Ivacy problems / linux route add command failed

friki67 commented 3 years ago

Before creating this issue I have:

REQUIRED

[X] Read through the pinned issues for related problems
[X] Searched for similar IVACY and CONTAINER ISSUES
[X] [Read the documentation], especially the troubleshooting section and FAQ
[X] Tried to add as much relevant information to the issue as possible
[X] Verified I have tried using newest release as well
[X] Agreed that my issue will be closed if I do not follow this template and will remain closed until I complete the template

This is related to issue #1142and to #135 too.

I've reported this to the qbittorrent-openvpn container github too.

Container version & last working release

haugene/transmission-openvpn:latest installed 2012-4-26
**Required, problem occurs in :** 
?? x68:64?

Describe the problem

Can't connect to transmission WEBUI . Container is showing "healthy" in portainter, and port 9091 is showed too.

Describe the steps you have tried to solve the problem

1)tried changing UDP to TCP and different VPN locations 2)tried with guillaume/bittorrent-openvpn container with same results. 3)openvpn templates are working in the cli (linux)/desktop: linux networkmanager and windows free openvpn clients. I've tried the templates, cert and key present in your github repository and all is working ok in the mentioned clients.

Add your docker run command or docker-compose file or env details

Running using portainer

PUID | 1000
-- | --
PGID | 1000
OPENVPN_PROVIDER | IVACY
OPENVPN_CONFIG | NorwayOsloUDP
OPENVPN_USERNAME | xxxx
OPENVPN_PASSWORD | xxxx
PATH | /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
GLOBAL_APPLY_PERMISSIONS | true
TRANSMISSION_HOME | /data/transmission-home
TRANSMISSION_RPC_PORT | 9091
TRANSMISSION_DOWNLOAD_DIR | /data/completed
TRANSMISSION_INCOMPLETE_DIR | /data/incomplete
TRANSMISSION_WATCH_DIR | /data/watch
CREATE_TUN_DEVICE | true
ENABLE_UFW | false
UFW_ALLOW_GW_NET | false
UFW_DISABLE_IPTABLES_REJECT | false
WEBPROXY_ENABLED | false
WEBPROXY_PORT | 8888
LOG_TO_STDOUT | false
HEALTH_CHECK_HOST | google.com
REVISION | 32bcf7522d1ecf9428cefe9044e12f9af5e30476
**LOCAL_NETWORK=192.168.100.0/24**

Set the NET_ADMIN capability through the GUI, set the volumes.

I'm using default port for transmission webgui and have no specified others.

Logs

EDIT: The complete log:

Starting container with revision: 32bcf7522d1ecf9428cefe9044e12f9af5e30476,
Creating TUN device /dev/net/tun,
Using OpenVPN provider: IVACY,
Starting OpenVPN using config NorwayOsloUDP.ovpn,
Setting OpenVPN credentials...,
adding route to local network 192.168.100.0/24 via 172.17.0.1 dev eth0,
2021-05-04 07:07:49 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.,
2021-05-04 07:07:49 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.,
2021-05-04 07:07:49 OpenVPN 2.5.1 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 16 2021,
2021-05-04 07:07:49 library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10,
2021-05-04 07:07:49 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.,
2021-05-04 07:07:49 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts,
2021-05-04 07:07:49 TCP/UDP: Preserving recently used remote address: [AF_INET]185.125.170.165:53,
2021-05-04 07:07:49 UDP link local: (not bound),
2021-05-04 07:07:49 UDP link remote: [AF_INET]185.125.170.165:53,
2021-05-04 07:07:49 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1550',
2021-05-04 07:07:49 WARNING: 'auth' is used inconsistently, local='auth SHA1', remote='auth [null-digest]',
2021-05-04 07:07:49 [Secure-Server] Peer Connection Initiated with [AF_INET]185.125.170.165:53,
2021-05-04 07:07:50 TUN/TAP device tun0 opened,
2021-05-04 07:07:50 /sbin/ip link set dev tun0 up mtu 1500,
2021-05-04 07:07:50 /sbin/ip link set dev tun0 up,
2021-05-04 07:07:50 /sbin/ip addr add dev tun0 141.101.146.146/28,
2021-05-04 07:07:50 /etc/openvpn/tunnelUp.sh tun0 1500 1553 141.101.146.146 255.255.255.240 init,
Up script executed with tun0 1500 1553 141.101.146.146 255.255.255.240 init,
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 141.101.146.146,
Updating Transmission settings.json with values from env variables,
Using existing settings.json for Transmission /data/transmission-home/settings.json,
Overriding bind-address-ipv4 because TRANSMISSION_BIND_ADDRESS_IPV4 is set to 141.101.146.146,
Overriding download-dir because TRANSMISSION_DOWNLOAD_DIR is set to /data/completed,
Overriding incomplete-dir because TRANSMISSION_INCOMPLETE_DIR is set to /data/incomplete,
Overriding rpc-port because TRANSMISSION_RPC_PORT is set to 9091,
Overriding watch-dir because TRANSMISSION_WATCH_DIR is set to /data/watch,
sed'ing True to true,
Enforcing ownership on transmission config directories,
Applying permissions to transmission config directories,
Setting owner for transmission paths to 1000:1000,
Setting permission for files (644) and directories (755),
Setting permission for watch directory (775) and its files (664),
-------------------------------------,
Transmission will run as,
-------------------------------------,
User name:   abc,
User uid:    1000,
User gid:    1000,
-------------------------------------,
STARTING TRANSMISSION,
Transmission startup script complete.,
RTNETLINK answers: File exists,
2021-05-04 07:07:53 ERROR: Linux route add command failed: external program exited with error status: 2,
2021-05-04 07:07:53 Initialization Sequence Completed,

ip r

default via 192.168.100.1 dev eth0 onlink 
10.6.0.0/24 dev wg0 proto kernel scope link src 10.6.0.1 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 
172.18.0.0/16 dev br-fde72e55cee7 proto kernel scope link src 172.18.0.1 
192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.61

Host system

I'm running Debian Buster, kernel 4.19.181-1 x86_64. I have a WireGuard server running in this machine.

Is it a bug? if not, what can I do to fix this?

github-actions[bot] commented 3 years ago

@friki67: hello! :wave:

This issue is being automatically closed because it does not follow the issue template. If you edit and follow the template properly by filling it in completely the issue will be re-opened

github-actions[bot] commented 3 years ago

@friki67: hello! :wave:

This issue is being automatically closed because it does not follow the issue template. If you edit and follow the template properly by filling it in completely the issue will be re-opened

pkishino commented 3 years ago

Please update with your complete config.. missing things like the ports specified, local_network etc.. Also please try some older releases in 2.x and 3.x When you say desktop clients, which? Openvpn? As it’s not working in a different container as well this is most likely vpn related.. check with them about latest ovpn files and try using custom

friki67 commented 3 years ago

Thank you. I've completed some details in the op. The ivacy opvn files are working ok. Maybe I have to specify some ports, or I have missmatched some instruction? I'll try to get some older release tonight.

pkishino commented 3 years ago

What hardware are you running this on? I don’t really see any issue in the log apart from the end.. Are you running the ip r inside the container? Cause then I’m wondering why the wireguard adapter is present..

pkishino commented 3 years ago

Can you check inside the container that openvpn is running, transmission is running etc and show details of /etc/resolv.conf? Also check if you can ping your host from inside etc.. are you running some firewall or blocking something?

friki67 commented 3 years ago

Hi pkishino. Thank you very much.

I really don't know what is happening. I haven't touched anything and now I can reach Transmission interface. And the container is marked as unhealhy (yesterday and this morning was healthy). It says DNS Resolution fail, and the logs reflects it.

So I tried from inside the container and openvpn and transmission-daemon are running, I can ping LAN address and the GW, and traceroute to Google shows that openvpn is working fine.

Then I stop and start the container and now is marked as healthy. The log show same error, but it is working. So it is resolved, by now.

Anyway I'm going to post all the information requested, because maybe you can find something that can cause these strange behavior.

ip r I posted is run in host, that's why there is a wireguard adapter (the host is a vpn server too, but I can get rid off it because I just configured a dd-wrt as wireguard server).

bash-5.1# ps -A
PID   USER     TIME  COMMAND
    1 root      0:00 dumb-init /etc/openvpn/start.sh
    7 root      0:00 openvpn --script-security 2 --up-delay --up /etc/openvpn/tunnelUp.sh --route-pre-down /etc/openvpn/tun
 1086 abc       0:08 /usr/bin/transmission-daemon -g /data/transmission-home --logfile /data/transmission-home/transmission
 3689 root      0:00 bash
 3695 root      0:00 ps -A

bash-5.1# cat /etc/resolv.conf
# Generated by openvpn for interface tun0
nameserver 141.101.146.3
nameserver 141.101.146.5

eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:0C  
          inet addr:172.17.0.12  Bcast:172.17.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5543 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2377 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1174617 (1.1 MiB)  TX bytes:327082 (319.4 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:141.101.146.147  P-t-P:141.101.146.147  Mask:255.255.255.240
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:396 errors:0 dropped:3789 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:0 (0.0 B)  TX bytes:30691 (29.9 KiB)

bash-5.1# ip r
0.0.0.0/1 via 141.101.146.145 dev tun0 
default via 141.101.146.145 dev tun0 
128.0.0.0/1 via 141.101.146.145 dev tun0 
141.101.146.144/28 dev tun0 proto kernel scope link src 141.101.146.147 
172.17.0.0/16 dev eth0 proto kernel scope link src 172.17.0.12 
192.168.100.0/24 via 172.17.0.1 dev eth0

pkishino commented 3 years ago

Ok, good that it works.. perhaps it somehow didn’t click something first time :p

haugene / docker-transmission-openvpn