write UDP: Operation not permitted (code=1) - Synology and custom VPN provider

[jonk999]

Information

The container has been running fine in Docker on my Synology for some time, however, my provider has just updated their VPN and I needed to update the VPN config file. I downloaded the latest one and replaced the old one and amended the username and password in the config as that had also updated. Now when starting the container, I get a write UDP: Operation not permitted (code=1) error. If I use the openvpn client on my PC, the new file from my VPN provider works without issue.

From log: [s6-finish] sending all processes the KILL signal and exiting. [s6-finish] sending all processes the TERM signal. [s6-finish] waiting for services. [cont-finish.d] done. [cont-finish.d] executing container finish scripts... 2022-04-17 01:02:02 SIGTERM[hard,] received, process exiting 2022-04-17 01:02:02 event_wait : Interrupted system call (code=4) 2022-04-17 01:01:52 write UDP: Operation not permitted (code=1) 2022-04-17 01:01:44 write UDP: Operation not permitted (code=1) 2022-04-17 01:01:40 write UDP: Operation not permitted (code=1) 2022-04-17 01:01:38 write UDP: Operation not permitted (code=1) 2022-04-17 01:01:38 UDP link remote: [AF_INET]23.106.33.27:1195 2022-04-17 01:01:38 UDP link local: (not bound) 2022-04-17 01:01:38 Socket Buffers: R=[212992->212992] S=[212992->212992] 2022-04-17 01:01:38 TCP/UDP: Preserving recently used remote address: [AF_INET]23.106.33.27:1195 2022-04-17 01:01:38 library versions: OpenSSL 1.1.1l 24 Aug 2021, LZO 2.10 2022-04-17 01:01:38 OpenVPN 2.5.2 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on May 4 2021 2022-04-17 01:01:38 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning. [services.d] done. [services.d] starting services [cont-init.d] done. [cont-init.d] 03-setup-iptables: exited 0. INFO: Configuring Docker networks: 172.17.0.2/16 [cont-init.d] 03-setup-iptables: executing... [cont-init.d] 02-setup-openvpn: exited 0. OpenVPN provider not set. Using configuration at /config/openvpn/config.ovpn 2022-04-17 01:01:38 Persist state set to: ON 2022-04-17 01:01:38 TUN/TAP device tun0 opened [cont-init.d] 02-setup-openvpn: executing... [cont-init.d] 01-setup-permissions: exited 0. [cont-init.d] 01-setup-permissions: executing... [cont-init.d] executing container initialization scripts... [fix-attrs.d] done. [fix-attrs.d] applying ownership & permissions fixes... [s6-init] ensuring user provided files have correct perms...exited 0. [s6-init] making user provided files available at /var/run/s6/etc...exited 0.

Current setup

guillaumedsde/alpine-qbittorrent-openvpn:latest Running on Synology Docker using 'Execute Container using high privilege' as it's been the only way I can access the webui when it was working.

docker-compose.yml file or docker run command

The below I assume would be the equivalent is the docker compose file. I used the Synology GUI to do all configuration

version: "3.3"
services:
  alpine-qbittorrent-openvpn:
    volumes:
      - "/docker/alpine-qbittorrent-openvpn/downloads/:/downloads"
      - "/docker/alpine-qbittorrent-openvpn/config/directory:/config"
    environment:
      - OPENVPN_CONFIG_FILE=/config/openvpn/config.ovpn
      - OPENVPN_USERNAME=user
      - OPENVPN_PASSWORD=pass
      - PUID=1054
      - PGID=101
      - LAN=192.168.10.0/24
      - QBT_WEBUI_PORT=8484
    ports:
      - "8484:8484"
    image: guillaumedsde/alpine-qbittorrent-openvpn:latest

New openvpn config file

remote address port 1195 verify-x509-name CN=address as per remote above auth-user-pass client dev tun proto udp cipher AES-256-CBC resolv-retry infinite nobind persist-key persist-tun mute-replay-warnings

-----BEGIN CERTIFICATE----- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -----END CERTIFICATE-----

verb 3 reneg-sec 0

Attempted Fix(es)

Made sure running latest version. Re-setup from scratch under new container. Other than entering paramaters via the Synology Docker GUI, my knowledge is extremely limited

[jonk999]

I also have a NUC running docker and a few other containers. Tried setting it up on that and received the same error...

[robarmstrong96]

Having the same issue here.

[noah-frank]

Push

[mortiis]

Try putting the port number after the server instead of in a separate port attribute in your .ovpn config: remote my.vpn.server 1195

The rule making script 03-setup-iptables gets its info like this: CONFIG_VPN_HOSTS_AND_PORTS="$(awk '/remote / { print $2 " " $3 }' "${OPENVPN_CONFIG_FILE}")"