ovpn.com provider on 4.0

[matt8707]

Hi, I'm still on 3.7.1 (Synology DSM 7) which works fine, but I need help updating to 4.0.
I'm using vpn-configs-contrib/tree/main/openvpn/ovpn and also tried se.ovpn.com.ovpn from ovpn.com.

se.ovpn.com.ovpn

client
dev tun
remote-cert-tls server
cipher aes-256-cbc
pull
nobind
reneg-sec 0
resolv-retry infinite
verb 3
persist-key
persist-tun
remote-random
remote pool-1.prd.se.ovpn.com 1194
remote pool-1.prd.se.ovpn.com 1195
remote pool-2.prd.se.ovpn.com 1194
remote pool-2.prd.se.ovpn.com 1195
remote pool-3.prd.se.ovpn.com 1194
remote pool-3.prd.se.ovpn.com 1195
remote pool-4.prd.se.ovpn.com 1194
remote pool-4.prd.se.ovpn.com 1195
proto udp
mute-replay-warnings
replay-window 256

auth-user-pass

comp-lzo

key-direction 1
<ca>
-----BEGIN CERTIFICATE-----
MIIEfTCCA2WgAwIBAgIJAK2aIWqpLj1/MA0GCSqGSIb3DQEBBQUAMIGFMQswCQYD
VQQGEwJTRTESMBAGA1UECBMJU3RvY2tob2xtMRIwEAYDVQQHEwlTdG9ja2hvbG0x
HDAaBgNVBAsTE0Zpcm1hIERhdmlkIFdpYmVyZ2gxEzARBgNVBAMTCm92cG4uc2Ug
Y2ExGzAZBgkqhkiG9w0BCQEWDGluZm9Ab3Zwbi5zZTAeFw0xNDA4MTcxODIxMjla
Fw0zNDA4MTIxODIxMjlaMIGFMQswCQYDVQQGEwJTRTESMBAGA1UECBMJU3RvY2to
b2xtMRIwEAYDVQQHEwlTdG9ja2hvbG0xHDAaBgNVBAsTE0Zpcm1hIERhdmlkIFdp
YmVyZ2gxEzARBgNVBAMTCm92cG4uc2UgY2ExGzAZBgkqhkiG9w0BCQEWDGluZm9A
b3Zwbi5zZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMR+aP4GTuZw
urZuOA2NYzMfqKyZi/TJcLEPlGTB/b4CWA9bTd8f0pHPrDAZsXIEayxxB58BIFND
NiybnbO15JN/QwlsqmA+aZX6mCSkScs/rRwasM6LDo8iGx+KmYEqAgzziONGbCMn
lO+OaarXte7LhZ9X6Z/bryu4xq/i1v3raak13kXsrogtu4iDzxqJE/QhbNOi0yhC
dlm5RYQjmlKGdPB9pNTgcakVI4HcngRYMzBlrGin0YkvWCdpx5FrDNeld7BSWrJM
NYyvd+buaid0Fu1T9/P/Srj/8AiabKoaDyiGFbZdTnGfK+04lWRvwAmvazpqbUt5
Omw634jJDuMCAwEAAaOB7TCB6jAdBgNVHQ4EFgQUEvJcHHcTiDtu7bAyZw+xaqg+
xdIwgboGA1UdIwSBsjCBr4AUEvJcHHcTiDtu7bAyZw+xaqg+xdKhgYukgYgwgYUx
CzAJBgNVBAYTAlNFMRIwEAYDVQQIEwlTdG9ja2hvbG0xEjAQBgNVBAcTCVN0b2Nr
aG9sbTEcMBoGA1UECxMTRmlybWEgRGF2aWQgV2liZXJnaDETMBEGA1UEAxMKb3Zw
bi5zZSBjYTEbMBkGCSqGSIb3DQEJARYMaW5mb0BvdnBuLnNlggkArZohaqkuPX8w
DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAJmID6OyBJbV7ayPPgquo
jF+FICuDdOfGVKP828cyISxcbVA04VpD0QLYVb0k9pFUx0NbgX2SvRTiFhP7LcyS
1HV9s+XLCb2WItPPsrdRTwtqU2n3TlCEzWA3WOcOCtT6JSkv1eelmx1JnP0gYJrD
vDvRYBFctwWhtE0bineSQkZwN6980zkknADLAiHpeZSu/AMx7CGTwA6SmoFvpNBm
HXDcfe/9ZqbbYfUfyPNe+0JbMrcv1elKi+6wlEkHFaEBphiZwGEbOX1CjUMcQFgW
/cIp3n50Eiyx6ktuqimhyb59P4Nw8gqH452tTtE4MM/brA5y0Q0WFBRBojfZIbGW
WQ==
-----END CERTIFICATE-----
</ca>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
81782767e4d59c4464cc5d1896f1cf60
15017d53ac62e2e3b94b889e00b2c69d
dc01944fe1c6d895b4d80540502eb719
10b8d785c9efa9e3182343532adffe1c
fbb7bb6eae39c502da2748edf0fb89b8
a20b0a1085cc1f06135037881bc0c4ad
8f2c0f4f72d2ab466fb54af3d8264c5f
ddeb0f21aa0ca41863678f5fc4c44de4
ca0926b36dfddc42c6f2fabd1694bdc8
215b2d223b9c21dc6734c2c778093187
afb8c33403b228b9af68b540c284f6d1
83bcc88bd41d47bd717996e499ce1cbb
fa768a9723c19c58314c4d19cfed82e5
43ee92e73d38ad26d4fbec231c0f9f3b
30773a5c87792e9bc7c34e8d7611002e
bedd044e48a0f1f96527bfdcc940aa09
-----END OpenVPN Static key V1-----
</tls-auth>

---

Here's the logs. Seems like everything's ok, then nothing.

Thanks!

Starting container with revision: 6922dd6b112d63e099b98165d
Creating TUN device /dev/net/tun
Using OpenVPN provider: OVPN
Running with VPN_CONFIG_SOURCE auto
No bundled config script found for OVPN. Defaulting to external config
Downloading configs from https://github.com/haugene/vpn-configs-contrib/archive/main.zip into /tmp/tmp.i3yJ2KLKn0
Extracting configs to /tmp/tmp.rAUfjy5lN1
Found configs for OVPN in /tmp/tmp.rAUfjy5lN1/vpn-configs-contrib-main/openvpn/ovpn, will replace current content in /etc/openvpn/ovpn
Cleanup: deleting /tmp/tmp.i3yJ2KLKn0 and /tmp/tmp.rAUfjy5lN1
No VPN configuration provided. Using default.
Modifying /etc/openvpn/ovpn/default.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Setting OpenVPN credentials...
adding route to local network 192.168.1.0/24 via 172.17.0.1 dev eth0
Tue Oct 26 03:55:12 2021 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 19 2021
Tue Oct 26 03:55:12 2021 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Tue Oct 26 03:55:12 2021 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Oct 26 03:55:12 2021 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 26 03:55:12 2021 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 26 03:55:12 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]217.64.148.64:1194
Tue Oct 26 03:55:12 2021 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Oct 26 03:55:12 2021 UDP link local: (not bound)
Tue Oct 26 03:55:12 2021 UDP link remote: [AF_INET]217.64.148.64:1194
Tue Oct 26 03:55:12 2021 TLS: Initial packet from [AF_INET]217.64.148.64:1194, sid=a05d9092 4fa57677
Tue Oct 26 03:55:12 2021 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Oct 26 03:55:12 2021 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, OU=Firma David Wibergh, CN=ovpn.se ca, emailAddress=info@ovpn.se
Tue Oct 26 03:55:12 2021 VERIFY KU OK
Tue Oct 26 03:55:12 2021 Validating certificate extended key usage
Tue Oct 26 03:55:12 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Oct 26 03:55:12 2021 VERIFY EKU OK
Tue Oct 26 03:55:12 2021 VERIFY OK: depth=0, CN=vpn47.prd.kista.ovpn.com
Tue Oct 26 03:56:12 2021 [vpn47.prd.kista.ovpn.com] Inactivity timeout (--ping-exit), exiting
Tue Oct 26 03:56:12 2021 SIGTERM[soft,ping-exit] received, process exiting

  test:
    container_name: test
    image: haugene/transmission-openvpn:latest
    volumes:
      - /volume1/docker/test:/data
      - /volume1/docker/test:/downloads
      - /etc/localtime:/etc/localtime:ro
    network_mode: bridge
    ports:
      - 9291:9091
    cap_add:
      - NET_ADMIN
    environment:
      - OPENVPN_PROVIDER=OVPN
      - OPENVPN_USERNAME=${OPENVPN_USERNAME}
      - OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
      - LOCAL_NETWORK=192.168.1.0/24
      - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
    logging:
      driver: json-file
      options:
        max-size: 10m
    # restart: always

[pkishino]

1. remove - /etc/localtime:/etc/localtime:ro mount, this is outdated..use TZ env variable if necessary
2. you have specified OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60 and your connection is reset by the server after 60 seconds as per log.. you can try remove those settings or try a different server

[pkishino]

can you try CONFIG_MOD_CA_CERTS=false ?

[pkishino]

and show what
ls /etc/openvpn/ovpn
inside the container returns, thanks

[matt8707]

Same log and files

ls /etc/openvpn/ovpn
Germany.ovpn  Sweden.ovpn  US.ovpn  default.ovpn

[pkishino]

ok, can you please try on :latest
CONFIG_MOD_TLS_CERTS=false
CONFIG_MOD_CA_CERTS=false
use the config you posted in first one (this should use default->sweden.ovpn)
@haugene here the ca and tls are embedded in the .ovpn file..I think the mod parts expects external files..

[matt8707]

SIGTERM[soft,ping-exit] (without TLS Error)