[Support] ich777 - Application Dockers

[ich777]

45 minutes ago, Merijeek said:

The output file isn't interesting from what I can tell:

Oh sorry, you actually have to execute the script too.

I‘m currently on the go and have not seen that.

[Merijeek]

26 minutes ago, ich777 said:

Oh sorry, you actually have to execute the script too.

I‘m currently on the go and have not seen that.

Well, this is where me being totally useless in Docker and mostly useless in Linux comes in. 

 

So...I'll just watch to hear from you when you're back.

[ich777]

On 8/27/2023 at 8:12 PM, Merijeek said:

Well, this is where me being totally useless in Docker and mostly useless in Linux comes in. 

This should do the trick:

curl https://raw.githubusercontent.com/macvk/dnsleaktest/master/dnsleaktest.sh | bash -

 

[Merijeek]

7 minutes ago, ich777 said:

This should do the trick:

curl https://raw.githubusercontent.com/macvk/dnsleaktest/master/dnsleaktest.sh | sh -

 

You'd think but nope, swing and a miss:

 

Quote

root@b43d57320d68:/# curl https://raw.githubusercontent.com/macvk/dnsleaktest/master/dnsleaktest.sh | sh -
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3273  100  3273    0     0  15413      0 --:--:-- --:--:-- --:--:-- 15438
sh: syntax error: unexpected redirection

 

[Merijeek]

And tried it without the -

 

Quote

root@b43d57320d68:/# curl https://raw.githubusercontent.com/macvk/dnsleaktest/master/dnsleaktest.sh | sh 
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3273  100  3273    0     0  40282      0 --:--:-- --:--:-- --:--:-- 40407
sh: syntax error: unexpected redirection

 

[Merijeek]

So then I tried this:

 

Quote

root@b43d57320d68:/# curl https://raw.githubusercontent.com/macvk/dnsleaktest/master/dnsleaktest.sh > dnsleaktest.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3273  100  3273    0     0  38815      0 --:--:-- --:--:-- --:--:-- 38964
root@b43d57320d68:/# sh dnsleaktest.sh 
dnsleaktest.sh: line 109: syntax error: unexpected redirection

 

With line 109 being the:

"        done <<< "$result_txt""

[ich777]

16 minutes ago, Merijeek said:

So then I tried this:

Then try this (just copy paste all):

cd /tmp
curl -s https://raw.githubusercontent.com/macvk/dnsleaktest/master/dnsleaktest.sh -o dnsleaktest.sh
chmod +x dnsleaktest.sh
./dnsleaktest.sh
rm dnsleaktest.sh

 

BTW you don't have to make a post for every command since this is bloating the thread and I believe you that it's not working.

[Merijeek]

OK well, some progress!

Quote

root@b43d57320d68:/# cd /tmp
root@b43d57320d68:/tmp# curl -s https://raw.githubusercontent.com/macvk/dnsleaktest/master/dnsleaktest.sh -o dnsleaktest.sh
root@b43d57320d68:/tmp# chmod +x dnsleaktest.sh
./dnsleaktest.sh
Your IP:
181.214.153.146 [Canada, AS174 Cogent Communications]

You use 1 DNS server:
162.158.145.99 [Canada, AS13335 CloudFlare Inc.]

Conclusion:
DNS may be leaking.
root@b43d57320d68:/tmp# rm dnsleaktest.sh
root@b43d57320d68:/tmp# 

 

Note: The above was actually from the OpenVPN container itself. 

 

I had to add some packages to get it working from another container, but finally got there:

 

Quote

root@b43d57320d68:/tmp# curl -s https://raw.githubusercontent.com/macvk/dnsleaktest/master/dnsleaktest.sh -o dnsleaktest.sh
root@b43d57320d68:/tmp# chmod +x dnsleaktest.sh
./dnsleaktest.sh
Your IP:
181.214.153.146 [Canada, AS174 Cogent Communications]

You use 1 DNS server:
162.158.145.99 [Canada, AS13335 CloudFlare Inc.]

Conclusion:
DNS may be leaking.

 

Edited August 27, 2023 by Merijeek

[ich777]

10 minutes ago, Merijeek said:

OK well, some progress!

I can't reproduce this with privado.io

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3273  100  3273    0     0   3561      0 --:--:-- --:--:-- --:--:--  3557
# chmod +x dnsleaktest.sh
# ./dnsleaktest.sh
Your IP:
<REMOVED> [Switzerland, Swiss Confederation, AS9009 M247 Europe SRL]

You use 1 DNS server:
<REMOVED> [Switzerland, Swiss Confederation, AS9009 M247 Europe SRL]

Conclusion:
DNS is not leaking.

 

[Merijeek]

Well, that's not great. Any thoughts? Or maybe just something not great with PIA?

 

I grabbed a Privado accound, and am seeing the same thing:

Quote

Your IP:
104.255.228.132 [United States of America, AS397423 Tier.Net Technologies LLC]

You use 1 DNS server:
85.12.32.49 [Netherlands, AS34305 Base IP B.V.]

Conclusion:
DNS may be leaking.
root@662e7bc91623:/# rm dnsleaktest.sh~
rm: cannot remove 'dnsleaktest.sh~': No such file or directory
root@662e7bc91623:/# rm dnsleaktest.sh
root@662e7bc91623:/# 
root@662e7bc91623:/# 

 

I swapped to a Netherlands server and I get the same thing more or less

 

Quote

Your IP:
91.148.224.13 [Netherlands, AS34343 Eweka Internet Services B.V.]

You use 1 DNS server:
85.12.32.49 [Netherlands, AS34305 Base IP B.V.]

Conclusion:
DNS may be leaking.

 

I'm even using the Privado VN DNS and getting that. 

Edited August 27, 2023 by Merijeek

[ich777]

11 hours ago, Merijeek said:

Well, that's not great. Any thoughts? Or maybe just something not great with PIA?

Is it possible for you to create a free account on privado.io and try it with their .ovpn files and see if it's the same?

 

Privado supports free accounts to AFAIK.

[curtis-bob]

if i had a question about routing while using the Open-VPN client where would you like my question to go. I have an existing post on this forum  -- 

 

and JorgeB suggested i go through the support route for the Container... which leads me here.

 

[ich777]

1 minute ago, curtis-bob said:

if i had a question about routing while using the Open-VPN client where would you like my question to go. I have an existing post on this forum  -- 

I've done a quick read on the other thread but the OpenVPN client is not designed what you want to do here.

 

It is designed to connect to a OpenVPN server which then can be shared with other containers so that they can use the VPN connection but not a site to site connection.

 

However what you can try is that you install a Firefox container along side with the OpenVPN container and share the network from the OpenVPN container with the Firefox container and connect through to the Firefox browser with the remote Unraid system.

 

Please keep in mind that you may have to set up proper routes so that your remote server can communicate with your local network which can be complicated and I can't help with that.

Do you have a second Unraid machine at home? If yes, why not create a site-to-site connection with the built in Wireguard Tunnel.

[Merijeek]

11 hours ago, ich777 said:

Is it possible for you to create a free account on privado.io and try it with their .ovpn files and see if it's the same?

 

Privado supports free accounts to AFAIK.

As you can see above, I did. 

 

However, while doing all my screwing around, I can't even route through the OVPN container. Just not sure it's worth the effort. I've been trying to get everything off a windows box by shifting all this stuff to docker containers on the Unraid server. But it's turning out to be quite the headache. 

 

I'll start over one more time with the Privado setup through this container and see what we see.

[ich777]

7 minutes ago, Merijeek said:

I'll start over one more time with the Privado setup through this container and see what we see.

I think you are doing something differently because I asked a second user and he also had no issues at all.

 

7 minutes ago, Merijeek said:

I can't even route through the OVPN container.

Why? This is pretty easy if you follow the steps from the description.

[Merijeek]

1 hour ago, ich777 said:

I think you are doing something differently because I asked a second user and he also had no issues at all.

 

Why? This is pretty easy if you follow the steps from the description.

 

I don't know. I appear to have broken it via all the experimenting I was going. 

 

As far as me doing something differently, anything is possible, but I don't know how. So this is from scratch

 

Completely basic setup:

 

Quote

docker run
  -d
  --name='OpenVPN-Client'
  --net='bridge'
  -e TZ="America/Los_Angeles"
  -e HOST_OS="Unraid"
  -e HOST_HOSTNAME="UnRAID"
  -e HOST_CONTAINERNAME="OpenVPN-Client"
  -l net.unraid.docker.managed=dockerman
  -l net.unraid.docker.icon='https://raw.githubusercontent.com/ich777/docker-templates/master/ich777/images/openvpn-client.png'
  -v '/mnt/user/dockerprod/openvpn-client':'/vpn':'rw'
  -v '/mnt/user':'/unraid':'rw'
  --device='/dev/net/tun'
  --cap-add=NET_ADMIN
  --dns=8.8.8.8
  --sysctl net.ipv6.conf.all.disable_ipv6=1 'ich777/openvpn-client'

3e6f00443e5eb78367d475fc7c85ac77abce767e3cec71323b901fe137c34c64

The command finished successfully!

 

Created an OVPN file over at PIA, then put it and creds in the right spot:

 

 

And it looks like it's up after a restart:

 

 

My QBT and OVPN containers can both ping the outside world via DNS. 

 

I've got this happy and good and completely legal torrent that finished a few minutes ago:

 

And I go and visit this site: https://ipleak.net/ and choose the "Torrent Address Detection" button, and then grab the magnet link and pop it into QBT:

 

 

And when I go back to ipleak, I see:

 

 

The top one being the VPN address, the bottom one being my own public IP. 

 

 

....so then he goes ahead and does the same thing. Shuts down all dockers and changes the ovpn.vpn and auth.vpn files to the Privado versions. 

 

OVPN file is Privado's: ams-001.default (renamed, of course)

 

Connected:

 

 

Go back to IPLeak, grab  a new magnet and put it into QBT:

 

 

...and poof, pretty much instantly

 

 

Finally, lacking any better ideas, I change the DNS that the OVPN container is using.

 

....and boom, same as above. 

 

Meanwhile, on my extra Windows machine running the PIA client, I go through the same tests, and only my PIA VPN IP ever shows up in the ipleak site. 

 

I'm not saying I'm not possibly doing something wrong here, but I don't see how I can be. 

 

 

[sonic6]

7 hours ago, Merijeek said:

 

I don't know. I appear to have broken it via all the experimenting I was going. 

 

As far as me doing something differently, anything is possible, but I don't know how. So this is from scratch

 

Completely basic setup:

 

 

Created an OVPN file over at PIA, then put it and creds in the right spot:

 

 

And it looks like it's up after a restart:

 

 

My QBT and OVPN containers can both ping the outside world via DNS. 

 

I've got this happy and good and completely legal torrent that finished a few minutes ago:

 

And I go and visit this site: https://ipleak.net/ and choose the "Torrent Address Detection" button, and then grab the magnet link and pop it into QBT:

 

 

And when I go back to ipleak, I see:

 

 

The top one being the VPN address, the bottom one being my own public IP. 

 

 

....so then he goes ahead and does the same thing. Shuts down all dockers and changes the ovpn.vpn and auth.vpn files to the Privado versions. 

 

OVPN file is Privado's: ams-001.default (renamed, of course)

 

Connected:

 

 

Go back to IPLeak, grab  a new magnet and put it into QBT:

 

 

...and poof, pretty much instantly

 

 

Finally, lacking any better ideas, I change the DNS that the OVPN container is using.

 

....and boom, same as above. 

 

Meanwhile, on my extra Windows machine running the PIA client, I go through the same tests, and only my PIA VPN IP ever shows up in the ipleak site. 

 

I'm not saying I'm not possibly doing something wrong here, but I don't see how I can be. 

 

 

i added LSIO's qbitorrent just for testing... can't reproduce it. it isn't the ovpn-client client. it must be you setup.

 

 

 

Edited August 29, 2023 by sonic6

[sonic6]

7 hours ago, Merijeek said:

Completely basic setup:

 

Quote

docker run
  -d
  --name='OpenVPN-Client'
  --net='bridge'
  -e TZ="America/Los_Angeles"
  -e HOST_OS="Unraid"
  -e HOST_HOSTNAME="UnRAID"
  -e HOST_CONTAINERNAME="OpenVPN-Client"
  -l net.unraid.docker.managed=dockerman
  -l net.unraid.docker.icon='https://raw.githubusercontent.com/ich777/docker-templates/master/ich777/images/openvpn-client.png'
  -v '/mnt/user/dockerprod/openvpn-client':'/vpn':'rw'
  -v '/mnt/user':'/unraid':'rw'
  --device='/dev/net/tun'
  --cap-add=NET_ADMIN
  --dns=8.8.8.8
  --sysctl net.ipv6.conf.all.disable_ipv6=1 'ich777/openvpn-client'

3e6f00443e5eb78367d475fc7c85ac77abce767e3cec71323b901fe137c34c64

The command finished successfully!

 

there are no ports or the firewall, which is needed in bridge mode, or i am wrong?

[ich777]

8 hours ago, Merijeek said:

I don't know. I appear to have broken it via all the experimenting I was going. 

As @sonic6 said, something seems off, can you please also post a screenshot from your torrent container with the Advanced View enabled?

I think there is a general configuration issue.

 

 

I've now also tried it with the ams-001.default file (@iviv this is maybe also interesting for you) :

 

First I've created the OpenVPN-Client container (this is a completely fresh installation) :

 

Then I clicked this button in the OpenVPN-Client template to add a variable and a new port entry:

 

This is the variable (this will ensure that no outgoing traffic is possible when the VPN connection is not established, strictly speaking you don't have to create that variable but I recommend it) :

 

This port is necessary because you route the traffic from the torrent client through the OpenVPN-Client and the torrent client has strictly speaking no own network anymore and you have to create all ports that you want to be reachable from outside the torrent container in the OpenVPN-Client template:

 

Then I ensured that the container doesn't leak by opening the console:

 

And issuing the command that I've provided (a bit modified, but it does the same) :

 

Then I created the torrent container and changing the Network Type to None and in the Extra Parameters you have to tell the torrent container that it uses the container network from OpenVPN-Client:

 

Then I ensured that there is no leak in the torrent container by opening up the console (please note that the WebUI button in the torrent container is not working anymore because it has no network anymore, you have to type in the IP:PORT manually in the address bar like 192.168.0.10:8080 to open the WebUI from the torrent client) :

 

I issued the command again:

 

Then I went over to the leak testing thing and this is my real IP (I removed basically everything except for the last digit but you should see that the IPs are different) :

 

Then I copied the Magnet Link and pasted it into the torrent client (you have to open up a browser and enter the IP followed by the port manually because the WebUI button doesn't work anymore as explained above) :

 

And back to the leak tester you can see that there is only one IP (from the VPN) :

 

 

Hope that makes sense.

[Merijeek]

Here's some shots of my advanced QBT setup:

 

 

 

As you can see, not much to it. 

 

However, I did add the FIREWALL variable to the OpenVPN container and so far I seem to be showing good:

 

 

So...I'll throw a few more things in there and check back and see what I can see. 

 

[sonic6]

@Merijeek the forwarded Ports are still Missing in your ovpn-client Container.

[Merijeek]

3 hours ago, sonic6 said:

@Merijeek the forwarded Ports are still Missing in your ovpn-client Container.

Yeah, that was just a shot from before I did it. They're there and I can reach the containers behind it. 

[Lucas Mietke]

Hello,
Unfortunately, I don't see the container ich777/ramboxce under the Apps tab

where is this one?

[ich777]

6 minutes ago, Lucas Mietke said:

Unfortunately, I don't see the container ich777/ramboxce under the Apps tab

This container was deprecated a while back.

[Lucas Mietke]

 

52 minutes ago, ich777 said:

Dieser Container wurde vor einiger Zeit nicht mehr unterstützt.

pity, is an interesting part

will there be anything else in the future?