Connecting to UI from outside docker host #2035

MystaraTheGreat · 2021-10-24T10:35:05Z

MystaraTheGreat
Oct 24, 2021

Is there a pinned issue for this?

I have read the pinned issues and could not find my issue

Is there an existing or similar issue/discussion for this?

I have searched the existing issues
I have searched the existing discussions

Is there any comment in the documentation for this?

I have read the documentation, especially the FAQ and Troubleshooting parts

Is this related to a provider?

I have checked the provider repo for issues
My issue is NOT related to a provider

Are you using the latest release?

I am using the latest release

Have you tried using the dev branch latest?

I have tried using dev branch

Config used

docker run --cap-add=NET_ADMIN -d -v /your/storage/path/:/data -e OPENVPN_PROVIDER=EXPRESSVPN -e OPENVPN_USERNAME=xxx -e OPENVPN_PASSWORD=yyy -e LOCAL_NETWORK=192.168.0.0/16 --log-driver json-file --log-opt max-size=10m -p 9091:9091 haugene/transmission-openvpn

Current Behavior

Cannot access web interface from outside docker host. Connection just times out.

Expected Behavior

Access to web interface from docker host :)

How have you tried to solve the problem?

I've tried the master and dev builds on github.
I also tried using none of the builds and simply relying on docker compose to get the image from docker hub.

I've tried using docker-compose and docker run. The only difference here is that with what seems to be exactly the same configuration, docke-compose gives me DNS resolution problems right at the beginning (even with the DNS entries in the docker-compose file).

I can access the interface from within the docker host itself.
I've tried telnet and wget.

From the documentation, it seems quite clear that the error is related to the "RTNETLINK answers: File exists" comment in the log (see below). However, the documentation does not explain how to deal with this.

I have tried creating open ports on the host (via netcat) and then connecting from another computer. This works correctly. So the route between the accessing computer and the docker host seems to be unimpeded.

Log output

Starting container with revision: 6922dd6
Creating TUN device /dev/net/tun
Using OpenVPN provider: EXPRESSVPN
Running with VPN_CONFIG_SOURCE auto
No bundled config script found for EXPRESSVPN. Defaulting to external config
Downloading configs from https://github.com/haugene/vpn-configs-contrib/archive/main.zip into /tmp/tmp.I0hoUg5M1r
Extracting configs to /tmp/tmp.3TjTL4L2hw
Found configs for EXPRESSVPN in /tmp/tmp.3TjTL4L2hw/vpn-configs-contrib-main/openvpn/expressvpn, will replace current content in /etc/openvpn/expressvpn
Cleanup: deleting /tmp/tmp.I0hoUg5M1r and /tmp/tmp.3TjTL4L2hw
No VPN configuration provided. Using default.
Modifying /etc/openvpn/expressvpn/default.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Setting OpenVPN credentials...
adding route to local network 192.168.0.0/16 via 172.17.0.1 dev eth0
Sun Oct 24 10:18:44 2021 WARNING: --keysize is DEPRECATED and will be removed in OpenVPN 2.6
Sun Oct 24 10:18:44 2021 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 19 2021
Sun Oct 24 10:18:44 2021 library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10
Sun Oct 24 10:18:44 2021 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Sun Oct 24 10:18:44 2021 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Oct 24 10:18:44 2021 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 24 10:18:44 2021 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 24 10:18:44 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]193.29.107.19:1195
Sun Oct 24 10:18:44 2021 Socket Buffers: R=[212992->425984] S=[212992->425984]
Sun Oct 24 10:18:44 2021 UDP link local: (not bound)
Sun Oct 24 10:18:44 2021 UDP link remote: [AF_INET]193.29.107.19:1195
Sun Oct 24 10:18:44 2021 TLS: Initial packet from [AF_INET]193.29.107.19:1195, sid=914c1c06 e0f4aec7
Sun Oct 24 10:18:44 2021 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Oct 24 10:18:45 2021 VERIFY OK: depth=1, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
Sun Oct 24 10:18:45 2021 VERIFY OK: nsCertType=SERVER
Sun Oct 24 10:18:45 2021 VERIFY X509NAME OK: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-8802-0a, emailAddress=support@expressvpn.com
Sun Oct 24 10:18:45 2021 VERIFY OK: depth=0, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-8802-0a, emailAddress=support@expressvpn.com
Sun Oct 24 10:18:45 2021 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Sun Oct 24 10:18:45 2021 [Server-8802-0a] Peer Connection Initiated with [AF_INET]193.29.107.19:1195
Sun Oct 24 10:18:46 2021 SENT CONTROL [Server-8802-0a]: 'PUSH_REQUEST' (status=1)
Sun Oct 24 10:18:46 2021 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.196.0.1,comp-lzo no,route 10.196.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.196.0.46 10.196.0.45,peer-id
8,cipher AES-256-GCM'
Sun Oct 24 10:18:46 2021 OPTIONS IMPORT: timers and/or timeouts modified
Sun Oct 24 10:18:46 2021 OPTIONS IMPORT: compression parms modified
Sun Oct 24 10:18:46 2021 OPTIONS IMPORT: --ifconfig/up options modified
Sun Oct 24 10:18:46 2021 OPTIONS IMPORT: route options modified
Sun Oct 24 10:18:46 2021 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Oct 24 10:18:46 2021 OPTIONS IMPORT: peer-id set
Sun Oct 24 10:18:46 2021 OPTIONS IMPORT: adjusting link_mtu to 1629
Sun Oct 24 10:18:46 2021 OPTIONS IMPORT: data channel crypto options modified
Sun Oct 24 10:18:46 2021 Data Channel: using negotiated cipher 'AES-256-GCM'
Sun Oct 24 10:18:46 2021 NCP: overriding user-set keysize with default
Sun Oct 24 10:18:46 2021 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Oct 24 10:18:46 2021 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Oct 24 10:18:46 2021 ROUTE_GATEWAY 172.17.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:11:00:02
Sun Oct 24 10:18:46 2021 TUN/TAP device tun0 opened
Sun Oct 24 10:18:46 2021 TUN/TAP TX queue length set to 100
Sun Oct 24 10:18:46 2021 /sbin/ip link set dev tun0 up mtu 1500
Sun Oct 24 10:18:46 2021 /sbin/ip addr add dev tun0 local 10.196.0.46 peer 10.196.0.45
Sun Oct 24 10:18:46 2021 /etc/openvpn/tunnelUp.sh tun0 1500 1557 10.196.0.46 10.196.0.45 init
Up script executed with tun0 1500 1557 10.196.0.46 10.196.0.45 init
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 10.196.0.46
Updating Transmission settings.json with values from env variables
Generating settings.json for Transmission from environment and defaults /etc/transmission/default-settings.json
Overriding bind-address-ipv4 because TRANSMISSION_BIND_ADDRESS_IPV4 is set to 10.196.0.46
Overriding download-dir because TRANSMISSION_DOWNLOAD_DIR is set to /data/completed
Overriding incomplete-dir because TRANSMISSION_INCOMPLETE_DIR is set to /data/incomplete
Overriding rpc-port because TRANSMISSION_RPC_PORT is set to 9091
Overriding watch-dir because TRANSMISSION_WATCH_DIR is set to /data/watch
sed'ing True to true

Transmission will run as

User name: root
User uid: 0
User gid: 0

STARTING TRANSMISSION
Transmission startup script complete.
Sun Oct 24 10:18:48 2021 /sbin/ip route add 193.29.107.19/32 via 172.17.0.1
Sun Oct 24 10:18:48 2021 /sbin/ip route add 0.0.0.0/1 via 10.196.0.45
Sun Oct 24 10:18:48 2021 /sbin/ip route add 128.0.0.0/1 via 10.196.0.45
Sun Oct 24 10:18:48 2021 /sbin/ip route add 10.196.0.1/32 via 10.196.0.45
RTNETLINK answers: File exists
Sun Oct 24 10:18:48 2021 ERROR: Linux route add command failed: external program exited with error status: 2
Sun Oct 24 10:18:48 2021 Initialization Sequence Completed

Environment

- OS: Debian 5.10.46-4~bpo10+1
- Docker: 20.10.9

Anything else?

No response

Answered by pkishino

Oct 24, 2021

can you try adding "PEER_DNS=false" as an env variable and restart please?

View full answer

pkishino · 2021-10-24T11:37:48Z

pkishino
Oct 24, 2021
Collaborator

Local_Network is invalid.. change to /24

0 replies

MystaraTheGreat · 2021-10-24T12:33:22Z

MystaraTheGreat
Oct 24, 2021
Author

Well spotted!
But actually, the error remains the same :(

0 replies

pkishino · 2021-10-24T19:58:36Z

pkishino
Oct 24, 2021
Collaborator

what IP is on your docker host and the docker container?
can you please run ip r inside the container and post output

0 replies

MystaraTheGreat · 2021-10-24T20:40:45Z

MystaraTheGreat
Oct 24, 2021
Author

root@9e3700a2ec02:/# ip r
0.0.0.0/1 via 10.196.0.97 dev tun0
default via 172.17.0.1 dev eth0
10.196.0.1 dev tun0 scope link
10.196.0.97 dev tun0 proto kernel scope link src 10.196.0.98
128.0.0.0/1 via 10.196.0.97 dev tun0
172.17.0.0/16 dev eth0 proto kernel scope link src 172.17.0.2
192.168.0.0/24 via 172.17.0.1 dev eth0
193.29.107.19 via 172.17.0.1 dev eth0

IP on the docker host would be 192.168.0.31

0 replies

pkishino · 2021-10-24T21:16:07Z

pkishino
Oct 24, 2021
Collaborator

can you try adding "PEER_DNS=false" as an env variable and restart please?

0 replies

pkishino · 2021-10-24T23:24:13Z

pkishino
Oct 24, 2021
Collaborator

ah, I might know..please try the suggestion above..
this line:
Sun Oct 24 10:18:48 2021 /sbin/ip route add 10.196.0.1/32 via 10.196.0.45
is the problem I think, because we already add a route earlier
Sun Oct 24 10:18:46 2021 /sbin/ip addr add dev tun0 local 10.196.0.46 peer 10.196.0.45

0 replies

MystaraTheGreat · 2021-10-25T19:13:05Z

MystaraTheGreat
Oct 25, 2021
Author

Success!

Also: For the record, it looks like transmission's web UI doesn't load in Safari. Just thought I'd mention that in case someone else brings up the issue at some point.

0 replies

pkishino · 2021-10-26T01:49:58Z

pkishino
Oct 26, 2021
Collaborator

so adding the line worked ? could you please post ip r now ? also contents of /etc/resolv.conf ?
thanks.. Would be good to figure out why it is trying to add that strange route

0 replies

pkishino · 2021-10-26T01:50:29Z

pkishino
Oct 26, 2021
Collaborator

also, regarding Safari, I have no issues using Safari

0 replies

MystaraTheGreat · 2021-10-27T07:20:33Z

MystaraTheGreat
Oct 27, 2021
Author

Sure.

ip r now returns the following:
0.0.0.0/1 via 10.102.0.41 dev tun0
default via 172.17.0.1 dev eth0
10.102.0.1 via 10.102.0.41 dev tun0
10.102.0.41 dev tun0 proto kernel scope link src 10.102.0.42
128.0.0.0/1 via 10.102.0.41 dev tun0
157.97.120.108 via 172.17.0.1 dev eth0
172.17.0.0/16 dev eth0 proto kernel scope link src 172.17.0.2
192.168.0.0/24 via 172.17.0.1 dev eth0

Regarding Safari, it seems to be something to do with self-signed certificates. I found something about it but haven't yet tried the fixes:
https://www.jeffgeerling.com/blog/2018/fixing-safaris-cant-establish-secure-connection-when-updating-self-signed-certificate

2 replies

pkishino Oct 27, 2021
Collaborator

Cheers, I’ll take a closer look tomorrow, but regarding safari.. I’ve tested both using my https reverse proxy with my ssl vet and no problems but also directly local, via normal http and no problem. Don’t use any self signed stuff

pkishino Oct 28, 2021
Collaborator

@haugene any idea here? so it looks like one route is added and then similar one tries to get re-added which fails and then causes problems.. I tried to figure out what but didn7t get anywhere :/
@MystaraTheGreat so I understand it IS working for if you set PEER_DNS=false, right? did you set any DNS ?

MystaraTheGreat · 2021-10-28T07:20:26Z

MystaraTheGreat
Oct 28, 2021
Author

That's right. If I set the PEER_DNS environment variable then it works. I didn't do anything else

0 replies

pkishino · 2021-10-28T07:24:16Z

pkishino
Oct 28, 2021
Collaborator

So without setting that parameter, what does your /etc/resolv.conf look like?

…

On Thu, Oct 28, 2021 at 16:20 MystaraTheGreat ***@***.***> wrote: That's right. If I set the PEER_DNS environment variable then it works. I didn't do anything else — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2035 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA7OFYRGQ7E7OOHKHF64VT3UJEBVLANCNFSM5GZS5AWQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

0 replies

MystaraTheGreat · 2021-10-28T20:24:18Z

MystaraTheGreat
Oct 28, 2021
Author

Generated by openvpn for interface tun0

nameserver 10.102.0.1

1 reply

pkishino Oct 28, 2021
Collaborator

Thanks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Connecting to UI from outside docker host #2035

{{title}}

Replies: 13 comments 3 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Connecting to UI from outside docker host #2035

MystaraTheGreat Oct 24, 2021

Is there a pinned issue for this?

Is there an existing or similar issue/discussion for this?

Is there any comment in the documentation for this?

Is this related to a provider?

Are you using the latest release?

Have you tried using the dev branch latest?

Config used

Current Behavior

Expected Behavior

How have you tried to solve the problem?

Log output

Transmission will run as

User name: root User uid: 0 User gid: 0

Environment

Anything else?

Replies: 13 comments · 3 replies

pkishino Oct 24, 2021 Collaborator

MystaraTheGreat Oct 24, 2021 Author

pkishino Oct 24, 2021 Collaborator

MystaraTheGreat Oct 24, 2021 Author

pkishino Oct 24, 2021 Collaborator

pkishino Oct 24, 2021 Collaborator

MystaraTheGreat Oct 25, 2021 Author

pkishino Oct 26, 2021 Collaborator

pkishino Oct 26, 2021 Collaborator

MystaraTheGreat Oct 27, 2021 Author

pkishino Oct 27, 2021 Collaborator

pkishino Oct 28, 2021 Collaborator

MystaraTheGreat Oct 28, 2021 Author

pkishino Oct 28, 2021 Collaborator

MystaraTheGreat Oct 28, 2021 Author

Generated by openvpn for interface tun0

pkishino Oct 28, 2021 Collaborator

MystaraTheGreat
Oct 24, 2021

User name: root
User uid: 0
User gid: 0

Replies: 13 comments 3 replies

pkishino
Oct 24, 2021
Collaborator

MystaraTheGreat
Oct 24, 2021
Author

pkishino
Oct 24, 2021
Collaborator

MystaraTheGreat
Oct 24, 2021
Author

pkishino
Oct 24, 2021
Collaborator

pkishino
Oct 24, 2021
Collaborator

MystaraTheGreat
Oct 25, 2021
Author

pkishino
Oct 26, 2021
Collaborator

pkishino
Oct 26, 2021
Collaborator

MystaraTheGreat
Oct 27, 2021
Author

pkishino Oct 27, 2021
Collaborator

pkishino Oct 28, 2021
Collaborator

MystaraTheGreat
Oct 28, 2021
Author

pkishino
Oct 28, 2021
Collaborator

MystaraTheGreat
Oct 28, 2021
Author

pkishino Oct 28, 2021
Collaborator