[NordVPN] Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)

[rojasneva]

Steps to reproduce:

I'm trying to create a docker container in synologyOS by running the following command

docker run -d --name=transmission-openvpn \
-p 8118:8118 \
-p 8888:8888 \
-p 9091:9091 \
-e PUID=1028 \
-e PGID=65537 \
-e TZ=America/Los_Angeles \
-e OPENVPN_PROVIDER=NORDVPN \
-e OPENVPN_USERNAME=<username_#2637> \
-e OPENVPN_PASSWORD=<password_#2637> \
-e NORDVPN_COUNTRY=US \
-e TRANSMISSION_DOWNLOAD_DIR=/data/complete \
-e TRANSMISSION_INCOMPLETE_DIR=/data/incomplete \
-e TRANSMISSION_WATCH_DIR=/data/watch \
-v /volume1/docker/transmission/:/data/ \
-v /volume1/docker/transmission/config/:/config/ \
--log-opt max-size=100m \
haugene/transmission-openvpn:latest

Expected behaviour:

Docker running correctly

Observed issue

Docker stopping automatically. This is showing in the log:

Best server : us9860.nordvpn.com
INFO: OVPN: Downloading config: us9860.nordvpn.com.ovpn
INFO: OVPN: Downloading from: https://downloads.nordcdn.com/configs/files/ovpn_tcp/servers/us9860.nordvpn.com.tcp.ovpn
OVPN: NORDVPN: selected: us9860.nordvpn.com, VPN_PROVIDER_HOME: /etc/openvpn/nordvpn
Starting OpenVPN using config us9860.nordvpn.com.ovpn
Modifying /etc/openvpn/nordvpn/us9860.nordvpn.com.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
2023-10-29 23:43:10 OpenVPN 2.5.5 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 14 2022
2023-10-29 23:43:10 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
2023-10-29 23:43:10 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2023-10-29 23:43:10 NOTE: --fast-io is disabled since we are not using UDP
2023-10-29 23:43:10 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2023-10-29 23:43:10 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2023-10-29 23:43:10 TCP/UDP: Preserving recently used remote address: [AF_INET]194.195.93.1:443
2023-10-29 23:43:10 Socket Buffers: R=[87380->87380] S=[16384->16384]
2023-10-29 23:43:10 Attempting to establish TCP connection with [AF_INET]194.195.93.1:443 [nonblock]
2023-10-29 23:43:10 TCP connection established with [AF_INET]194.195.93.1:443
2023-10-29 23:43:10 TCP_CLIENT link local: (not bound)
2023-10-29 23:43:10 TCP_CLIENT link remote: [AF_INET]194.195.93.1:443
2023-10-29 23:43:10 TLS: Initial packet from [AF_INET]194.195.93.1:443, sid=5491187d 754a2a1f
2023-10-29 23:43:10 VERIFY OK: depth=2, C=PA, O=NordVPN, CN=NordVPN Root CA
2023-10-29 23:43:10 VERIFY OK: depth=1, O=NordVPN, CN=NordVPN CA8
2023-10-29 23:43:10 VERIFY KU OK
2023-10-29 23:43:10 Validating certificate extended key usage
2023-10-29 23:43:10 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2023-10-29 23:43:10 VERIFY EKU OK
2023-10-29 23:43:10 VERIFY X509NAME OK: CN=us9860.nordvpn.com
2023-10-29 23:43:10 VERIFY OK: depth=0, CN=us9860.nordvpn.com
2023-10-29 23:43:10 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 4096 bit RSA, signature: RSA-SHA512
2023-10-29 23:43:10 [us9860.nordvpn.com] Peer Connection Initiated with [AF_INET]194.195.93.1:443
2023-10-29 23:43:11 SENT CONTROL [us9860.nordvpn.com]: 'PUSH_REQUEST' (status=1)
2023-10-29 23:43:11 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 103.86.96.100,dhcp-option DNS 103.86.99.100,explicit-exit-notify,comp-lzo no,route-gateway 10.7.1.1,topology subnet,ping 60,ping-restart 180,ifconfig 10.7.1.3 255.255.255.0,peer-id 0,cipher AES-256-CBC'
2023-10-29 23:43:11 OPTIONS IMPORT: timers and/or timeouts modified
2023-10-29 23:43:11 OPTIONS IMPORT: --explicit-exit-notify can only be used with --proto udp
2023-10-29 23:43:11 OPTIONS IMPORT: compression parms modified
2023-10-29 23:43:11 OPTIONS IMPORT: --ifconfig/up options modified
2023-10-29 23:43:11 OPTIONS IMPORT: route options modified
2023-10-29 23:43:11 OPTIONS IMPORT: route-related options modified
2023-10-29 23:43:11 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2023-10-29 23:43:11 OPTIONS IMPORT: peer-id set
2023-10-29 23:43:11 OPTIONS IMPORT: adjusting link_mtu to 1659
2023-10-29 23:43:11 OPTIONS IMPORT: data channel crypto options modified
2023-10-29 23:43:11 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2023-10-29 23:43:11 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
2023-10-29 23:43:11 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2023-10-29 23:43:11 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
2023-10-29 23:43:11 net_route_v4_best_gw query: dst 0.0.0.0
2023-10-29 23:43:11 net_route_v4_best_gw result: via 172.17.0.1 dev eth0
2023-10-29 23:43:11 ROUTE_GATEWAY 172.17.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:11:00:04
2023-10-29 23:43:11 ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)
2023-10-29 23:43:11 Exiting due to fatal error

It doesn't seem to be an authorization issue. I can't tell from the log why it is raising a fatal error. This was working back in July. Any advice would be appreciated.

[edgd1er]

Hi,

I suspect a synology peculiar way of handling docker to be the cause of your problem.
You may either mount /dev/tun in the container or set CREATE_TUN_DEVICE to true
https://haugene.github.io/docker-transmission-openvpn/config-options/

[rojasneva]

Thanks @edgd1er, this led me to find the solution in #1542