Good evening
A while ago I configured a VM with deluge and VPN. I used ufw to limit traffic to the vpn interface and it works fine for me but it's still maintenance and disk space wo when I noticed this docker last week, I was eager to try.
Without VPN enabled, the webUI works well; with VPN, no webUI. Supervisor logs look OK, no authentication failure but I noticed that this configures the IP tables with tun0 while ibvpn uses tap0. From my limited understanding of IPtables, I think that could prevent traffic from going to/from the vpn but my home subnet is still allowed. Anybody knows?
debug logs:
2016-09-24 01:10:40,700 CRIT Set uid to user 0
2016-09-24 01:10:40,700 INFO Included extra file "/etc/supervisor/conf.d/delugevpn.conf" during parsing
2016-09-24 01:10:40,702 INFO supervisord started with pid 19
2016-09-24 01:10:41,704 INFO spawned: 'start-script' with pid 22
2016-09-24 01:10:41,704 INFO spawned: 'webui-script' with pid 23
2016-09-24 01:10:41,705 INFO spawned: 'deluge-script' with pid 24
2016-09-24 01:10:41,706 INFO spawned: 'privoxy-script' with pid 25
2016-09-24 01:10:41,710 DEBG 'privoxy-script' stdout output:
[info] VPN is enabled, checking VPN tunnel local ip is valid
2016-09-24 01:10:41,710 INFO success: start-script entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2016-09-24 01:10:41,710 INFO success: webui-script entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2016-09-24 01:10:41,710 INFO success: deluge-script entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2016-09-24 01:10:41,710 INFO success: privoxy-script entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2016-09-24 01:10:41,711 DEBG 'start-script' stdout output:
[info] VPN is enabled, beginning configuration of VPN
2016-09-24 01:10:41,711 DEBG 'deluge-script' stdout output:
[info] deluge config file already exists, skipping copy
2016-09-24 01:10:41,712 DEBG 'deluge-script' stdout output:
[info] VPN is enabled, checking VPN tunnel local ip is valid
2016-09-24 01:10:41,718 DEBG 'start-script' stdout output:
[info] VPN provider defined as custom
[debug] Environment variables defined as follows
BASH=/bin/bash
BASHOPTS=cmdhist:complete_fullquote:extquote:force_fignore:hostcomplete:interactive_comments:progcomp:promptvars:sourcepath
BASH_ALIASES=()
BASH_ARGC=()
BASH_ARGV=()
BASH_CMDS=()
2016-09-24 01:10:41,718 DEBG 'start-script' stdout output:
BASH_LINENO=([0]="0")
BASH_SOURCE=([0]="/root/start.sh")
BASH_VERSINFO=([0]="4" [1]="3" [2]="42" [3]="1" [4]="release" [5]="x86_64-unknown-linux-gnu")
BASH_VERSION='4.3.42(1)-release'
DEBUG=true
DIRSTACK=()
ENABLE_PRIVOXY=no
EUID=0
GROUPS=()
HOME=/home/nobody
HOSTNAME=c56305b6b988
HOSTTYPE=x86_64
HOST_OS=unRAID
IFS=$' \t\n'
LANG=en_GB.UTF-8
LAN_NETWORK=192.168.1.0/24
MACHTYPE=x86_64-unknown-linux-gnu
OPTERR=1
OPTIND=1
OSTYPE=linux-gnu
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PGID=100
PIPESTATUS=([0]="0")
PPID=19
PS4='+ '
PUID=99
PWD=/
SHELL=/bin/bash
SHELLOPTS=braceexpand:hashall:interactive-comments
SHLVL=2
STRONG_CERTS=no
SUPERVISOR_ENABLED=1
SUPERVISOR_GROUP_NAME=start-script
SUPERVISOR_PROCESS_NAME=start-script
TERM=xterm
TZ=America/New_York
UID=0
VPN_CONFIG=/config/openvpn/ua1.ovpn
VPN_ENABLED=yes
VPN_PASS=XXXXXXX
VPN_PORT=1194
VPN_PROTOCOL=tcp
VPN_PROV=custom
VPN_REMOTE=ua1.ibvpn.com
VPN_USER=XXXXXXX
_='[debug] Environment variables defined as follows'
[info] VPN config file (ovpn extension) is located at /config/openvpn/ua1.ovpn
2016-09-24 01:10:41,719 DEBG 'start-script' stdout output:
[info] Env vars defined via docker -e flags for remote host, port and protocol, writing values to ovpn file...
2016-09-24 01:10:41,725 DEBG 'start-script' stdout output:
[debug] Contents of ovpn file /config/openvpn/ua1.ovpn as follows...
2016-09-24 01:10:41,726 DEBG 'start-script' stdout output:
auth-user-pass credentials.conf
up 'client.up'
down 'client.down'
link-mtu 1578
dev tap
server-poll-timeout 20
client
nobind
resolv-retry infinite
auth-retry nointeract
persist-key
mute-replay-warnings
comp-lzo
verb 3
mute 20
ns-cert-type server
route-method exe
route-delay 2
script-security 3 system
reneg-sec 0
<ca>
-----BEGIN CERTIFICATE-----
MIIDeDCCAuGgAwIBAgIJAMVKgpjMPUfxMA0GCSqGSIb3DQEBBQUAMIGFMQswCQYD
VQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5jaXNjbzEVMBMG
A1UEChMMRm9ydC1GdW5zdG9uMRgwFgYDVQQDEw9Gb3J0LUZ1bnN0b24gQ0ExITAf
BgkqhkiG9w0BCQEWEm1lQG15aG9zdC5teWRvbWFpbjAeFw0xMDA3MjExOTU5MzVa
Fw0yMDA3MTgxOTU5MzVaMIGFMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFTAT
BgNVBAcTDFNhbkZyYW5jaXNjbzEVMBMGA1UEChMMRm9ydC1GdW5zdG9uMRgwFgYD
VQQDEw9Gb3J0LUZ1bnN0b24gQ0ExITAfBgkqhkiG9w0BCQEWEm1lQG15aG9zdC5t
eWRvbWFpbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAz23m3BXY5Asiw8Dx
T4F6feqsp+pIx6ivftTniyUCbSAxI1J1s1x75DzxmUpIwPu5xavzgPXgZr8FT81X
JGqF9km4AE95iddJawKx0wNgdTo7GximQq9rw0dsQIB5hZZQ9TJwHC3VOnmEic5A
OawKOCybMcRs8saLakZOgh7Xc+UCAwEAAaOB7TCB6jAdBgNVHQ4EFgQUeRhE2N4l
XwL4H1dbjkZ4ou6fj3AwgboGA1UdIwSBsjCBr4AUeRhE2N4lXwL4H1dbjkZ4ou6f
j3ChgYukgYgwgYUxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEVMBMGA1UEBxMM
U2FuRnJhbmNpc2NvMRUwEwYDVQQKEwxGb3J0LUZ1bnN0b24xGDAWBgNVBAMTD0Zv
cnQtRnVuc3RvbiBDQTEhMB8GCSqGSIb3DQEJARYSbWVAbXlob3N0Lm15ZG9tYWlu
ggkAxUqCmMw9R/EwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQASt0pl
WzVseQLTNM8Mlgw4ZnGAv/x2xnijmMqrkE+F7pnaOicGpxgCfMKzjZuJu0TNJqF2
fibE7GhMdomD4dLFgIu8Wb5E7iQ1CSBEOGumRhK8qCsDzjr7WXUdhqA6Xvo+ylU6
DMzy0Wn3NNvfGC+qxOgybYCJwDnVPi0CEDSbzQ==
-----END CERTIFICATE-----
</ca>
2016-09-24 01:10:41,726 DEBG 'start-script' stdout output:
[info] VPN provider remote gateway defined as ua1.ibvpn.com
[info] VPN provider remote port defined as 1194
[info] VPN provider remote protocol defined as tcp
2016-09-24 01:10:41,730 DEBG 'start-script' stdout output:
[info] VPN provider username defined as XXXXXXX
2016-09-24 01:10:41,732 DEBG 'start-script' stdout output:
[warn] Username contains characters which could cause authentication issues, please consider changing this if possible
2016-09-24 01:10:41,734 DEBG 'start-script' stdout output:
[info] VPN provider password defined as XXXXXXX
2016-09-24 01:10:41,746 DEBG 'start-script' stdout output:
[info] Default route for container is 172.17.0.1
2016-09-24 01:10:41,750 DEBG 'start-script' stdout output:
[info] Setting permissions recursively on /config/openvpn...
2016-09-24 01:10:41,756 DEBG 'start-script' stdout output:
[info] Adding 192.168.1.0/24 as route via docker eth0
2016-09-24 01:10:41,756 DEBG 'start-script' stdout output:
[info] ip route defined as follows...
--------------------
2016-09-24 01:10:41,756 DEBG 'start-script' stdout output:
default via 172.17.0.1 dev eth0
172.17.0.0/16 dev eth0 proto kernel scope link src 172.17.0.12
192.168.1.0/24 via 172.17.0.1 dev eth0
2016-09-24 01:10:41,757 DEBG 'start-script' stdout output:
--------------------
2016-09-24 01:10:41,758 DEBG 'start-script' stdout output:
[debug] Modules currently loaded for kernel
2016-09-24 01:10:41,759 DEBG 'start-script' stdout output:
Module Size Used by
xt_nat 1849 16
veth 4665 0
xt_CHECKSUM 1271 1
iptable_mangle 1592 2
ipt_MASQUERADE 1213 20
nf_nat_masquerade_ipv4 1865 1 ipt_MASQUERADE
iptable_nat 1831 1
nf_nat_ipv4 4327 1 iptable_nat
nf_nat 9852 3 nf_nat_ipv4,xt_nat,nf_nat_masquerade_ipv4
nf_conntrack_ipv4 5810 3
ipt_REJECT 1457 2
nf_reject_ipv4 2419 1 ipt_REJECT
ebtable_filter 1839 0
ebtables 14232 1 ebtable_filter
iptable_filter 1528 2
ip_tables 9422 3 iptable_filter,iptable_mangle,iptable_nat
vhost_net 8037 0
tun 16556 2 vhost_net
vhost 13029 1 vhost_net
macvtap 9551 1 vhost_net
macvlan 11993 1 macvtap
md_mod 36275 9
fbcon 33163 70
bitblit 4297 1 fbcon
fbcon_rotate 1900 1 bitblit
fbcon_ccw 4678 1 fbcon_rotate
fbcon_ud 4741 1 fbcon_rotate
fbcon_cw 4542 1 fbcon_rotate
softcursor 1277 4 fbcon_cw,fbcon_ud,fbcon_ccw,bitblit
ast 40712 1
font 7524 1 fbcon
drm_kms_helper 75196 1 ast
cfbfillrect 3242 1 drm_kms_helper
cfbimgblt 1983 1 drm_kms_helper
cfbcopyarea 2942 1 drm_kms_helper
ttm 60280 1 ast
drm 216679 4 ast,ttm,drm_kms_helper
x86_pkg_temp_thermal 4669 0
coretemp 5276 0
kvm_intel 142211 0
agpgart 21186 2 drm,ttm
syscopyarea 2878 1 drm_kms_helper
sysfillrect 3114 1 drm_kms_helper
sysimgblt 1983 1 drm_kms_helper
fb_sys_fops 1314 1 drm_kms_helper
i2c_i801 10759 0
kvm 268324 1 kvm_intel
ahci 26003 5
fb 29432 7 fbcon,fbcon_cw,fbcon_ud,drm_kms_helper,softcursor,fbcon_ccw,bitblit
fbdev 966 2 fb,fbcon
libahci 19067 1 ahci
mpt3sas 165336 5
igb 124209 0
ptp 8988 1 igb
pps_core 5864 1 ptp
i2c_algo_bit 4624 2 ast,igb
sata_mv 23743 1
raid_class 3316 1 mpt3sas
i2c_core 18064 6 ast,drm,igb,i2c_i801,drm_kms_helper,i2c_algo_bit
scsi_transport_sas 21365 1 mpt3sas
ipmi_si 36527 0
2016-09-24 01:10:41,760 DEBG 'start-script' stdout output:
[info] iptable_mangle support detected, adding fwmark for tables
2016-09-24 01:10:41,779 DEBG 'start-script' stdout output:
[info] iptables defined as follows...
--------------------
2016-09-24 01:10:41,779 DEBG 'start-script' stdout output:
-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT DROP
-A INPUT -i tun0 -j ACCEPT
-A INPUT -s 172.17.0.0/16 -d 172.17.0.0/16 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 1194 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 8112 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 8112 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -i eth0 -p tcp -m tcp --dport 58846 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
-A OUTPUT -s 172.17.0.0/16 -d 172.17.0.0/16 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 1194 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 8112 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 8112 -j ACCEPT
-A OUTPUT -d 192.168.1.0/24 -o eth0 -p tcp -m tcp --sport 58846 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
2016-09-24 01:10:41,779 DEBG 'start-script' stdout output:
--------------------
2016-09-24 01:10:41,779 DEBG 'start-script' stdout output:
[info] nameservers
2016-09-24 01:10:41,780 DEBG 'start-script' stdout output:
nameserver 8.8.8.8
nameserver 8.8.4.4
2016-09-24 01:10:41,780 DEBG 'start-script' stdout output:
--------------------
[info] Starting OpenVPN...
2016-09-24 01:10:41,782 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:41 2016 OpenVPN 2.3.11 x86_64-unknown-linux-gnu [sSL (OpenSSL)] [LZO] [EPOLL] [MH] [iPv6] built on May 12 2016
Sat Sep 24 01:10:41 2016 library versions: OpenSSL 1.0.2h 3 May 2016, LZO 2.09
Sat Sep 24 01:10:41 2016 WARNING: file 'credentials.conf' is group or others accessible
2016-09-24 01:10:41,782 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:41 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2016-09-24 01:10:41,782 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:41 2016 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1502)
2016-09-24 01:10:41,782 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:41 2016 Socket Buffers: R=[87380->87380] S=[65536->65536]
2016-09-24 01:10:41,846 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:41 2016 Attempting to establish TCP connection with [AF_INET]91.231.84.93:1194 [nonblock]
2016-09-24 01:10:42,846 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:42 2016 TCP connection established with [AF_INET]91.231.84.93:1194
Sat Sep 24 01:10:42 2016 TCPv4_CLIENT link local: [undef]
Sat Sep 24 01:10:42 2016 TCPv4_CLIENT link remote: [AF_INET]91.231.84.93:1194
2016-09-24 01:10:43,014 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:43 2016 TLS: Initial packet from [AF_INET]91.231.84.93:1194, sid=6987021e b4fea3ee
2016-09-24 01:10:43,559 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:43 2016 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, CN=Fort-Funston CA,
[email protected]
2016-09-24 01:10:43,559 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:43 2016 VERIFY OK: nsCertType=SERVER
Sat Sep 24 01:10:43 2016 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, CN=server,
[email protected]
2016-09-24 01:10:44,159 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:44 2016 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1578', remote='link-mtu 1576'
Sat Sep 24 01:10:44 2016 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1534', remote='tun-mtu 1532'
2016-09-24 01:10:44,159 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:44 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Sep 24 01:10:44 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 24 01:10:44 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Sep 24 01:10:44 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 24 01:10:44 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Sat Sep 24 01:10:44 2016 [server] Peer Connection Initiated with [AF_INET]91.231.84.93:1194
2016-09-24 01:10:46,681 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:46 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2016-09-24 01:10:47,055 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:47 2016 PUSH: Received control message: 'PUSH_REPLY,show-net-up,route-gateway 10.10.20.1,ping 10,ping-restart 60,redirect-gateway def1,dhcp-option DNS 1.2.3.4,ifconfig 10.10.20.2 255.255.255.0'
Sat Sep 24 01:10:47 2016 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:1: show-net-up (2.3.11)
Sat Sep 24 01:10:47 2016 OPTIONS IMPORT: timers and/or timeouts modified
Sat Sep 24 01:10:47 2016 OPTIONS IMPORT: --ifconfig/up options modified
Sat Sep 24 01:10:47 2016 OPTIONS IMPORT: route options modified
Sat Sep 24 01:10:47 2016 OPTIONS IMPORT: route-related options modified
Sat Sep 24 01:10:47 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2016-09-24 01:10:47,055 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:47 2016 ROUTE_GATEWAY 172.17.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:11:00:0c
Sat Sep 24 01:10:47 2016 TUN/TAP device tap0 opened
Sat Sep 24 01:10:47 2016 TUN/TAP TX queue length set to 100
Sat Sep 24 01:10:47 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Sep 24 01:10:47 2016 /usr/bin/ip link set dev tap0 up mtu 1502
2016-09-24 01:10:47,056 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:47 2016 /usr/bin/ip addr add dev tap0 10.10.20.2/24 broadcast 10.10.20.255
2016-09-24 01:10:47,056 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:47 2016 client.up tap0 1502 1578 10.10.20.2 255.255.255.0 init
2016-09-24 01:10:49,062 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:49 2016 /usr/bin/ip route add 91.231.84.93/32 via 172.17.0.1
2016-09-24 01:10:49,062 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:49 2016 /usr/bin/ip route add 0.0.0.0/1 via 10.10.20.1
2016-09-24 01:10:49,063 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:49 2016 /usr/bin/ip route add 128.0.0.0/1 via 10.10.20.1
2016-09-24 01:10:49,063 DEBG 'start-script' stdout output:
Sat Sep 24 01:10:49 2016 Initialization Sequence Completed