dnLL

I disabled the rule just to be safe. It didn't fix the issue. I guess I'm gonna run some wireshark diag next...

FWIW 10.1.1.54 responds to ping. Here are the screenshots requested, I removed the user/pass again: https://imgur.com/a/ccdLClH

If I put ENABLE_VPN to false, webUI works. Which made me think it isn't a firewall issue. I don't have a pi-hole, I do use pfSense however as my router (and pfBlocker-NG is disabled). 10.1.1.54 and 10.1.1.102 are in the same VLAN so they don't go through pfSense at all, shouldn't be a firewall issue (especially considering it works with VPN disabled in the docker settings). However, the DNS settings... I am really not sure of as I do have a rule that redirects all the trafic on port 53 to pfSense itself.

Right. So I installed new gen, it did fix the error, in fact I have no error at all anymore in my log... but the webUI won't work from local network (trying to access 10.1.1.54:8080 from 10.1.1.102). Here is the full log, with user/pass removed: https://hastebin.com/yorasuyoxe.swift

This docker has been a source of frustration forever because of my inhability to make the VPN part of it working. I gave up multiple times in the past but would like to try again and make it work this time. So, installed the docker from scratch... I added the crt, perm and ovpn files from PIA in the /config/openvpn folder. I tried Toronto and Montreal, both supporting port forwarding. The docker template settings I have: Network Type: br0 Fixed IP: 10.1.1.54 Privileged: On Host Ports: all default VPN_ENABLED: yes VPN_PROV: pia STRICT_PORT_FORWARD: yes LAN_NETWORK: 10.1.1.0/24 NAME_SERVERS: 1.1.1.1 DEBUG: true The error: 2020-10-13 14:55:24,366 DEBG 'start-script' stdout output: [info] PIA endpoint 'ca-toronto.privateinternetaccess.com' is in the list of endpoints that support port forwarding ... 2020-10-13 14:55:54,612 DEBG 'start-script' stdout output: [warn] Unable to download json for dynamically assigned port, exiting script... [info] Port forwarding failure, creating file '/tmp/portfailure' to indicate failure... The portfailure file is empty. I would really like to make this work eventually.

Worked perfectly for me with a X11SCH-LN4F motherboard, didn't even have to reboot and no need to edit syslinux.cfg. pfsense VM immediately recognized both ports (be careful to use i440fx, if you use Q35, the ports will only be detected if they have active connections which is not exactly what we want for pfSense). Haven't rebooted yet, unsure if Unraid will try to take the ports for itself, if so I'll do some syslinux.cfg magic but don't think that will be necessary at this point.

Sorry if it's already been discussed (couldn't find in the original post) but my motherboard has 4 Intel I210 controllers each with their separate port, with lspci -n I see this: 02:00.0 0200: 8086:1533 (rev 03) 03:00.0 0200: 8086:1533 (rev 03) 04:00.0 0200: 8086:1533 (rev 03) 05:00.0 0200: 8086:1533 (rev 03) Now, adding 8086:1533 to my syslinux.cfg, will Unraid still be able to use the first 2 ports (0200 and 0300, which I'm curently using in bond0) while I'd like to passthrough 0400 and 0500 to a pfSense VM?

I have a X11SCH-LN4F and as soon as I type modprobe i915 in the console, I lose video output in the console. I didn't have that issue on my older ASRock Rack motherboard but that one had a separated GPU chip onboard on top of the IGP from the CPU. Anyways, personally I don't need the console image once Unraid is booted up so that's not too much of an issue. If you really want a workaround, I guess that would be to get a dedicated GPU and have both the IGP and the GPU enabled, the IGP being used for the console video output.

It is a USB drive that was causing the "error". I don't think it's particularly a big issue either but at the same time I hate ignoring error messages so I decided to post here just in case. Check_MK by default poke every host every minute, I changed it to 2 minutes. Yes, I like having detailed information about what's happening with my VMs, dockers and physical hardwares such as my server, my pfsense router, my printer and so on very often. the big adavantage of check_mk is data aggregation, it produces charts that are good for 400 days with a very minimal amount of disk space needed. It's just not as "live" as some other monitoring solutions, I can miss CPU spikes within those 2 minutes, but it's accurate enough for my needs. It also scans my logfiles... so check_mk is the reason why I saw that error in syslog and why I'm here now. I can just filter it out in check_mk itself. I added a conf file for rsyslog to discard the useless messages however, UserScripts will create the conf file on every start and restart rsyslog. Anyways, that's beyond the scope of this thread.

I can do a test tonight, mount the drive, do some writes, unmount it and wait 5 minutes before unplugging. I did unplug it like 10 seconds after unmounting. So yea, maybe syncing before unmounting would help, I don't mind doing some tests with you if need be. As for Check_MK... well, it's my monitoring solution, I should probably tune syslog to filter out these infos, but it's not a Check_MK problem per se, it's just the way syslog is configured on Unraid with xinetd. It can definitely be filtered but I never really saw any reason to do it, logrotate does its job and I can just egrep -v xinetd|rpcbind if that bothers me that much while looking at logs. With that said, I'll look into it as it is, like you said, useless logging =).

Here you go. server-diagnostics-20200509-0839.zip

After unmounting a drive, I'm getting this error: May 7 21:37:10 server kernel: usb 2-4: USB disconnect, device number 2 May 7 21:37:10 server kernel: sd 9:0:0:0: [sdh] Synchronizing SCSI cache May 7 21:37:10 server kernel: sd 9:0:0:0: [sdh] Synchronize Cache(10) failed: Result: hostbyte=0x01 driverbyte=0x00 Just wanna make sure that I'm not doing anything wrong, what's SCSI cache here? I assume this has nothing to do with my Unraid cache but...

So any idea how to debug the webUI not working when vpn is enabled?

Also note that the webUI works perfectly with VPN_ENABLED set to no. I'm accessing the docker from the same VLAN/subnet so the firewall shouldn't be an issue here (everything is allowed on that VLAN/subnet anyway).

Just noticed the VPN IP is part of RFC 1918 reserved IPs for private (local) networks, is that normal? Tried Spain and Israel servers. 2020-04-12 10:02:52,603 DEBG 'watchdog-script' stdout output: [info] qBittorrent process listening on port 8080 2020-04-12 10:02:52,666 DEBG 'watchdog-script' stdout output: [debug] VPN incoming port is 38328 [debug] qBittorrent incoming port is 38328 [debug] VPN IP is 10.12.11.6 [debug] qBittorrent IP is 10.12.11.6 That's confusing. As for qbittorrent.log, 10.1.1.54 being the docker IP: (N) 2020-04-12T10:02:52 - qBittorrent v4.2.3 started (N) 2020-04-12T10:02:52 - Using config directory: /config/qBittorrent/config/ (N) 2020-04-12T10:02:52 - qBittorrent v4.2.3 started (N) 2020-04-12T10:02:52 - Using config directory: /config/qBittorrent/config/ (I) 2020-04-12T10:02:52 - Trying to listen on: 0.0.0.0:49121,[::]:49121 (N) 2020-04-12T10:02:52 - Peer ID: -qB4230- (N) 2020-04-12T10:02:52 - HTTP User-Agent is 'qBittorrent/4.2.3' (I) 2020-04-12T10:02:52 - DHT support [ON] (I) 2020-04-12T10:02:52 - Local Peer Discovery support [ON] (I) 2020-04-12T10:02:52 - PeX support [ON] (I) 2020-04-12T10:02:52 - Anonymous mode [OFF] (I) 2020-04-12T10:02:52 - Encryption support [FORCED] (I) 2020-04-12T10:02:52 - IP geolocation database loaded. Type: DBIP-Country-Lite. Build time: Tue Mar 31 19:49:13 2020. (N) 2020-04-12T10:02:52 - Using built-in Web UI. (N) 2020-04-12T10:02:52 - Web UI translation for selected locale (en) has been successfully loaded. (N) 2020-04-12T10:02:52 - Web UI: Now listening on IP: *, port: 8080 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 127.0.0.1, port: TCP/49121 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 127.0.0.1, port: UDP/49121 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 10.12.11.6, port: TCP/49121 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 10.12.11.6, port: UDP/49121 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 10.1.1.54, port: TCP/49121 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 10.1.1.54, port: UDP/49121 (N) 2020-04-12T10:02:52 - Web UI: Now listening on IP: *, port: 8080 (N) 2020-04-12T10:02:52 - Web UI: Now listening on IP: *, port: 8080 (I) 2020-04-12T10:02:52 - Trying to listen on: 0.0.0.0:38328,[::]:38328 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 127.0.0.1, port: TCP/38328 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 127.0.0.1, port: UDP/38328 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 10.12.11.6, port: TCP/38328 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 10.12.11.6, port: UDP/38328 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 10.1.1.54, port: TCP/38328 (I) 2020-04-12T10:02:52 - Successfully listening on IP: 10.1.1.54, port: UDP/38328 (I) 2020-04-12T10:02:55 - Detected external IP: 185.77.248.2

Just switched servers since Canadian ones are broken (for port forwarding). According to supervisord.log, everything is working. I don't see anything special in qBittorrent.log either aside from the correct VPN IP. However, the webUI doesn't work, despite both logs saying it's now listening on port 8080. Is there a different log for the webUI hidden somewhere?

Just tested it and you are 100% right I had these setup for no reason. Can't delete the last one (LAN) however, the UI is preventing me from deleting the last network.

I just configured the whole thing this morning and it went like a breeze. Very very easy to figure everything out with some very basic knowledge and ability to read the manuals (which are both awesome ressources whether it's for UniFi or pfSense). My AP is directly behind pfSense, all I had to do on the UniFi controller is basically to create 2 networks in 2 different subnets, have one of them with a VLAN tag id, create my 2 wireless networks with the guest assigned to that vlan ID and relay all the DHCP stuff to pfSense. On pfSense, had to enable the interface the AP is plugged in and I added my main subnet in there (the safer wifi one), then I created a VLAN under that interface with the same ID as previously and I configured it in the same different subnet as I did in UniFi and bam, job's done, IPs get assigned properly. AFter that it's only a matter of creating firewall rules.

Can't put it on port 80 whatever I do. Seems like the available settings don't actually do anything, it keeps mapping port 8080 even if I put port 80 for webui and host port 2 and 80 in the app settings too. We should have the option...

Noticed the server I'm using doesn't support port fowarding? Can't use anything in the US??? 2020-02-29 22:30:59,893 DEBG 'start-script' stdout output: [info] ca-toronto.privateinternetaccess.com [info] ca-montreal.privateinternetaccess.com [info] ca-vancouver.privateinternetaccess.com [info] de-berlin.privateinternetaccess.com [info] de-frankfurt.privateinternetaccess.com [info] sweden.privateinternetaccess.com [info] swiss.privateinternetaccess.com [info] france.privateinternetaccess.com [info] czech.privateinternetaccess.com [info] spain.privateinternetaccess.com [info] ro.privateinternetaccess.com [info] israel.privateinternetaccess.com [info] Attempting to get dynamically assigned port... Got it working with the Toronto VPN but eh...

Got it working WITHOUT vpn enabled. Now, if I enable VPN, I get this: 2020-02-29 22:26:14,822 DEBG 'start-script' stdout output: [warn] Response code 000 from curl != 2xx [warn] Exit code 7 from curl != 0 [info] 10 retries left [info] Retrying in 10 secs... I'm using PIA, not sure what's wrong, the error is very generic? Do I need to port forward something? root@server:~# ls -l /mnt/user/appdata/qbittorrentvpn/openvpn/ total 16 -rwxrwxr-x 1 nobody users 2025 Oct 22 17:06 ca.rsa.2048.crt* -rwxrwxr-x 1 nobody users 20 Feb 29 22:25 credentials.conf* -rwxrwxr-x 1 nobody users 869 Oct 22 17:06 crl.rsa.2048.pem* -rwxrwxr-x 1 nobody users 3170 Feb 29 22:25 us2-aes-128-cbc-udp-dns.ovpn*

Just noticed the supervisord.log file in appdata, please ignore my last post I'm dumb.

So... totally new to this docker... installed it from CA, put my PIA credentials in there... but the docker won't start. Nothing in /var/log/docker.log, and I have this in /var/log/syslog: Feb 29 11:08:14 server kernel: docker0: port 1(veth979aba4) entered blocking state Feb 29 11:08:14 server kernel: docker0: port 1(veth979aba4) entered disabled state Feb 29 11:08:14 server kernel: device veth979aba4 entered promiscuous mode Feb 29 11:08:14 server kernel: IPv6: ADDRCONF(NETDEV_UP): veth979aba4: link is not ready Feb 29 11:08:14 server kernel: docker0: port 1(veth979aba4) entered blocking state Feb 29 11:08:14 server kernel: docker0: port 1(veth979aba4) entered forwarding state Feb 29 11:08:14 server kernel: docker0: port 1(veth979aba4) entered disabled state Feb 29 11:08:14 server kernel: eth0: renamed from vethda9dccf Feb 29 11:08:14 server kernel: IPv6: ADDRCONF(NETDEV_CHANGE): veth979aba4: link becomes ready Feb 29 11:08:14 server kernel: docker0: port 1(veth979aba4) entered blocking state Feb 29 11:08:14 server kernel: docker0: port 1(veth979aba4) entered forwarding state Feb 29 11:08:15 server kernel: vethda9dccf: renamed from eth0 Feb 29 11:08:15 server kernel: docker0: port 1(veth979aba4) entered disabled state Feb 29 11:08:15 server kernel: docker0: port 1(veth979aba4) entered disabled state Feb 29 11:08:15 server kernel: device veth979aba4 left promiscuous mode Feb 29 11:08:15 server kernel: docker0: port 1(veth979aba4) entered disabled state I tried bridge, host and custom modes as network types. Also tried the debug flag. Haven't done anything else yet (didn't see any special instruction in the first post of this thread so I assumed it would work without any extra setup). Never had any problem with anything else from binhex or dockers in Unraid in general.

Completely new to the Unifi world, thinking of purchasing an AP I just installed the LTS version of this docker to see what I can expect. Is the memory leak issue only happening in the latest version or is it also the case in LTS (5.6.x)? If their software is flawed it's hard to trust their hardware and the company as a whole, unless the memory management is purely related to lsio's implementation of the software inside docker. Bonus question not really related to the docker: I assume this software with one AP plugged into my pfSense box will allow me to have pretty much complete control over my WiFi? I want guests to be on a separate SSID and ideally a different network subnet to restrict their access to the local network and I want pfSense to handle most of it (DHCP/DNS/firewall/etc) if possible

Found it with a recursive grep, had to purge the content of /tmp/reboot_notifications. Deleting it would probably work too, haven't tried.