[Support] settings to iptables cannot be done because i am using an LXC container. #1492

Titanet · 2022-04-03T13:43:29Z

Titanet
Apr 3, 2022

In raising this issue, I confirm the following:

{please fill the checkboxes, e.g: [X]}

I have read the documentation
I have read and understood the contributors guide.
The issue I am reporting can be replicated.
The issue I am reporting can be is directly related to the pivpn installer script.

Have you searched for similar issues and solutions?

(yes/no / which issues?)

Has your install failed?

Don't know

Please provide your system information

What type of hardware are you running PiVPN at?

Router Turris Omnia
LXC container in a SSD connected inside the router

Output of `uname -a`

Linux vmlxc-debian-11 4.14.269 #0 SMP Mon Mar 7 07:26:07 2022 armv7l GNU/Linux

Output of `cat /etc/os-release`

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian

If install failed Please provide the console output of `curl -L https://install.pivpn.io | bash`

Issue

During installation, settings to iptables cannot be done because i am using an LXC container. So can you tell me what to do in the firewall setting inside my router ?

Console output of `curl -L install.pivpn.io | bash`

  OUTPUT HERE
  DO NOT DELETE THE BACK-TICKS 
  PASTE THE OUTPUT INSIDE THE BACK-TICKS

Console output of `pivpn add` or `pivpn add nopass`

  OUTPUT HERE
  DO NOT DELETE THE BACK-TICKS 
  PASTE THE OUTPUT INSIDE THE BACK-TICKS

Console output of `pivpn debug`

  $ cat /tmp/debug.log
::::		PiVPN debug		 ::::
=============================================
::::		Latest commit		 ::::
Branch: master
Commit: f80b0a7962d91862132c0a4abd65c1e67bd37bd7
Author: 4s3ti
Date: Fri Dec 3 21:41:13 2021 +0100
Summary: Update Changelog
=============================================
::::	    Installation settings    	 ::::
PLAT=Debian
OSCN=bullseye
USING_UFW=0
IPv4dev=eth0
install_user=phil
install_home=/home/phil
VPN=openvpn
pivpnPROTO=udp
pivpnPORT=1194
pivpnDNS1=10.8.0.1
pivpnDNS2=
pivpnSEARCHDOMAIN=
pivpnHOST=REDACTED
TWO_POINT_FOUR=0
pivpnENCRYPT=2048
USE_PREDEFINED_DH_PARAM=1
INPUT_CHAIN_EDITED=1
FORWARD_CHAIN_EDITED=1
pivpnDEV=tun0
pivpnNET=10.8.0.0
subnetClass=24
ALLOWED_IPS=""
UNATTUPG=1
INSTALLED_PACKAGES=(bsdmainutils bash-completion iptables-persistent openvpn grepcidr expect unattended-upgrades)
HELP_SHOWN=1
=============================================
::::  Server configuration shown below   ::::
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/vmlxc-debian-11_88b7764d-2076-4807-86b9-c7027c577333.crt
key /etc/openvpn/easy-rsa/pki/private/vmlxc-debian-11_88b7764d-2076-4807-86b9-c7027c577333.key
dh /etc/openvpn/easy-rsa/pki/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 192.168.1.161"
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
client-config-dir /etc/openvpn/ccd
keepalive 15 120
remote-cert-tls client
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher AES-256-CBC
auth SHA256
user openvpn
group openvpn
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device. 
#duplicate-cn
# Generated for use by PiVPN.io
=============================================
::::  Client template file shown below   ::::
client
dev tun
proto udp
remote REDACTED 1194
resolv-retry infinite
nobind
key-direction 1
remote-cert-tls server
tls-version-min 1.2
verify-x509-name vmlxc-debian-11_88b7764d-2076-4807-86b9-c7027c577333 name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3
=============================================
:::: 	Recursive list of files in	 ::::
::: /etc/openvpn/easy-rsa/pki shows below :::
/etc/openvpn/easy-rsa/pki/:
ca.crt
crl.pem
Default.txt
dh2048.pem
Honor_9.ovpn
index.txt
index.txt.attr
index.txt.attr.old
index.txt.old
issued
openssl-easyrsa.cnf
private
renewed
revoked
safessl-easyrsa.cnf
serial
serial.old
ta.key

/etc/openvpn/easy-rsa/pki/issued:
Honor_9.crt
vmlxc-debian-11_88b7764d-2076-4807-86b9-c7027c577333.crt

/etc/openvpn/easy-rsa/pki/private:
ca.key
Honor_9.key
vmlxc-debian-11_88b7764d-2076-4807-86b9-c7027c577333.key

/etc/openvpn/easy-rsa/pki/renewed:
private_by_serial
reqs_by_serial

/etc/openvpn/easy-rsa/pki/renewed/private_by_serial:

/etc/openvpn/easy-rsa/pki/renewed/reqs_by_serial:

/etc/openvpn/easy-rsa/pki/revoked:
private_by_serial
reqs_by_serial

/etc/openvpn/easy-rsa/pki/revoked/private_by_serial:

/etc/openvpn/easy-rsa/pki/revoked/reqs_by_serial:
=============================================
::::		Self check		 ::::
:: [OK] IP forwarding is enabled
Done
Done
Done
:: [OK] OpenVPN is running
:: [OK] OpenVPN is enabled (it will automatically start on reboot)
Done
[INFO] Run pivpn -d again to see if we detect issues
=============================================
:::: Having trouble connecting? Take a look at the FAQ:
:::: https://docs.pivpn.io/faq
=============================================
::::      Snippet of the server log      ::::

=============================================
::::		Debug complete		 ::::


When running : $ pivpn debug
=============================================
::::		Self check		 ::::
:: [OK] IP forwarding is enabled
:: [ERR] Iptables MASQUERADE rule is not set, attempt fix now? [Y/n] 
iptables v1.8.7 (nf_tables): Couldn't load match `comment':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables-save v1.8.7 (nf_tables): Could not fetch rule set generation id: Invalid argument

Done
:: [ERR] Iptables INPUT rule is not set, attempt fix now? [Y/n] 
iptables v1.8.7 (nf_tables): unknown option "--dport"
Try `iptables -h' or 'iptables --help' for more information.
iptables-save v1.8.7 (nf_tables): Could not fetch rule set generation id: Invalid argument

Done
:: [ERR] Iptables FORWARD rule is not set, attempt fix now? [Y/n] 
iptables v1.8.7 (nf_tables): Couldn't load match `conntrack':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.8.7 (nf_tables): Couldn't load match `comment':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
iptables-save v1.8.7 (nf_tables): Could not fetch rule set generation id: Invalid argument

Done
:: [OK] OpenVPN is running
:: [OK] OpenVPN is enabled (it will automatically start on reboot)
:: [ERR] OpenVPN is not listening, try to restart now? [Y/n] 
Done

Have you taken any steps towards solving your issue?

$ cat /etc/pivpn/openvpn/setupVars.conf
PLAT=Debian
OSCN=bullseye
USING_UFW=0
IPv4dev=eth0
install_user=phil
install_home=/home/phil
VPN=openvpn
pivpnPROTO=udp
pivpnPORT=1194
pivpnDNS1=10.8.0.1
pivpnDNS2=
pivpnSEARCHDOMAIN=
pivpnHOST=109.190.50.144
TWO_POINT_FOUR=0
pivpnENCRYPT=2048
USE_PREDEFINED_DH_PARAM=1
INPUT_CHAIN_EDITED=1
FORWARD_CHAIN_EDITED=1
pivpnDEV=tun0
pivpnNET=10.8.0.0
subnetClass=24
ALLOWED_IPS=""
UNATTUPG=1
INSTALLED_PACKAGES=(bsdmainutils bash-completion iptables-persistent openvpn grepcidr expect unattended-upgrades)
HELP_SHOWN=1

$ ip -f inet address show eth0
30: eth0@if31: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link-netnsid 0
    inet 192.168.1.161/24 brd 192.168.1.255 scope global eth0
       valid_lft forever preferred_lft forever

coolapso · 2022-04-03T18:40:23Z

coolapso
Apr 3, 2022
Maintainer

Edited your post and fixed formatting.

LXC containers are not supported: https://docs.pivpn.io/faq/#what-boardsoses-does-pivpn-support

I have never used LXC containers, so can't really tell much other than the obvious, I've tried for a while going around that with docker containers, but then got stuck and life got in the way ... not sure how easy is to go around this ... and not sure what can you do on the router side.

My personal advice, if you want to use PiVPN stick with what is supported.

Moving to discussions, with a bit of luck someone actually knows how to help you.

0 replies

mxwmnn · 2023-05-03T16:05:22Z

mxwmnn
May 3, 2023

It's already working. Had opened the wrong port... My mistake. Works flawlessly

2 replies

coolapso May 3, 2023
Maintainer

that sounds great news, all you had to do was to run pivpn?

I have never used LXC containers therefore could never test it myself .. but i have recently changed to proxmox might give it a try someday.

mxwmnn May 3, 2023

I ran the script from tteck. Did normal port forwarding since I only have 1ipv4 and can now access every vm and lxc and the internet. My mistake was portforwading. 51280 instead of 51820.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Support] settings to iptables cannot be done because i am using an LXC container. #1492

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 2 replies

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

[Support] settings to iptables cannot be done because i am using an LXC container. #1492

Titanet Apr 3, 2022

In raising this issue, I confirm the following:

Have you searched for similar issues and solutions?

Has your install failed?

Please provide your system information

What type of hardware are you running PiVPN at?

Output of uname -a

Output of cat /etc/os-release

If install failed Please provide the console output of curl -L https://install.pivpn.io | bash

Issue

Console output of curl -L install.pivpn.io | bash

Console output of pivpn add or pivpn add nopass

Console output of pivpn debug

Have you taken any steps towards solving your issue?

Replies: 2 comments · 2 replies

coolapso Apr 3, 2022 Maintainer

mxwmnn May 3, 2023

coolapso May 3, 2023 Maintainer

mxwmnn May 3, 2023

Titanet
Apr 3, 2022

Output of `uname -a`

Output of `cat /etc/os-release`

If install failed Please provide the console output of `curl -L https://install.pivpn.io | bash`

Console output of `curl -L install.pivpn.io | bash`

Console output of `pivpn add` or `pivpn add nopass`

Console output of `pivpn debug`

Replies: 2 comments 2 replies

coolapso
Apr 3, 2022
Maintainer

mxwmnn
May 3, 2023

coolapso May 3, 2023
Maintainer