/dev/net/tun error - Proxmox LXC Docker

[chop249]

Trying to get this up and running in a ProxMox LXC using Docker. I've tried Deb 11 both in privileged and unprivileged LXCs. I keep running into errors with the /dev/net/tun. Here is my docker-compose.yml:

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    # line above must be uncommented to allow external containers to connect. See https://github.com/qdm12/gluetun/wiki/Connect-a-contain>
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
    volumes:
      - /docker/gluetun:/gluetun
    environment:
      # See https://github.com/qdm12/gluetun/wiki
      - VPN_SERVICE_PROVIDER=vpn unlimited
      - VPN_TYPE=openvpn
      # OpenVPN:
      - OPENVPN_USER=<USER>
      - OPENVPN_PASSWORD=<PASSWD>
      - SERVER_COUNTRIES=Canada,France,Romania
      - SERVER_CITIES=Ontario,Paris
      # Wireguard:
      # - WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU=
      # - WIREGUARD_ADDRESSES=10.64.222.21/32
      # Timezone for accurate log times
      - TZ=America/Chicago

And the error:
ERROR: for gluetun Cannot start service gluetun: error gathering device information while adding custom device "/dev/net/tun": no such file or directory
I've tried the suggestions in Github without a solution. The end result I'm looking for too is for separate LXC's also containing docker to be able to connect through this VPN service. I know that doesn't have anything to do with this error but maybe that will make a difference with my initial setup?

[qdm12]

Does this on your host fixes it?

mkdir -p /dev/net
mknod /dev/net/tun c 10 200
chmod 600 /dev/net/tun

[frepke]

I don't know LXC, but maybe this is helpful: link

[qdm12]

I just added --device /dev/net/tun:/dev/net/tun to the run command and the error changed to

What does the log say before the error log? It should log the tun device file wasn't found 🤔

[chop249]

Here is the latest log.

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================

Running version latest built on 2022-09-14T13:28:28.429Z (commit e5be20d)

🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
🐛 Bug? https://github.com/qdm12/gluetun/issues/new
✨ New feature? https://github.com/qdm12/gluetun/issues/new
☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2022-09-26T22:03:10Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-09-26T22:03:10Z INFO [routing] local ethernet link found: eth0
2022-09-26T22:03:10Z INFO [routing] local ipnet found: 172.17.0.0/16
2022-09-26T22:03:10Z INFO [firewall] enabling...
2022-09-26T22:03:10Z INFO [firewall] enabled successfully
2022-09-26T22:03:10Z INFO [storage] merging by most recent 11721 hardcoded servers and 11721 servers read from /gluetun/servers.json
2022-09-26T22:03:10Z INFO Alpine version: 3.16.2
2022-09-26T22:03:10Z INFO OpenVPN 2.4 version: 2.4.12
2022-09-26T22:03:10Z INFO OpenVPN 2.5 version: 2.5.6
2022-09-26T22:03:10Z INFO Unbound version: 1.15.0
2022-09-26T22:03:10Z INFO IPtables version: v1.8.8
2022-09-26T22:03:10Z INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: vpn unlimited
|   |   └── Server selection settings:
|   |       ├── VPN type: openvpn
|   |       ├── Countries: canada, france, romania
|   |       └── OpenVPN server selection settings:
|   |           └── Protocol: UDP
|   └── OpenVPN settings:
|       ├── OpenVPN version: 2.5
|       ├── User: [set]
|       ├── Password: [set]
|       ├── Client crt: [set]
|       ├── Client key: [set]
|       ├── Network interface: tun0
|       ├── Run OpenVPN as: root
|       └── Verbosity level: 1
├── DNS settings:
|   ├── DNS server address to use: 127.0.0.1
|   ├── Keep existing nameserver(s): no
|   └── DNS over TLS settings:
|       ├── Enabled: yes
|       ├── Update period: every 24h0m0s
|       ├── Unbound settings:
|       |   ├── Authoritative servers:
|       |   |   └── cloudflare
|       |   ├── Caching: yes
|       |   ├── IPv6: no
|       |   ├── Verbosity level: 1
|       |   ├── Verbosity details level: 0
|       |   ├── Validation log level: 0
|       |   ├── System user: root
|       |   └── Allowed networks:
|       |       ├── 0.0.0.0/0
|       |       └── ::/0
|       └── DNS filtering settings:
|           ├── Block malicious: yes
|           ├── Block ads: no
|           ├── Block surveillance: no
|           └── Blocked IP networks:
|               ├── 127.0.0.1/8
|               ├── 10.0.0.0/8
|               ├── 172.16.0.0/12
|               ├── 192.168.0.0/16
|               ├── 169.254.0.0/16
|               ├── ::1/128
|               ├── fc00::/7
|               ├── fe80::/10
|               ├── ::ffff:7f00:1/104
|               ├── ::ffff:a00:0/104
|               ├── ::ffff:a9fe:0/112
|               ├── ::ffff:ac10:0/108
|               └── ::ffff:c0a8:0/112
├── Firewall settings:
|   └── Enabled: yes
├── Log settings:
|   └── Log level: INFO
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: cloudflare.com:443
|   ├── Read header timeout: 100ms
|   ├── Read timeout: 500ms
|   └── VPN wait durations:
|       ├── Initial duration: 6s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   └── Logging: yes
├── OS Alpine settings:
|   ├── Process UID: 1000
|   └── Process GID: 1000
├── Public IP settings:
|   ├── Fetching: every 12h0m0s
|   └── IP file path: /tmp/gluetun/ip
└── Version settings:
    └── Enabled: yes
2022-09-26T22:03:10Z INFO IPv6 is not supported
2022-09-26T22:03:10Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-09-26T22:03:10Z INFO [routing] adding route for 0.0.0.0/0
2022-09-26T22:03:10Z INFO [firewall] setting allowed subnets...
2022-09-26T22:03:10Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-09-26T22:03:10Z INFO TUN device is not available: open /dev/net/tun: operation not permitted; creating it...
2022-09-26T22:03:10Z INFO [routing] routing cleanup...
2022-09-26T22:03:10Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-09-26T22:03:10Z INFO [routing] deleting route for 0.0.0.0/0
2022-09-26T22:03:10Z ERROR cannot create TUN device file node: file exists
2022-09-26T22:03:10Z INFO Shutdown successful

[chop249]

I don't know LXC, but maybe this is helpful: link

That broke the LXC. Had to remove it because I couldn't even start it.

[chop249]

Threw caution to the wind and tried docker-compose again. It created successfully but when I curl ifconfig.io I get my IP and not the one from VPN Unlimited. Am I missing something. Also when I do docker-compose it doesn't ask for client.crt or client.key.

[chenks]

Threw caution to the wind and tried docker-compose again. It created successfully but when I curl ifconfig.io I get my IP and not the one from VPN Unlimited. Am I missing something. Also when I do docker-compose it doesn't ask for client.crt or client.key.

did you ever get this working?
i have the same issue, deb12 LXC running docker, getting the same error gathering device information while adding custom device "/dev/net/tun": no such file or directory when trying to created the gluetun dontainer

[miniboathead]

I know I'm late, and you have already seen/solved it, but see bnhf's comment below: add /dev/net/tun as a passthrough device to the LXC.

[jaquavis]

If anyone comes across this in the future, please see the following wiki for solution: https://pve.proxmox.com/wiki/OpenVPN_in_LXC

Boiled down, the two steps to solve are:

1. Add the following to LXC config:
   lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir

2. Set owner (for unprivileged LXCs):
   chown 100000:100000 /dev/net/tun

[bnhf]

@jaquavis

If anyone comes across this in the future, please see the following wiki for solution: https://pve.proxmox.com/wiki/OpenVPN_in_LXC

Boiled down, the two steps to solve are:

1. Add the following to LXC config:
   lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir
2. Set owner (for unprivileged LXCs):
   chown 100000:100000 /dev/net/tun

This is no longer required for current versions of Proxmox (8.1 and above). It's easily done via the Proxmox Dashboard now:

[miniboathead]

This done the trick!

Adding /dev/net/tun as a passthrough device

Chef's Kiss!