search

haugene / docker-transmission-openvpn

Docker container running Transmission torrent client with WebUI over an OpenVPN tunnel
GNU General Public License v3.0
4.1k stars 1.2k forks source link

Update PIA configs to next gen servers #1334

Closed haugene closed 3 years ago

haugene commented 4 years ago

Which provider? PIA

Where are the configs? Should probably update to the next gen servers.

https://www.privateinternetaccess.com/helpdesk/news/posts/august-19th-2020-important-updated-server-changes-and-related-issues

IroesStrongarm commented 4 years ago

I apologize for asking, but I downloaded the config files but I'm uncertain how I would use them with the docker compose. Any help please?

Kriskras99 commented 4 years ago

Here's what I am using:

  tr1:
    image: haugene/transmission-openvpn
    container_name: tr1
    volumes:
      - tr1_data:/data
      - tr1_config:/config
      - '/etc/localtime:/etc/localtime:ro'
      - '/home/kriskras99/compose/transmission/Netherlands.ovpn:/etc/openvpn/custom/default.ovpn:ro'
    environment:
      - OPENVPN_PROVIDER=CUSTOM
      - OPENVPN_USERNAME=p1234567
      - OPENVPN_PASSWORD=password
    cap_add:
      - NET_ADMIN
    ports:
      - '9091:9091'
    dns:
      - 1.1.1.1
      - 1.0.0.1

Just replace your ovpn file path with mine and your good to go

zjorsie commented 4 years ago

Here's what I am using:

  tr1:
    image: haugene/transmission-openvpn
    container_name: tr1
    volumes:
      - tr1_data:/data
      - tr1_config:/config
      - '/etc/localtime:/etc/localtime:ro'
      - '/home/kriskras99/compose/transmission/Netherlands.ovpn:/etc/openvpn/custom/default.ovpn:ro'
    environment:
      - OPENVPN_PROVIDER=CUSTOM
      - OPENVPN_USERNAME=p1234567
      - OPENVPN_PASSWORD=password
    cap_add:
      - NET_ADMIN
    ports:
      - '9091:9091'
    dns:
      - 1.1.1.1
      - 1.0.0.1

Just replace your ovpn file path with mine and your good to go

Problem with that config is that port forwarding does not work. If you change it to:

   tr1:
     image: haugene/transmission-openvpn
     container_name: tr1
     volumes:
       - tr1_data:/data
       - tr1_config:/config
       - '/etc/localtime:/etc/localtime:ro'
       - '/home/kriskras99/compose/transmission/France.ovpn:/etc/openvpn/pia/France.ovpn:ro'
     environment:
       - OPENVPN_PROVIDER=PIA
       -OPENVPN_CONFIG=France
       - OPENVPN_USERNAME=p1234567
       - OPENVPN_PASSWORD=password
     cap_add:
       - NET_ADMIN
     ports:
       - '9091:9091'
     dns:
       - 1.1.1.1
       - 1.0.0.1

it will use port forwarding from PIA (currently, the Netherlands is not in the list of servers supporting port forwarding)

IroesStrongarm commented 4 years ago

Thank you both for your help. It took much trial and error until I got it all correct. In the end I went with the way zjorsie configured and it works perfect.

Once again, thank you both very much for taking your time to help me out.

IroesStrongarm commented 4 years ago

Nevermind. I'm clearly not doing something right. It's likely a backend setup for this I'm not getting...Thanks anyway

zjorsie commented 4 years ago

Oh yeah, do not use the x.... username pia generates for you. For the nextgen config you'll need your login credentials you also use on the app! took me some time to figure out as well (if you get auth failed messages).

And I forgot to mention that you have to change a line in your config (as received from the ovpn generator). I chose:

Then, in your file you should have a line auth-user-pass

Change this line to: auth-user-pass /config/openvpn-credentials.txt

IroesStrongarm commented 4 years ago

I'm sorry to keep asking. Which config file am I supposed to edit? I downloaded the ovpn file from PIA directly. I'm unfamiliar with ovpn generator. This is what my compose looks like:

version: "2" services: transmission-openvpn: image: haugene/transmission-openvpn:latest container_name: transmission-openvpn-syno restart: always cap_add:

zjorsie commented 4 years ago

I'm sorry to keep asking. Which config file am I supposed to edit? I downloaded the ovpn file from PIA directly. I'm unfamiliar with ovpn generator. This is what my compose looks like:

version: "2" services: transmission-openvpn: image: haugene/transmission-openvpn:latest container_name: transmission-openvpn-syno restart: always cap_add:

  • NET_ADMIN devices:
  • /dev/net/tun volumes:
  • /srv/dev-disk-by-label-scratch/scratch/downloads:/data
  • /srv/dev-disk-by-id-ata-CT500MX500SSD1_1752E108A760-part4/appdata/transmission:/config
  • /srv/dev-disk-by-label-data/users/roy/transmission/Switzerland.ovpn:/etc/openvpn/pia/Switzerland.ovpn:ro environment:
  • OPENVPN_PROVIDER=PIA
  • OPENVPN_CONFIG=Switzerland
  • OPENVPN_USERNAME=p1234567 #(I've entered my actual username here)
  • OPENVPN_PASSWORD=password #(I've entered my actual password here)
  • WEBPROXY_ENABLED=false
  • LOCAL_NETWORK=192.168.1.0/24
  • OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
  • PUID=998
  • PGID=100
  • TRANSMISSION_SCRAPE_PAUSED_TORRENTS_ENABLED=false logging: driver: json-file options: max-size: 10m dns:
  • 8.8.8.8
  • 8.8.4.4 ports:
  • 9091:9091
  • 8888:8888

You have to edit the line in this file: /srv/dev-disk-by-label-data/users/roy/transmission/Switzerland.ovpn

IroesStrongarm commented 4 years ago

If the line you are referring to is the auth-user-pass to auth-user-pass /config/openvpn-credentials.txt I've done that.

The error I get once I deploy and it tries to load is:

Port forwarding is already activated on this connection, has expired, or you are not connected to a PIA region that supports port forwarding curl encountered an error looking up new port: 7

zjorsie commented 4 years ago

On reddit (https://www.reddit.com/r/PrivateInternetAccess/comments/i6qqu0/pia_portforward_request_ip_is_dead/) they say they are migrating servers and it could happen that it doesn't work for the next while.

For the time being you can also just use the included VPN configs and just wait until the nextgen configs are included in the haugene image.

haugene commented 4 years ago

I'll get to it very soon. Hopefully this weekend.

IroesStrongarm commented 4 years ago

@zjorsie The standard ones sometimes fail to port forward so the next gen ones were recommended as the fix. That said I really do appreciate all your help.

@haugene I assumed your note at the top was just telling people like me we had to manually do it. I greatly appreciate the time you've taken in making this docker and maintaining it.

haugene commented 4 years ago

@IroesStrongarm No, you shouldn't have to do it manually ;) Trying to keep it up to date. But over the years there has come a lot of providers and there's always stuff to do. I'm using pia myself, so that should be a safe choice though.

IroesStrongarm commented 4 years ago

@zjorsie Sorry to keep bothering but I was hoping for a follow up question for my own clarification. After using everything I've learned this morning from this thread and reading the docs for this docker, I'm able to get connected using the original compose posted by kriskras99. That said, like you said, it doesn't support port forwarding.

Why is the port forwarding so important for this setup? When I use a tracking magnet link it does show a Swiss IP. I just want to properly understand why this setup is bad.

Thank you.

zjorsie commented 4 years ago

@IroesStrongarm No problem! Everything has a steep learning curve, which will eventually flatten out (I hope at least).

You don't need the port forwarding to download torrents. The connections you make all origin from your computer, so downloading will work fine.

However, when you want to upload (e.g. for private trackers, or just being someone who enjoys torrents and supports the network) you want to seed torrents. Then, you'll need people to be able to connect to you (to request data), and that's where port forwarding comes in.

Not sure how much you know about port forwarding in general but basically, the port forwarding service is nothing more than sending traffic that arrives at PIA ADDRESS:PORT to your machine over the PIA VPN, where PORT is a random port number which can be requested from PIA. This port forward can then use it to let clients connect to you (to upload torrents in this case).

IroesStrongarm commented 4 years ago

@zjorsie Thank you for that write up. So if I were to want to, for the time being (though not ideal), I could use the setup that Kriskras99 put, that did work for me, but no port forwarding, and I'd be able to download safely, just not upload to anyone?

I know that's not in the spirit of things, and obviously once I can get the next gen working with forwarding I would fix it, but just want to know if it would give me safe and functional functionality for me today?

zjorsie commented 4 years ago

@IroesStrongarm Yeah that's true, downloading is fine. For the time being, you can also use the 'normal' PIA config. This works the same as the 'nextgen' config (probably new software they're deploying with better throughput/latencies/routing efficiency/...).

If you want to test if IP hiding works correctly for your torrents, you can go to ipleak.net (activate the torrent address detection and add the magnet link to your torrent client).

mizzi0n commented 4 years ago

@zjorsie @haugene @IroesStrongarm hey everyone, i have tried this today with the old gen profiles and some of the new gen profiles, i can connect fine on all but can not get a port on any. has anyone got this working and if so which country and which gen?

evil666 commented 4 years ago

@zjorsie @haugene @IroesStrongarm hey everyone, i have tried this today with the old gen profiles and some of the new gen profiles, i can connect fine on all but can not get a port on any. has anyone got this working and if so which country and which gen?

Same here. Tried the client just in case it was the server side acting up, and the client is snagging ports just fine. Not sure if the script for this needs to be tweaked or what. Either way, appreciated your guy's time and awesome image.

zjorsie commented 4 years ago

@mizzi0n @evil666 I tried it today as well, with no luck (both on old and new config).

For the old config I get error 52, which means the server did not return any data. Not sure why though, probably issues (or choices) at the PIA side.

The PIA page about port forwarding (https://www.privateinternetaccess.com/helpdesk/kb/articles/can-i-use-port-forwarding-without-using-the-pia-client-current-gen-only) specifies that the port forwarding is only available for their currentgen config (for now), so that's why the nextgen config doesn't work I guess. I will have a look at running the pia app in the container instead of the openvpn approach.

mizzi0n commented 4 years ago

@zjorsie @evil666 i done some playing this evening. after reading this https://www.privateinternetaccess.com/pages/client-support/#portforward i tried the following servers:

Spain Romania Israel and they worked. what i done was download the orginal config files and changed the line auth-user-pass to auth-user-pass /config/openvpn-credentials.txt and mounted into the image - /root/config/pia:/etc/openvpn/pia:ro

it still isnt 100% consistant but once its up it doesnt seem to drop

zjorsie commented 4 years ago

@mizzi0n Thanks, tried Romania and got a port on the first try! Couldn't connect to DE Berlin however (closer to my location), they're probably busy with something.

mizzi0n commented 4 years ago

@mizzi0n Thanks, tried Romania and got a port on the first try! Couldn't connect to DE Berlin however (closer to my location), they're probably busy with something.

no problem, did you have to mount your own config files or just used what was there on the docker ?

IroesStrongarm commented 4 years ago

@mizzi0n Just wanted to say that your method worked for me. Currently connected to Spain no problem, port forwarded. I haven't tried to reconnect so for now the connection just remains open.

Thanks.

code-is-art commented 4 years ago

Tried this with no luck. What I did to see if I made a mistake somewhere.

to...

auth-user-pass /config/openvpn-credentials.txt

  • created dir to house .ovpn file 
    $ sudo mkdir -p /srv/openvpn/pia
$ sudo chmod -R 777 /srv/openvpn
  • moved updated .ovpn file to... /srv/openvpn/pia
  • docker-compose.yml 
    
---
version: "3.2"
services:
transmission:
image: haugene/transmission-openvpn:latest-armhf
container_name: transmission
cap_add:
  • NET_ADMIN devices:
  • /dev/net/tun restart: always ports:
  • 9091:9091
  • 8888:8888 volumes:
  • /etc/localtime:/etc/localtime:ro
  • /srv/transmission/data:/data:rw
  • /srv/transmission/config:/config:rw
  • /srv/openvpn/pia/France.ovpn:/etc/openvpn/pia/France.ovpn:ro
  • type: bind source: /media/pi/Media/Torrents target: /torrents environment:
  • PUID=1001
  • PGID=1000
  • OPENVPN_PROVIDER=PIA
  • OPENVPN_CONFIG=France
  • OPENVPN_USERNAME=u12345
  • OPENVPN_PASSWORD=p12345
  • TRANSMISSION_INCOMPLETE_DIR=/torrents/incomplete
  • TRANSMISSION_DOWNLOAD_DIR=/torrents/complete
  • TRANSMISSION_WATCH_DIR=/torrents/watch
  • OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
  • LOCAL_NETWORK=192.168.68.100/24 ports:
  • 9091:9091 dns:
  • 1.1.1.1
  • 1.0.0.1 logging: driver: json-file options: max-size: "10m" 
    
**still getting**
**> Port forwarding is already activated on this connection, has expired, or you are not connected to a PIA region that supports port forwarding**  
**> curl encountered an error looking up new port: 7**

I'm not sure what I did wrong but can't get it to work. Any Ideas from anyone who has got this to work????

jhender commented 4 years ago

Tried this with no luck. What I did to see if I made a mistake somewhere.

NextGen OpenVPN 2.4 or newer Linux France UDP/1198

  • create config and data dirs
$ sudo mkdir -p /srv/transmission/{data,config}
$ sudo chmod -R 777 /srv/transmission/
  • create user-pass file for pia next-gen
cat << 'EOF' > /srv/transmission/config/openvpn-credentials.txt
u12345
p12345
EOF
  • changed the .ovpn file line that says...

auth-user-pass

to...

auth-user-pass /config/openvpn-credentials.txt

  • created dir to house .ovpn file
$ sudo mkdir -p /srv/openvpn/pia
$ sudo chmod -R 777 /srv/openvpn
  • moved updated .ovpn file to...

/srv/openvpn/pia

  • docker-compose.yml
---
version: "3.2"
services:
  transmission:
    image: haugene/transmission-openvpn:latest-armhf
    container_name: transmission
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    restart: always
    ports:
      - 9091:9091
      - 8888:8888
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /srv/transmission/data:/data:rw
      - /srv/transmission/config:/config:rw
      - /srv/openvpn/pia/France.ovpn:/etc/openvpn/pia/France.ovpn:ro
      - type: bind
        source: /media/pi/Media/Torrents
        target: /torrents
    environment:
      - PUID=1001
      - PGID=1000
      - OPENVPN_PROVIDER=PIA
      - OPENVPN_CONFIG=France
      - OPENVPN_USERNAME=u12345
      - OPENVPN_PASSWORD=p12345
      - TRANSMISSION_INCOMPLETE_DIR=/torrents/incomplete
      - TRANSMISSION_DOWNLOAD_DIR=/torrents/complete
      - TRANSMISSION_WATCH_DIR=/torrents/watch
      - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
      - LOCAL_NETWORK=192.168.68.100/24
    ports:
      - 9091:9091
    dns:
       - 1.1.1.1
       - 1.0.0.1
    logging:
      driver: json-file
      options:
        max-size: "10m"

still getting > Port forwarding is already activated on this connection, has expired, or you are not connected to a PIA region that supports port forwarding > curl encountered an error looking up new port: 7

I'm not sure what I did wrong but can't get it to work. Any Ideas from anyone who has got this to work????

Hi, that's a pretty detailed config. Do you want to try using LOCAL_NETWORK=192.168.1.0/24 instead of LOCAL_NETWORK=192.168.68.100/24

mizzi0n commented 4 years ago

Tried this with no luck. What I did to see if I made a mistake somewhere.

* went to [pia ovpn generator](https://www.privateinternetaccess.com/pages/ovpn-config-generator) and generated an .ovpn config

NextGen OpenVPN 2.4 or newer Linux France UDP/1198

* create config and data dirs
$ sudo mkdir -p /srv/transmission/{data,config}
$ sudo chmod -R 777 /srv/transmission/
* create user-pass file for pia next-gen
cat << 'EOF' > /srv/transmission/config/openvpn-credentials.txt
u12345
p12345
EOF
* changed the .ovpn file line that says...

auth-user-pass

to...

auth-user-pass /config/openvpn-credentials.txt

* created dir to house .ovpn file
$ sudo mkdir -p /srv/openvpn/pia
$ sudo chmod -R 777 /srv/openvpn
* moved updated .ovpn file to...

/srv/openvpn/pia

* docker-compose.yml
---
version: "3.2"
services:
  transmission:
    image: haugene/transmission-openvpn:latest-armhf
    container_name: transmission
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    restart: always
    ports:
      - 9091:9091
      - 8888:8888
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /srv/transmission/data:/data:rw
      - /srv/transmission/config:/config:rw
      - /srv/openvpn/pia/France.ovpn:/etc/openvpn/pia/France.ovpn:ro
      - type: bind
        source: /media/pi/Media/Torrents
        target: /torrents
    environment:
      - PUID=1001
      - PGID=1000
      - OPENVPN_PROVIDER=PIA
      - OPENVPN_CONFIG=France
      - OPENVPN_USERNAME=u12345
      - OPENVPN_PASSWORD=p12345
      - TRANSMISSION_INCOMPLETE_DIR=/torrents/incomplete
      - TRANSMISSION_DOWNLOAD_DIR=/torrents/complete
      - TRANSMISSION_WATCH_DIR=/torrents/watch
      - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
      - LOCAL_NETWORK=192.168.68.100/24
    ports:
      - 9091:9091
    dns:
       - 1.1.1.1
       - 1.0.0.1
    logging:
      driver: json-file
      options:
        max-size: "10m"

still getting > Port forwarding is already activated on this connection, has expired, or you are not connected to a PIA region that supports port forwarding > curl encountered an error looking up new port: 7

I'm not sure what I did wrong but can't get it to work. Any Ideas from anyone who has got this to work????

the last i heard from PIA they said the only legcy severs with working port forwarding are Toronto,Vancouver, France, Romania and isreal. my mate and i have been using israel which seems pretty consistent to work.

francisreader commented 4 years ago

PIA just published Bash Scripts for their nextgen servers...

https://www.privateinternetaccess.com/helpdesk/kb/articles/next-generation-port-forwarding

evil666 commented 4 years ago

I just ended up canceling PIA and went with TorGuard at the same price I was paying before. No scripts needed for port forwarding just some configuration on their side which didn’t take long.

11jwolfe2 commented 3 years ago

I tried the new bash scripts with no luck. Any one figure out how to make this work yet?

justin-peacock commented 3 years ago

Just wondering, has this ever worked with this container? Does the port that's grabbed from PIA need to then be opened for the container itself?

mizzi0n commented 3 years ago

Just wondering, has this ever worked with this container? Does the port that's grabbed from PIA need to then be opened for the container itself?

this has worked as i have it working now. if you are not issuesd a port the contianer will work and you will be able to download fine, peers will not be able to connected to you however. so no upload traffic.

@11jwolfe2 i have not tested the new script with the next gen servers but i havent had too. if you get it working outside the docker, you will still need to then mount the configs and change the current updateport.sh script to use it, this is until the creator updates the image

justin-peacock commented 3 years ago

Right, sorry, the container itself is working for me but has the port forwarding ever worked correctly?

mizzi0n commented 3 years ago

Right, sorry, the container itself is working for me but has the port forwarding ever worked correctly?

yes its worked fine for a long time, the reason there is issues now is because PIA are doing alot of upgrades on their servers , as a result only server sites (listed above) currently support the port forwarding.

zjorsie commented 3 years ago

In the pull request added to this issue somebody mentioned PIA has released new scripts to allow port forwarding for their nextgen services (I think a week ago). I will check if I have time to create something using their nextgen config as a basis (and maybe wireguard).

They have changed the way how port forwarding works, so it will probably not be a 5 minute fix.

11jwolfe2 commented 3 years ago

Right, sorry, the container itself is working for me but has the port forwarding ever worked correctly?

yes its worked fine for a long time, the reason there is issues now is because PIA are doing alot of upgrades on their servers , as a result only server sites (listed above) currently support the port forwarding.

I have not had port fwding work on any server listed.

mizzi0n commented 3 years ago

Right, sorry, the container itself is working for me but has the port forwarding ever worked correctly?

yes its worked fine for a long time, the reason there is issues now is because PIA are doing alot of upgrades on their servers , as a result only server sites (listed above) currently support the port forwarding.

I have not had port fwding work on any server listed.

i have it working right now on isreal and so does my mate who put me onto this. i did have some issue recently though where i had to try connect multiple times .ie either keep restarting the dcoker or access the cli of the docker and manually request a new port. try that a few times and see what happens

jscoys commented 3 years ago

@haugene Hello sir, hope you're doing well! Do you think you can help us here to have something working easily with the next gen PIA servers? It seems that today we're doing manual stuff and we could break other stuff and make the container not working properly... Thx in advance for you help!

jscoys commented 3 years ago

Right, sorry, the container itself is working for me but has the port forwarding ever worked correctly?

yes its worked fine for a long time, the reason there is issues now is because PIA are doing alot of upgrades on their servers , as a result only server sites (listed above) currently support the port forwarding.

I have not had port fwding work on any server listed.

i have it working right now on isreal and so does my mate who put me onto this. i did have some issue recently though where i had to try connect multiple times .ie either keep restarting the dcoker or access the cli of the docker and manually request a new port. try that a few times and see what happens

But did you try with an other supposed to be working servers (France, Toronto...) or you have been always plugged to Israel? Can you test with CA Toronto for instance and check if it works? If no, seems only Israel server can work with port forwarding, if yes, it's that we're doing something wrong in the configuration?!

jscoys commented 3 years ago

I just ended up canceling PIA and went with TorGuard at the same price I was paying before. No scripts needed for port forwarding just some configuration on their side which didn’t take long.

What kind of configuration of their side? What did you/they do to make it work?

haroonie commented 3 years ago

I ended up going with and configured for AirVPN for a little bit while PIA gets its act together -- the past few months have been hit or miss with PIA while the past 2 years were rock solid. No problems with AirVPN since making the move - hoping for a good deal come Black Friday for the same price as PIA.

jscoys commented 3 years ago

I ended up going with and configured for AirVPN for a little bit while PIA gets its act together -- the past few months have been hit or miss with PIA while the past 2 years were rock solid. No problems with AirVPN since making the move - hoping for a good deal come Black Friday for the same price as PIA.

Do you have port forwarding? Are you able to seed?

mizzi0n commented 3 years ago

@jscoys i used to have France working but been sticking to Israel, i have just tested France and Toronto and neither work now. switched back to Israel and it worked right away

jscoys commented 3 years ago

@jscoys i used to have France working but been sticking to Israel, i have just tested France and Toronto and neither work now. switched back to Israel and it worked right away

Wow man thank you! I confirm that with IPA and the container of the box (So not having to manage a custom provider or putting the config files with credentials... etc) It works! I have a "Port is open" in transmission and then I can seed! Hurray thx!

Just put - OPENVPN_CONFIG=Israel in your docker parameter and that's it!

jscoys commented 3 years ago

@haugene I'm very happy with the Israel server trick, but we should be prepared when this one will not allow port forwarding anymore, so we should have a support for next gen PIA servers built-into the container image ;-)

mizzi0n commented 3 years ago

@jscoys im glad you have it working. i have been playing about with the next gen configs and wireguard, im hoping to soon mod my updatePort.sh script to use them since they seem to be working fine all over

kperinga commented 3 years ago

Looks like all of us who still have the legacy servers working will need an alternative solution soon: https://www.privateinternetaccess.com/blog/private-internet-access-legacy-vpn-network-sunset-announcement-30-september/

zjorsie commented 3 years ago

Hmm.. I've started implementing the wireguard scripts. Think it should work now, i'll test itnprobably this weekend

mizzi0n commented 3 years ago

@kperinga @zjorsie i have a custom updatePort.sh working at the moment which is allowing me to connect and port forward on the next gen servers. it needs alot of tidying up and testing but my seedbox has been sharing away fine for a bit now

mizzi0n commented 3 years ago

@jscoys or anyone else on here, i have a working portupdate script for the nextgen servers, anyone care to try it and see if it works universally ?