Help Transmission with VPN TDL

rdmATX · 27. August 2019

I am trying to create the Transmission with VPN docker from TDL video_here.

There are two errors that I get.
1)

Code

Failed to execute command 'export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C.UTF-8; docker run -d --restart=always --privileged -v /etc/localtime:/etc/localtime:ro --net=bridge -e PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

2) exit code 125: docker: conflicting options: cannot attach both user-defined and non-user-defined network-modes.

I checked the network given, per docker:

Code

/sharedfolders/shareA/AppData# docker network inspect mynet
[
    {
        "Name": "mynet",
        "Id": "01f9985f142ae86deecf1ce6b9cbe060c7fa2e3ab98ec2a3c11b26304310e927",
        "Created": "2019-08-27T12:17:34.641430334-05:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.19.0.0/16",
                    "Gateway": "172.19.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {},
        "Options": {},
        "Labels": {}
    }
]

Alles anzeigen

subzero79 · 27. August 2019

Running containers with network option in extra arg like in that video is not possible any more due to docker changes. You need to set it up in the command line.

rdmATX · 27. August 2019

I'm not sure what you mean...how? I'm not sure I follow.

subzero79 · 28. August 2019

The plugin sets up the network option by default. In previous version of docker (18) this wasn’t a problem to put an extra network arg. Now I’m current docker (19) to run a a container with both options as you see on the video when he adds an extra argument for network docker throws an error you see which is not the plugin is docker itself.
This won’t get fixed, your best option is to fire the container in terminal or use another docker management software like portainer.

subzero79 · 28. August 2019

here use this instead of the plugin frontend.

http://haugene.github.io/docker-transmission-openvpn/

rdmATX · 28. August 2019

I see...funny, so when I left off that network argument, though I still created the network, I "believe" it means I can attach some other container...that said, I think its the same guide, but what both of the recommendations you are making is 1. use the haugene.github docker (I essentially am using it), BUT....do it in terminal, NOT OMV GUI.

If that is the correct understanding, then "I think I got it".

Lastly, from the logs, this does seem to set up the VPN anyhow, right?

Code

tarting OpenVPN using config default.ovpn
Setting OPENVPN credentials...
adding route to local network 192.168.29.0/24 via 172.17.0.1 dev eth0
adding route to local network 10.26.0.0/24 via 172.17.0.1 dev eth0
adding route to local network 10.18.60.0/24 via 172.17.0.1 dev eth0
Tue Aug 27 19:54:18 2019 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 19 2019
Tue Aug 27 19:54:18 2019 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Tue Aug 27 19:54:18 2019 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Aug 27 19:54:18 2019 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Aug 27 19:54:18 2019 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Aug 27 19:54:18 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]89.187.164.92:1194
Tue Aug 27 19:54:18 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Aug 27 19:54:18 2019 UDP link local: (not bound)
Tue Aug 27 19:54:18 2019 UDP link remote: [AF_INET]89.187.164.92:1194
Tue Aug 27 19:54:18 2019 TLS: Initial packet from [AF_INET]89.187.164.92:1194, sid=96b1e7fc 62d6fe62
Tue Aug 27 19:54:18 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Aug 27 19:54:18 2019 VERIFY OK: depth=2, C=PA, O=NordVPN, CN=NordVPN Root CA
Tue Aug 27 19:54:18 2019 VERIFY OK: depth=1, C=PA, O=NordVPN, CN=NordVPN CA3
Tue Aug 27 19:54:18 2019 VERIFY KU OK
Tue Aug 27 19:54:18 2019 Validating certificate extended key usage
Tue Aug 27 19:54:18 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Aug 27 19:54:18 2019 VERIFY EKU OK
Tue Aug 27 19:54:18 2019 VERIFY OK: depth=0, CN=us3112.nordvpn.com
Tue Aug 27 19:54:18 2019 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Tue Aug 27 19:54:18 2019 [us3112.nordvpn.com] Peer Connection Initiated with [AF_INET]89.187.164.92:1194
Tue Aug 27 19:54:20 2019 SENT CONTROL [us3112.nordvpn.com]: 'PUSH_REQUEST' (status=1)
Tue Aug 27 19:54:20 2019 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 103.86.96.100,dhcp-option DNS 103.86.99.100,sndbuf 524288,rcvbuf 524288,explicit-exit-notify,comp-lzo no,route-gateway 10.8.3.1,topology subnet,ping 60,ping-restart 180,ifconfig 10.8.3.39 255.255.255.0,peer-id 37,cipher AES-256-GCM'
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: timers and/or timeouts modified
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: explicit notify parm(s) modified
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: compression parms modified
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Tue Aug 27 19:54:20 2019 Socket Buffers: R=[212992->425984] S=[212992->425984]
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: --ifconfig/up options modified
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: route options modified
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: route-related options modified
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: peer-id set
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: adjusting link_mtu to 1657
Tue Aug 27 19:54:20 2019 OPTIONS IMPORT: data channel crypto options modified
Tue Aug 27 19:54:20 2019 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Aug 27 19:54:20 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Aug 27 19:54:20 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Aug 27 19:54:20 2019 ROUTE_GATEWAY 172.17.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:11:00:04
Tue Aug 27 19:54:20 2019 TUN/TAP device tun0 opened
Tue Aug 27 19:54:20 2019 TUN/TAP TX queue length set to 100
Tue Aug 27 19:54:20 2019 /sbin/ip link set dev tun0 up mtu 1500
Tue Aug 27 19:54:20 2019 /sbin/ip addr add dev tun0 10.8.3.39/24 broadcast 10.8.3.255
Tue Aug 27 19:54:20 2019 /etc/openvpn/tunnelUp.sh tun0 1500 1585 10.8.3.39 255.255.255.0 init
Up script executed with tun0 1500 1585 10.8.3.39 255.255.255.0 init
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 10.8.3.39
Generating transmission settings.json from env variables
sed'ing True to true
Enforcing ownership on transmission config directories
Applying permissions to transmission config directories
Setting owner for transmission paths to 1001:100
Setting permission for files (644) and directories (755)


-------------------------------------
Transmission will run as
-------------------------------------
User name:   abc
User uid:    1001
User gid:    100
-------------------------------------


STARTING TRANSMISSION
NO PORT UPDATER FOR THIS PROVIDER
Transmission startup script complete.
STARTING TINYPROXY
Found config file /etc/tinyproxy.conf, updating settings.
Setting tinyproxy port to 8888
Starting tinyproxy: tinyproxy.
Tinyproxy startup script complete.
Tue Aug 27 19:54:20 2019 /sbin/ip route add 89.187.164.92/32 via 172.17.0.1
Tue Aug 27 19:54:20 2019 /sbin/ip route add 0.0.0.0/1 via 10.8.3.1
Tue Aug 27 19:54:20 2019 /sbin/ip route add 128.0.0.0/1 via 10.8.3.1
Tue Aug 27 19:54:20 2019 Initialization Sequence Completed
Tue Aug 27 20:19:53 2019 AEAD Decrypt error: bad packet ID (may be a replay): [ #25538 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

Alles anzeigen

subzero79 · 28. August 2019

Looks ok to me. I don’t see errors. Yes set it up in terminal. There was another thread in the forum for this particular issue. So yes you can attach to the network later in the GUI

rdmATX · 28. August 2019

So, I actually did the whole thing int the GUI without that network argument...that was it. I just left that off, even though I created the network.

rdmATX · 28. August 2019

However, I am seeing Decrypt errors...is there a way to edit the *.ovpn config file to add a change to mss?

Another forum pointed out "If the MTU is 1500, add mssfix 1431 at the bottom of your *.ovpn"
->
With a TUN-style tunnel over UDP using the default TLS options, the per-packet overhead is:

41 bytes security layer overhead (includes packet tag (1), HMAC-SHA1 signature (20), initialization vector (16), sequence number (4))
28 bytes tunneling overhead (includes IP + UDP header)
Total: 69 bytes per packet

>> However, elsewhere it is stated this is not an issue fixed with

OPENVPN_OPTS --mute-replay-warnings
OPENVPN_OPTS --mssfix 1460

and putting a max size on logs

--log-opt max-size=10m
Look for mssfix

Code

AEAD Decrypt error: bad packet ID (may be a replay): [ #126605 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Tue Aug 27 22:39:10 2019 AEAD Decrypt error: bad packet ID (may be a replay): [ #126606 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Tue Aug 27 22:39:10 2019 AEAD Decrypt error: bad packet ID (may be a replay): [ #126607 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

subzero79 · 28. August 2019

You’ll have to figure that out. Have to read the docs on docker image if it provides a way, if it uses some permanent storage volume to retain data when container is recreated.

Jetzt mitmachen!