Container can not be accessed when run in a nested virtualised environment (Proxmon->Docker)

[Unwrapped3]

Is there a pinned issue for this?

• I have read the pinned issues and could not find my issue

Is there an existing or similar issue/discussion for this?

• I have searched the existing issues
• I have searched the existing discussions

Is there any comment in the documentation for this?

• I have read the documentation, especially the FAQ and Troubleshooting parts

Is this related to a provider?

• I have checked the provider repo for issues
• My issue is NOT related to a provider

Are you using the latest release?

• I am using the latest release

Have you tried using the dev branch latest?

• I have tried using dev branch

Docker compose config used

version: '3.3'
services:
transmission-openvpn:
sysctls:
- "net.ipv6.conf.all.disable_ipv6=0"
cap_add:
- NET_ADMIN
volumes:
- /home/vlad/transmission/transmission-data:/data
- /home/vlad/transmission/mullvad_config:/config
- /mnt/downloads:/downloads
environment:
- OPENVPN_PROVIDER=Mullvad
- OPENVPN_CONFIG=at_vie
- OPENVPN_USERNAME=long_number
- OPENVPN_PASSWORD=short_password
- LOCAL_NETWORK=192.168.0.0/16
logging:
driver: json-file
options:
max-size: 10m
ports:
- '9091:9091'
image: haugene/transmission-openvpn
restart: unless-stopped

Current Behavior

Web interface of transmission can not be accessed from LAN.

Expected Behavior

Web interface should be accessible via server_ip:9091.

How have you tried to solve the problem?

I followed the "Debug your setup" wiki and it works as expected up until Accessing Transmission Web UI. Unfortunately, I could not find anyone with a similar issue elsewhere so I decided to ask here.

Log output

Starting container with revision: 1103172
TRANSMISSION_HOME is currently set to: /config/transmission-home
Creating TUN device /dev/net/tun
Using OpenVPN provider: MULLVAD
Running with VPN_CONFIG_SOURCE auto
No bundled config script found for MULLVAD. Defaulting to external config
Downloading configs from https://github.com/haugene/vpn-configs-contrib/archive/main.zip into /tmp/tmp.SRqN359o2N
Extracting configs to /tmp/tmp.G8wt4ASouW
Found configs for MULLVAD in /tmp/tmp.G8wt4ASouW/vpn-configs-contrib-main/openvpn/mullvad, will replace current content in /etc/openvpn/mullvad
Cleanup: deleting /tmp/tmp.SRqN359o2N and /tmp/tmp.G8wt4ASouW
Starting OpenVPN using config at_vie.ovpn
Modifying /etc/openvpn/mullvad/at_vie.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
adding route to local network 192.168.0.0/16 via 172.23.0.1 dev eth0
2023-05-20 14:45:07 Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.
2023-05-20 14:45:07 OpenVPN 2.5.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 14 2022
2023-05-20 14:45:07 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
2023-05-20 14:45:07 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2023-05-20 14:45:07 TCP/UDP: Preserving recently used remote address: [AF_INET]146.70.116.194:53
2023-05-20 14:45:07 Socket Buffers: R=[212992->425984] S=[212992->425984]
2023-05-20 14:45:07 UDP link local: (not bound)
2023-05-20 14:45:07 UDP link remote: [AF_INET]146.70.116.194:53
2023-05-20 14:45:07 TLS: Initial packet from [AF_INET]146.70.116.194:53, sid=a0bbc541 ee6541c0
2023-05-20 14:45:07 VERIFY OK: depth=2, C=SE, ST=Gotaland, L=Gothenburg, O=Amagicom AB, OU=Mullvad, CN=Mullvad Root CA v2, emailAddress=[email protected]
2023-05-20 14:45:07 VERIFY OK: depth=1, C=SE, ST=Gotaland, O=Amagicom AB, OU=Mullvad, CN=Mullvad Intermediate CA v5, emailAddress=[email protected]
2023-05-20 14:45:07 VERIFY KU OK
2023-05-20 14:45:07 Validating certificate extended key usage
2023-05-20 14:45:07 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2023-05-20 14:45:07 VERIFY EKU OK
2023-05-20 14:45:07 VERIFY OK: depth=0, C=SE, ST=Gotaland, O=Amagicom AB, OU=Mullvad, CN=at-vie-ovpn-001.mullvad.net, emailAddress=[email protected]
2023-05-20 14:45:07 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1549', remote='link-mtu 1534'
2023-05-20 14:45:07 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, peer certificate: 4096 bit RSA, signature: RSA-SHA256
2023-05-20 14:45:07 [at-vie-ovpn-001.mullvad.net] Peer Connection Initiated with [AF_INET]146.70.116.194:53
2023-05-20 14:45:08 SENT CONTROL [at-vie-ovpn-001.mullvad.net]: 'PUSH_REQUEST' (status=1)
2023-05-20 14:45:09 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 10.7.0.1,redirect-gateway def1 bypass-dhcp,route-ipv6 0000::/2,route-ipv6 4000::/2,route-ipv6 8000::/2,route-ipv6 C000::/2,route-gateway 10.7.0.1,topology subnet,socket-flags TCP_NODELAY,ifconfig-ipv6 fdda:d0d0:cafe:53::1001/64 fdda:d0d0:cafe:53::,ifconfig 10.7.0.3 255.255.0.0,peer-id 1,cipher AES-256-GCM'
2023-05-20 14:45:09 OPTIONS IMPORT: --socket-flags option modified
2023-05-20 14:45:09 NOTE: setsockopt TCP_NODELAY=1 failed
2023-05-20 14:45:09 OPTIONS IMPORT: --ifconfig/up options modified
2023-05-20 14:45:09 OPTIONS IMPORT: route options modified
2023-05-20 14:45:09 OPTIONS IMPORT: route-related options modified
2023-05-20 14:45:09 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2023-05-20 14:45:09 OPTIONS IMPORT: peer-id set
2023-05-20 14:45:09 OPTIONS IMPORT: adjusting link_mtu to 1624
2023-05-20 14:45:09 OPTIONS IMPORT: data channel crypto options modified
2023-05-20 14:45:09 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2023-05-20 14:45:09 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2023-05-20 14:45:09 net_route_v4_best_gw query: dst 0.0.0.0
2023-05-20 14:45:09 net_route_v4_best_gw result: via 172.23.0.1 dev eth0
2023-05-20 14:45:09 ROUTE_GATEWAY 172.23.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:17:00:02
2023-05-20 14:45:09 GDG6: remote_host_ipv6=n/a
2023-05-20 14:45:09 net_route_v6_best_gw query: dst ::
2023-05-20 14:45:09 sitnl_send: rtnl: generic error (-101): Network is unreachable
2023-05-20 14:45:09 ROUTE6: default_gateway=UNDEF
2023-05-20 14:45:09 TUN/TAP device tun0 opened
2023-05-20 14:45:09 net_iface_mtu_set: mtu 1500 for tun0
2023-05-20 14:45:09 net_iface_up: set tun0 up
2023-05-20 14:45:09 net_addr_v4_add: 10.7.0.3/16 dev tun0
2023-05-20 14:45:09 net_iface_mtu_set: mtu 1500 for tun0
2023-05-20 14:45:09 net_iface_up: set tun0 up
2023-05-20 14:45:09 net_addr_v6_add: fdda:d0d0:cafe:53::1001/64 dev tun0
2023-05-20 14:45:09 net_route_v4_add: 146.70.116.194/32 via 172.23.0.1 dev [NULL] table 0 metric -1
2023-05-20 14:45:09 net_route_v4_add: 0.0.0.0/1 via 10.7.0.1 dev [NULL] table 0 metric -1
2023-05-20 14:45:09 net_route_v4_add: 128.0.0.0/1 via 10.7.0.1 dev [NULL] table 0 metric -1
2023-05-20 14:45:09 add_route_ipv6(::/2 -> fdda:d0d0:cafe:53:: metric -1) dev tun0
2023-05-20 14:45:09 net_route_v6_add: ::/2 via :: dev tun0 table 0 metric -1
2023-05-20 14:45:09 add_route_ipv6(4000::/2 -> fdda:d0d0:cafe:53:: metric -1) dev tun0
2023-05-20 14:45:09 net_route_v6_add: 4000::/2 via :: dev tun0 table 0 metric -1
2023-05-20 14:45:09 add_route_ipv6(8000::/2 -> fdda:d0d0:cafe:53:: metric -1) dev tun0
2023-05-20 14:45:09 net_route_v6_add: 8000::/2 via :: dev tun0 table 0 metric -1
2023-05-20 14:45:09 add_route_ipv6(c000::/2 -> fdda:d0d0:cafe:53:: metric -1) dev tun0
2023-05-20 14:45:09 net_route_v6_add: c000::/2 via :: dev tun0 table 0 metric -1
Up script executed with device=tun0 ifconfig_local=10.7.0.3
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 10.7.0.3

Transmission will run as

User name: root
User uid: 0
User gid: 0

Updating Transmission settings.json with values from env variables
Attempting to use existing settings.json for Transmission
Successfully used existing settings.json /config/transmission-home/settings.json
Overriding bind-address-ipv4 because TRANSMISSION_BIND_ADDRESS_IPV4 is set to 10.7.0.3
Overriding download-dir because TRANSMISSION_DOWNLOAD_DIR is set to /data/completed
Overriding incomplete-dir because TRANSMISSION_INCOMPLETE_DIR is set to /data/incomplete
Overriding rpc-password because TRANSMISSION_RPC_PASSWORD is set to [REDACTED]
Overriding rpc-port because TRANSMISSION_RPC_PORT is set to 9091
Overriding rpc-username because TRANSMISSION_RPC_USERNAME is set to
Overriding watch-dir because TRANSMISSION_WATCH_DIR is set to /data/watch
sed'ing True to true
STARTING TRANSMISSION
Transmission startup script complete.
2023-05-20 14:45:09 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-05-20 14:45:09 Initialization Sequence Completed

HW/SW Environment

- OS: Proxmox 7-4.3
- Docker: 20.10.21

Anything else?

I think the LOCAL_NETWORK= environment does not work properly. As you can see from the compose file, it is left on default 192.168.0.0\16. The client I am trying to access it is 192.168.0.60, which should be in the covered range.

I would highly appreciate any help!

[pkishino]

This is a support question, not an issue. LOCAL_NETWORK does work properly, but you need to properly configure your networking.
Proxmox works perfectly fine as host with this setup.
I suggest choosing a subnet in class C such as /24 instead, /16 seems unnecessary large..
check your other proxmox network settings.
Are you using a CT or VM?

[Unwrapped3]

Thanks for a quick reply! You are correct, the issue was with the CT I was running Docker on. I have created a new CT in Promox, copied the same compose file and it worked like a charm!

[GregHilston]

@Brightyfalls Can you elaborate a bit more on this for someone who is just getting started with Proxmox?

[Unwrapped3]

Hi Greg! Sure! In my case, the issue was connected to a corrupted container that I was trying to install Transmission on. After creating a new container and installing Transmission using docker compose, everything worked out as it was supposed to. Cheers!

[GregHilston]

Interesting, I unfortunately don't think this relates to my issue. For anyone coming here and still having problems, I recommend setting up, haugene/transmission-openvpn-proxy say like this:

  transmission-proxy:
    image: haugene/transmission-openvpn-proxy
    container_name: transmission-proxy
    links:
      - transmission:transmission
    ports:
      - 8080:8080
    restart: unless-stopped

I now can access the transmission UI by hitting port 8080