbuf 524288,explicit-exit-notify,comp-lzo no,route-gateway 10.8.3.1,topology subnet,ping 60,ping-restart 180,ifconfig 10.8.3.9 255.255.255.0,peer-id 8,cipher AES-256-GCM'
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: timers and/or timeouts modified
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: explicit notify parm(s) modified
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: compression parms modified
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Wed Feb  2 17:53:15 2022 Socket Buffers: R=[212992->425984] S=[212992->425984]
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: --ifconfig/up options modified
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: route options modified
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: route-related options modified
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: peer-id set
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: adjusting link_mtu to 1657
Wed Feb  2 17:53:15 2022 OPTIONS IMPORT: data channel crypto options modified
Wed Feb  2 17:53:15 2022 Data Channel: using negotiated cipher 'AES-256-GCM'
Wed Feb  2 17:53:15 2022 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Wed Feb  2 17:53:15 2022 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Wed Feb  2 17:53:15 2022 ROUTE_GATEWAY 192.168.64.1/255.255.240.0 IFACE=eth0 HWADDR=02:42:c0:a8:40:02
Wed Feb  2 17:53:15 2022 TUN/TAP device tun0 opened
Wed Feb  2 17:53:15 2022 TUN/TAP TX queue length set to 100
Wed Feb  2 17:53:15 2022 /sbin/ip link set dev tun0 up mtu 1500
Wed Feb  2 17:53:15 2022 /sbin/ip addr add dev tun0 10.8.3.9/24 broadcast 10.8.3.255
Wed Feb  2 17:53:15 2022 /etc/openvpn/tunnelUp.sh tun0 1500 1585 10.8.3.9 255.255.255.0 init
Up script executed with tun0 1500 1585 10.8.3.9 255.255.255.0 init
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 10.8.3.9
Updating Transmission settings.json with values from env variables
Using existing settings.json for Transmission /data/transmission-home/settings.json
Overriding bind-address-ipv4 because TRANSMISSION_BIND_ADDRESS_IPV4 is set to 10.8.3.9
Overriding download-dir because TRANSMISSION_DOWNLOAD_DIR is set to /data/completed
Overriding incomplete-dir because TRANSMISSION_INCOMPLETE_DIR is set to /data/incomplete
Overriding rpc-port because TRANSMISSION_RPC_PORT is set to 9091
Overriding watch-dir because TRANSMISSION_WATCH_DIR is set to /data/watch
sed'ing True to true
Enforcing ownership on transmission config directories
Applying permissions to transmission config directories
-------------------------------------
Transmission will run as
-------------------------------------
User name:   abc
User uid:    850
User gid:    850
-------------------------------------
STARTING TRANSMISSION
Transmission startup script complete.
Wed Feb  2 17:53:15 2022 /sbin/ip route add 178.239.165.26/32 via 192.168.64.1
Wed Feb  2 17:53:15 2022 /sbin/ip route add 0.0.0.0/1 via 10.8.3.1
Wed Feb  2 17:53:15 2022 /sbin/ip route add 128.0.0.0/1 via 10.8.3.1
Wed Feb  2 17:53:15 2022 Initialization Sequence Completed

route command output:

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    0      0        0 enp7s0
_gateway        0.0.0.0         255.255.255.255 UH    0      0        0 enp7s0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-c4ead374402c
172.20.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-3dc2c4524615
172.21.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-cc9eda268dcb
172.22.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-99a05f560ec8
172.23.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-0b172fbc9856
172.24.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-4c26b1cd2b32
172.25.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-c2bdad6bce0c
172.26.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-409e81740436
172.27.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-fe544d2fad4f
172.28.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-843796e1a73d
172.29.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-63c8cc998c62
172.30.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-34bf42034d2f
172.31.0.0      0.0.0.0         255.255.0.0     U     0      0        0 br-89e0ac1818f0
192.168.0.0     0.0.0.0         255.255.240.0   U     0      0        0 br-6853539f80bd
192.168.16.0    0.0.0.0         255.255.240.0   U     0      0        0 br-9f70b7a0d34c
192.168.32.0    0.0.0.0         255.255.240.0   U     0      0        0 br-4e35cbc0edd3
192.168.48.0    0.0.0.0         255.255.240.0   U     0      0        0 br-38753a7bb782
192.168.64.0    0.0.0.0         255.255.240.0   U     0      0        0 br-7d323bf68d91

Answered by enchained

Feb 6, 2022

Not sure what I've done, but by disabling "rpc-whitelist-enabled" back, removing the LOCAL_NETWORK variable completely, and bringing back the sidecar proxy to compose, I was able to get it working via the port I chose for proxy, both for WebUI, RPC for Transmission Remote GUI and sonarr (the latter also can work with the 9091 port if I map it to the transmission-openvpn in compose, but the proxy itself works without it mapped).

Then I also erased the mapped data folder to test with the default settings.json. After launching it anew with this compose, it still worked with the proxy port:

version: '3.3'
services:
    transmission-openvpn:
        cap_add:
            - NET_ADMIN
        con…

View full answer

enchained · 2022-02-02T20:53:27Z

enchained
Feb 2, 2022
Author

I tried the proxy option, but RPC does not connect to proxy, only the WebUI does.
Compose with proxy:

version: '3.3'
services:
    transmission-openvpn:
        cap_add:
            - NET_ADMIN
        container_name: transmission-openvpn
        volumes:
            - '/docker/appdata/transmission-openvpn:/data'
        environment:
            - PUID=850
            - PGID=850
            - GLOBAL_APPLY_PERMISSIONS=false
            - OPENVPN_PROVIDER=NORDVPN
            - OPENVPN_USERNAME=***
            - OPENVPN_PASSWORD=***
            - NORDVPN_COUNTRY=CH
            - NORVPN_CATEGORY=legacy_p2p
            - LOCAL_NETWORK=192.168.0.0/16
        logging:
            driver: json-file
            options:
                max-size: 10m
        ports:
            - '9091:9091'
        image: haugene/transmission-openvpn
    transmission-openvpn-proxy:
        container_name: transmission-openvpn-proxy
        links:
            - 'transmission-openvpn:transmission'
        ports:
            - '8080:8080'
        image: haugene/transmission-openvpn-proxy

I also tried to set LOCAL_NETWORK=client_ip/32, where client_ip is my home network public IP (I pay my internet provider for a static one). It works with WebUI, but also doesn't work with RPC, which I need much more often.
Settings I tried with Transmission Remote GUI for RPC (in all the combinations):

Remote host: http://mydomain.com | http://myserver_public_ip
Port: 9091 | 8080
RPC path: /transmission/rpc | /transmission/rpc/

Will appreciate any help!

4 replies

pkishino Feb 2, 2022
Collaborator

I suspect you will need to fix your rpc-whitelist
https://github.com/transmission/transmission/wiki/Editing-Configuration-Files#rpc

enchained Feb 3, 2022
Author

Thanks. Looks like it's "rpc-whitelist-enabled": false, by default. It also has: "rpc-whitelist": "127.0.0.1,::1",, not sure what the ::1 means and where do I append my client IP, will try to figure this out.

But the main issue still stands - I would prefer not to limit access just to a single client IP. Are there any ways to achieve this, or I will have to use LOCAL_NETWORK=client_ip/32 indefinitely?

enchained Feb 3, 2022
Author

Looks like ::1 is just IPv6 version of 127.0.0.1. I tried those settings:

"rpc-whitelist": "127.0.0.1,::1,client_ip",
"rpc-whitelist-enabled": true,

Sadly, RPC still doesn't work.

enchained Feb 3, 2022
Author

Swapping Remote host from domain name to public IP of the server helped to connect via RPC from the client network.

But after enabling rpc-whitelist, I encountered another issue. Containers like sonarr and radarr can't access transmission anymore. And proxy doesn't either - it gives error 403, referring to the whitelist spefically. I hoped that 127.0.0.1 in the whitelist would cover them since they use host network, but looks like I might have to look up their internal IPs or something. All of this makes limiting to specific client network even less appealing.

I got some IP after executing hostname -i inside the sonarr container, but adding it to the rpc-whitelist did not fix things.

enchained · 2022-02-06T02:13:45Z

enchained
Feb 6, 2022
Author

Not sure what I've done, but by disabling "rpc-whitelist-enabled" back, removing the LOCAL_NETWORK variable completely, and bringing back the sidecar proxy to compose, I was able to get it working via the port I chose for proxy, both for WebUI, RPC for Transmission Remote GUI and sonarr (the latter also can work with the 9091 port if I map it to the transmission-openvpn in compose, but the proxy itself works without it mapped).

Then I also erased the mapped data folder to test with the default settings.json. After launching it anew with this compose, it still worked with the proxy port:

version: '3.3'
services:
    transmission-openvpn:
        cap_add:
            - NET_ADMIN
        container_name: transmission-openvpn
        image: haugene/transmission-openvpn
        volumes:
            - '/docker/appdata/transmission-openvpn:/data'
        environment:
            - PUID=850
            - PGID=850
            - GLOBAL_APPLY_PERMISSIONS=false
            - OPENVPN_PROVIDER=NORDVPN
            - OPENVPN_USERNAME=***
            - OPENVPN_PASSWORD=***
            - NORDVPN_COUNTRY=CH
            - NORDVPN_CATEGORY=legacy_p2p
        logging:
            driver: json-file
            options:
                max-size: 10m
    transmission-openvpn-proxy:
        container_name: transmission-openvpn-proxy
        links:
            - 'transmission-openvpn:transmission'
        ports:
            - '32111:8080'
        image: haugene/transmission-openvpn-proxy

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Can't access WebUI and RPC on a dedicated remote server (hetzner) #2175

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Can't access WebUI and RPC on a dedicated remote server (hetzner) #2175

Uh oh!

Uh oh!

enchained Feb 2, 2022

Replies: 2 comments · 4 replies

Uh oh!

enchained Feb 2, 2022 Author

Uh oh!

pkishino Feb 2, 2022 Collaborator

Uh oh!

enchained Feb 3, 2022 Author

Uh oh!

enchained Feb 3, 2022 Author

Uh oh!

enchained Feb 3, 2022 Author

Uh oh!

enchained Feb 6, 2022 Author

enchained
Feb 2, 2022

Replies: 2 comments 4 replies

enchained
Feb 2, 2022
Author

pkishino Feb 2, 2022
Collaborator

enchained Feb 3, 2022
Author

enchained Feb 3, 2022
Author

enchained Feb 3, 2022
Author

enchained
Feb 6, 2022
Author