Cannot access to Transmission GUI even if openvpn custom provider configuration seems to be OK #2658

gtrhayrug · 2023-07-13T14:15:10Z

gtrhayrug
Jul 13, 2023

Hi,

After a wrong topic (seems to be an issue, but it is a configuration issue, thanks @pkishino, i'm starting a new discussion.

I'm moving from 2.X to last version.

Thanks to #1397 and last configuration, my previous configuration works.
In parallel, i've tried to use openvpn alone with the ovpn file, again, OK.

I'm trying to use the last version haugene container with this file. My network is 192.168.2.X so i've modified the line from original configuration 192.168.0.0 to 192.168.2.0/24.
The log reports VPN connection OK and transmission starts but i've not an access to web gui. I've added dns options and with/or without, it is the same.

I'm seen the line in the log which i don't understand:
/etc/openvpn/start.sh: line 51: 10 Aborted (core dumped) nslookup ${HEALTH_CHECK_HOST:-"google.com"} > /dev/null 2>&1 WARNING: initial DNS resolution test failed Creating TUN device /dev/net/tun

My stack:

version:'3.3'
services:
    transmission-openvpn:
        image: haugene/transmission-openvpn   
        cap_add:
            - NET_ADMIN
        volumes:
            - '/mnt/QNAP/Transmission/:/data'
            - '/mnt/QNAP/OpenVPN/:/etc/openvpn/custom/'
        environment:
            - PUID=1000
            - PGID=1000
            - CREATE_TUN_DEVICE=true
            - OPENVPN_PROVIDER=custom
            - OPENVPN_CONFIG=openvpn
            - OPENVPN_USERNAME=XXXXXXX
            - OPENVPN_PASSWORD=XXXXXXXXXX
            - LOCAL_NETWORK=192.168.2.0/24
            - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
            - TZ=Europe/Paris
 #           - TRANSMISSION_DOWNLOAD_QUEUE_ENABLED=true
 #           - TRANSMISSION_DOWNLOAD_QUEUE_SIZE=20
 #           - TRANSMISSION_RPC_AUTHENTICATION_REQUIRED=true
 #           - TRANSMISSION_RPC_HOST_WHITELIST="127.0.0.1,192.168.*.*"
 #           - TRANSMISSION_RPC_USERNAME=xxx
 #           - TRANSMISSION_RPC_PASSWORD=xxxx
 #           - TRANSMISSION_WEB_UI=transmission-web-control
 #           - TRANSMISSION_SPEED_LIMIT_UP=1000
 #           - TRANSMISSION_SPEED_LIMIT_DOWN=1000
 #           - TRANSMISSION_SPEED_LIMIT_DOWN_ENABLED=true
 #           - TRANSMISSION_WATCH_DIR_ENABLED=true
 #           - TRANSMISSION_RATIO_LIMIT=2
 #           - TRANSMISSION_LIMIT_ENABLED=true
        logging:
          driver: json-file
          options:
             max-size: 10m
        ports:
            - '9091:9091'
        restart: unless-stopped
#        dns:
#            - '8.8.8.8'
#            - `'8.8.4.4'`

But the log reports:

WARNING: initial DNS resolution test failed
Creating TUN device /dev/net/tun
Using OpenVPN provider: CUSTOM
Modifying /etc/openvpn/custom/default.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
adding route to local network 192.168.0.0/24 via 172.25.0.1 dev eth0
2023-07-13 16:13:16 DEPRECATED OPTION: ncp-disable. Disabling cipher negotiation is a deprecated debug feature that will be removed in OpenVPN 2.6
2023-07-13 16:13:16 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2023-07-13 16:13:16 WARNING: file '/etc/openvpn/custom/client.key' is group or others accessible
2023-07-13 16:13:16 OpenVPN 2.5.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 14 2022
2023-07-13 16:13:16 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
2023-07-13 16:13:16 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2023-07-13 16:13:16 TCP/UDP: Preserving recently used remote address: [AF_INET]82.102.26.212:443
2023-07-13 16:13:16 Socket Buffers: R=[212992->212992] S=[212992->212992]
2023-07-13 16:13:16 UDP link local: (not bound)
2023-07-13 16:13:16 UDP link remote: [AF_INET]82.102.26.212:443
2023-07-13 16:13:16 TLS: Initial packet from [AF_INET]82.102.26.212:443, sid=e9dd37e1 9dfcbeac
2023-07-13 16:13:16 VERIFY OK: depth=1, C=RO, L=Bucharest, O=CyberGhost S.A., CN=CyberGhost Root CA, [email protected]
2023-07-13 16:13:16 VERIFY KU OK
2023-07-13 16:13:16 Validating certificate extended key usage
2023-07-13 16:13:16 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2023-07-13 16:13:16 VERIFY EKU OK
2023-07-13 16:13:16 VERIFY OK: depth=0, CN=barcelona-rack406.nodes.gen4.ninja
2023-07-13 16:13:16 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1569', remote='link-mtu 1553'
2023-07-13 16:13:16 WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
2023-07-13 16:13:16 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 4096 bit RSA, signature: RSA-SHA256
2023-07-13 16:13:16 [barcelona-rack406.nodes.gen4.ninja] Peer Connection Initiated with [AF_INET]82.102.26.212:443
2023-07-13 16:13:16 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route-ipv6 2000::/3,dhcp-option DNS 10.0.0.243,route-gateway 10.2.4.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.2.4.184 255.255.255.0,peer-id 11'
2023-07-13 16:13:16 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2023-07-13 16:13:16 OPTIONS IMPORT: timers and/or timeouts modified
2023-07-13 16:13:16 OPTIONS IMPORT: --ifconfig/up options modified
2023-07-13 16:13:16 OPTIONS IMPORT: route options modified
2023-07-13 16:13:16 OPTIONS IMPORT: route-related options modified
2023-07-13 16:13:16 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2023-07-13 16:13:16 OPTIONS IMPORT: peer-id set
2023-07-13 16:13:16 OPTIONS IMPORT: adjusting link_mtu to 1624
2023-07-13 16:13:16 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2023-07-13 16:13:16 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
2023-07-13 16:13:16 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2023-07-13 16:13:16 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
2023-07-13 16:13:16 net_route_v4_best_gw query: dst 0.0.0.0
2023-07-13 16:13:16 net_route_v4_best_gw result: via 172.25.0.1 dev eth0
2023-07-13 16:13:16 ROUTE_GATEWAY 172.25.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:19:00:02
2023-07-13 16:13:16 GDG6: remote_host_ipv6=n/a
2023-07-13 16:13:16 net_route_v6_best_gw query: dst ::
2023-07-13 16:13:16 net_route_v6_best_gw result: via :: dev lo
2023-07-13 16:13:16 ROUTE6_GATEWAY :: ON_LINK IFACE=lo
2023-07-13 16:13:16 TUN/TAP device tun0 opened
2023-07-13 16:13:16 net_iface_mtu_set: mtu 1500 for tun0
2023-07-13 16:13:16 net_iface_up: set tun0 up
2023-07-13 16:13:16 net_addr_v4_add: 10.2.4.184/24 dev tun0
2023-07-13 16:13:21 net_route_v4_add: 82.102.26.212/32 via 172.25.0.1 dev [NULL] table 0 metric -1
2023-07-13 16:13:21 net_route_v4_add: 0.0.0.0/1 via 10.2.4.1 dev [NULL] table 0 metric -1
2023-07-13 16:13:21 net_route_v4_add: 128.0.0.0/1 via 10.2.4.1 dev [NULL] table 0 metric -1
2023-07-13 16:13:21 WARNING: OpenVPN was configured to add an IPv6 route. However, no IPv6 has been configured for tun0, therefore the route installation may fail or may not work as expected.
2023-07-13 16:13:21 add_route_ipv6(2000::/3 -> :: metric -1) dev tun0
2023-07-13 16:13:21 net_route_v6_add: 2000::/3 via :: dev tun0 table 0 metric -1
Up script executed with device=tun0 ifconfig_local=10.2.4.184
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 10.2.4.184
Enforcing ownership on transmission directories
Applying permissions to transmission directories
Setting owner for transmission paths to 1000:1000
Setting permissions for download and incomplete directories
umask: 2
Directories: 775
Files: 664
Setting permission for watch directory (775) and its files (664)
-------------------------------------
Transmission will run as
-------------------------------------
User name:   abc
User uid:    1000
User gid:    1000
-------------------------------------
Updating Transmission settings.json with values from env variables
Attempting to use existing settings.json for Transmission
Successfully used existing settings.json /config/transmission-home/settings.json
Overriding bind-address-ipv4 because TRANSMISSION_BIND_ADDRESS_IPV4 is set to 10.2.4.184
Overriding download-dir because TRANSMISSION_DOWNLOAD_DIR is set to /data/completed
Overriding incomplete-dir because TRANSMISSION_INCOMPLETE_DIR is set to /data/incomplete
Overriding rpc-password because TRANSMISSION_RPC_PASSWORD is set to [REDACTED]
Overriding rpc-port because TRANSMISSION_RPC_PORT is set to 9091
Overriding rpc-username because TRANSMISSION_RPC_USERNAME is set to 
Overriding watch-dir because TRANSMISSION_WATCH_DIR is set to /data/watch
sed'ing True to true
STARTING TRANSMISSION
Transmission startup script complete.
2023-07-13 16:13:21 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-07-13 16:13:21 Initialization Sequence Completed

pkishino · 2023-07-14T01:08:20Z

pkishino
Jul 14, 2023
Collaborator

log above still shows "adding route to local network 192.168.0.0/24 via 172.25.0.1 dev eth0"
instead of 192.168.2.0/24 ..
so that is why you can't access it..check that the stack is updated

1 reply

gtrhayrug Jul 14, 2023
Author

Sorry, i've copy the wrong log. I've tried several configuration.
It is the same with 192.168.2.0/24.

/etc/openvpn/start.sh: line 51:    10 Aborted                 (core dumped) nslookup ${HEALTH_CHECK_HOST:-"google.com"} > /dev/null 2>&1
WARNING: initial DNS resolution test failed
Creating TUN device /dev/net/tun
Using OpenVPN provider: CUSTOM
Modifying /etc/openvpn/custom/default.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
adding route to local network 192.168.2.0/24 via 172.25.0.1 dev eth0
2023-07-14 09:15:40 DEPRECATED OPTION: ncp-disable. Disabling cipher negotiation is a deprecated debug feature that will be removed in OpenVPN 2.6
2023-07-14 09:15:40 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2023-07-14 09:15:40 WARNING: file '/etc/openvpn/custom/client.key' is group or others accessible
2023-07-14 09:15:40 OpenVPN 2.5.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 14 2022
2023-07-14 09:15:40 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
2023-07-14 09:15:40 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2023-07-14 09:15:40 TCP/UDP: Preserving recently used remote address: [AF_INET]196.245.54.37:443
2023-07-14 09:15:40 Socket Buffers: R=[212992->212992] S=[212992->212992]
2023-07-14 09:15:40 UDP link local: (not bound)
2023-07-14 09:15:40 UDP link remote: [AF_INET]196.245.54.37:443
2023-07-14 09:15:41 TLS: Initial packet from [AF_INET]196.245.54.37:443, sid=3abe6289 8e421ca2
2023-07-14 09:15:41 VERIFY OK: depth=1, C=RO, L=Bucharest, O=CyberGhost S.A., CN=CyberGhost Root CA, [email protected]
2023-07-14 09:15:41 VERIFY KU OK
2023-07-14 09:15:41 Validating certificate extended key usage
2023-07-14 09:15:41 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2023-07-14 09:15:41 VERIFY EKU OK
2023-07-14 09:15:41 VERIFY OK: depth=0, CN=valencia-rack403.nodes.gen4.ninja
2023-07-14 09:15:41 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1569', remote='link-mtu 1553'
2023-07-14 09:15:41 WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
2023-07-14 09:15:41 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 4096 bit RSA, signature: RSA-SHA256
2023-07-14 09:15:41 [valencia-rack403.nodes.gen4.ninja] Peer Connection Initiated with [AF_INET]196.245.54.37:443
2023-07-14 09:15:41 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route-ipv6 2000::/3,dhcp-option DNS 10.0.0.243,route-gateway 10.7.4.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.7.4.30 255.255.255.0,peer-id 6'
2023-07-14 09:15:41 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2023-07-14 09:15:41 OPTIONS IMPORT: timers and/or timeouts modified
2023-07-14 09:15:41 OPTIONS IMPORT: --ifconfig/up options modified
2023-07-14 09:15:41 OPTIONS IMPORT: route options modified
2023-07-14 09:15:41 OPTIONS IMPORT: route-related options modified
2023-07-14 09:15:41 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2023-07-14 09:15:41 OPTIONS IMPORT: peer-id set
2023-07-14 09:15:41 OPTIONS IMPORT: adjusting link_mtu to 1624
2023-07-14 09:15:41 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2023-07-14 09:15:41 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
2023-07-14 09:15:41 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2023-07-14 09:15:41 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
2023-07-14 09:15:41 net_route_v4_best_gw query: dst 0.0.0.0
2023-07-14 09:15:41 net_route_v4_best_gw result: via 172.25.0.1 dev eth0
2023-07-14 09:15:41 ROUTE_GATEWAY 172.25.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:19:00:02
2023-07-14 09:15:41 GDG6: remote_host_ipv6=n/a
2023-07-14 09:15:41 net_route_v6_best_gw query: dst ::
2023-07-14 09:15:41 net_route_v6_best_gw result: via :: dev lo
2023-07-14 09:15:41 ROUTE6_GATEWAY :: ON_LINK IFACE=lo
2023-07-14 09:15:41 TUN/TAP device tun0 opened
2023-07-14 09:15:41 net_iface_mtu_set: mtu 1500 for tun0
2023-07-14 09:15:41 net_iface_up: set tun0 up
2023-07-14 09:15:41 net_addr_v4_add: 10.7.4.30/24 dev tun0
2023-07-14 09:15:46 net_route_v4_add: 196.245.54.37/32 via 172.25.0.1 dev [NULL] table 0 metric -1
2023-07-14 09:15:46 net_route_v4_add: 0.0.0.0/1 via 10.7.4.1 dev [NULL] table 0 metric -1
2023-07-14 09:15:46 net_route_v4_add: 128.0.0.0/1 via 10.7.4.1 dev [NULL] table 0 metric -1
2023-07-14 09:15:46 WARNING: OpenVPN was configured to add an IPv6 route. However, no IPv6 has been configured for tun0, therefore the route installation may fail or may not work as expected.
2023-07-14 09:15:46 add_route_ipv6(2000::/3 -> :: metric -1) dev tun0
2023-07-14 09:15:46 net_route_v6_add: 2000::/3 via :: dev tun0 table 0 metric -1
Up script executed with device=tun0 ifconfig_local=10.7.4.30
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 10.7.4.30
Enforcing ownership on transmission directories
Applying permissions to transmission directories
Setting owner for transmission paths to 1000:1000
Setting permissions for download and incomplete directories
umask: 2
Directories: 775
Files: 664
Setting permission for watch directory (775) and its files (664)
-------------------------------------
Transmission will run as
-------------------------------------
User name:   abc
User uid:    1000
User gid:    1000
-------------------------------------
Updating Transmission settings.json with values from env variables
Attempting to use existing settings.json for Transmission
Successfully used existing settings.json /config/transmission-home/settings.json
Overriding bind-address-ipv4 because TRANSMISSION_BIND_ADDRESS_IPV4 is set to 10.7.4.30
Overriding download-dir because TRANSMISSION_DOWNLOAD_DIR is set to /data/completed
Overriding incomplete-dir because TRANSMISSION_INCOMPLETE_DIR is set to /data/incomplete
Overriding rpc-password because TRANSMISSION_RPC_PASSWORD is set to [REDACTED]
Overriding rpc-port because TRANSMISSION_RPC_PORT is set to 9091
Overriding rpc-username because TRANSMISSION_RPC_USERNAME is set to 
Overriding watch-dir because TRANSMISSION_WATCH_DIR is set to /data/watch
sed'ing True to true
STARTING TRANSMISSION
Transmission startup script complete.
2023-07-14 09:15:46 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-07-14 09:15:46 Initialization Sequence Completed

edgd1er · 2023-07-14T05:57:43Z

edgd1er
Jul 14, 2023

I couldn't say better:
WARNING: initial DNS resolution test failedis the consequence of the local network not being properly set.
docker compose up may help.

1 reply

gtrhayrug Jul 14, 2023
Author

I saw this :
2023-07-14 09:15:46 WARNING: OpenVPN was configured to add an IPv6 route. However, no IPv6 has been configured for tun0, therefore the route installation may fail or may not work as expected. 2023-07-14 09:15:46 add_route_ipv6(2000::/3 -> :: metric -1) dev tun0 2023-07-14 09:15:46 net_route_v6_add: 2000::/3 via :: dev tun0 table 0 metric -1

I don't understand why docker compose helps ?

I have other dockers on portainer which works perfectly as jackett per example.

https://i.imgur.com/xDkTzgG.png

gtrhayrug · 2023-07-14T08:00:35Z

gtrhayrug
Jul 14, 2023
Author

OK, solved.
I've added:

        sysctls:
            - "net.ipv6.conf.all.disable_ipv6=0"
        security_opt:
            - seccomp:unconfined

which removes IPv6 alert and now dns works.
In parallel, i've modified my resolv.conf to use cloudfare dns instead of pihole.

2 replies

edgd1er Jul 14, 2023

when using pihole, all containers that require dns have to be in the same docker's network.
say you pihole container is in a network named pihole_net, transmission should be attached to pihole_net also.

concerning docker-compose, as the yml was a docker compose file, I supposed you were using docker compose.

gtrhayrug Jul 14, 2023
Author

Pihole is not in docker. It is a dedicated VM out of the VM which loads docker where transmission/jackett are installed.

Uh oh!

Cannot access to Transmission GUI even if openvpn custom provider configuration seems to be OK #2658

Uh oh!

Uh oh!

gtrhayrug Jul 13, 2023

Replies: 3 comments · 4 replies

Uh oh!

pkishino Jul 14, 2023 Collaborator

Uh oh!

Uh oh!

gtrhayrug Jul 14, 2023 Author

Uh oh!

edgd1er Jul 14, 2023

Uh oh!

gtrhayrug Jul 14, 2023 Author

Uh oh!

gtrhayrug Jul 14, 2023 Author

Uh oh!

edgd1er Jul 14, 2023

Uh oh!

gtrhayrug Jul 14, 2023 Author

gtrhayrug
Jul 13, 2023

Replies: 3 comments 4 replies

pkishino
Jul 14, 2023
Collaborator

gtrhayrug Jul 14, 2023
Author

edgd1er
Jul 14, 2023

gtrhayrug Jul 14, 2023
Author

gtrhayrug
Jul 14, 2023
Author

gtrhayrug Jul 14, 2023
Author