Can't access WebUI anymore (help needed!) #2771

fortinmike · 2023-12-18T00:24:09Z

fortinmike
Dec 18, 2023

Hey there,

First of all, thanks for making and maintaining this container. It's been super useful so far.

A few weeks back the WebUI for the container stopped being accessible. I'm not sure exactly when, unfortunately. I've been procrastinating but I'm trying to fix this again, without success. I searched through the project's issues and discussions but didn't find anything resembling what I'm seeing here. I've updated it (recreated the container from scratch) multiple times since then but the issue persists.

Here are some details about my setup:

macOS Sonoma 14.2
Docker Desktop 4.25.2
Latest docker-transmission-openvpn as of right now (image: haugene/transmission-openvpn)

Here's the situation:

I've done all of the troubleshooting steps here and everything works as expected as far as the things those tests verify.
The container logs seem mostly fine to me apart from some IPV6 errors (see below).
Running curl ifconfig.me inside the container outputs a PIA IP address, different from the host's public IP as expected.
I can access the WebUI from within the container shell like so curl localhost:9091. This returns <h1>301: Moved Permanently</h1> as expected.
When trying curl localhost:9091 from the host, I get curl: (56) Recv failure: Connection reset by peer. Web browsers show similar error messages.
All of my other containers work fine and their web UIs are accessible as expected.
I've tried other port mappings like 9092:9091 and other random ports, still unreachable.

Any idea what might be the issue? I've been trying lots of suggestions from people trying to fix unreachable containers (not necessarily specific to docker-transmission-openvpn) without any progress.

Thanks in advance for the help!

docker-compose.yml

version: '3.3'
name: docker-transmission-openvpn
services:

  app:
    image: haugene/transmission-openvpn
    restart: always
    cap_add:
      - NET_ADMIN
    environment:
      - OPENVPN_PROVIDER=PIA
      - OPENVPN_CONFIG=ca_ontario
      - OPENVPN_USERNAME=[REDACTED]
      - OPENVPN_PASSWORD=[REDACTED]
      - TRANSMISSION_WEB_UI=combustion # https://haugene.github.io/docker-transmission-openvpn/config-options/#alternative_web_uis
      - TRANSMISSION_DOWNLOAD_DIR=/data
      - TRANSMISSION_INCOMPLETE_DIR=/data/Incomplete
      - TRANSMISSION_WATCH_DIR=/data
      - TRANSMISSION_RPC_USERNAME=[REDACTED]
      - TRANSMISSION_RPC_PASSWORD=[REDACTED]
      - HEALTH_CHECK_HOST=duckduckgo.com
      - LOCAL_NETWORK=10.0.0.0/24 # Note: The host's IP is 10.0.0.20
      - TZ=Canada/Eastern
    logging:
      driver: json-file
      options:
        max-size: 10m
    ports:
      - '9091:9091'
    volumes:
      - ./config:/config
      - /Volumes/Downloads:/data

Container startup log:

2023-12-17 19:08:42 2023-12-17 19:08:42 event_wait : Interrupted system call (code=4)
2023-12-17 19:08:42 2023-12-17 19:08:42 /etc/openvpn/tunnelDown.sh tun0 1500 1553 10.55.112.124 255.255.255.0 init
2023-12-17 19:08:42 resolv.conf was restored
2023-12-17 19:08:42 Sending kill signal to transmission-daemon
2023-12-17 19:08:43 Waiting 5s for transmission-daemon to die
2023-12-17 19:08:47 Sending kill signal (SIGKILL) to transmission-daemon
2023-12-17 19:08:47 2023-12-17 19:08:47 net_route_v4_del: 104.200.138.243/32 via 172.18.0.1 dev [NULL] table 0 metric -1
2023-12-17 19:08:47 2023-12-17 19:08:47 net_route_v4_del: 0.0.0.0/1 via 10.55.112.1 dev [NULL] table 0 metric -1
2023-12-17 19:08:47 2023-12-17 19:08:47 net_route_v4_del: 128.0.0.0/1 via 10.55.112.1 dev [NULL] table 0 metric -1
2023-12-17 19:08:47 2023-12-17 19:08:47 Closing TUN/TAP interface
2023-12-17 19:08:47 2023-12-17 19:08:47 net_addr_v4_del: 10.55.112.124 dev tun0
2023-12-17 19:08:47 2023-12-17 19:08:47 SIGTERM[hard,] received, process exiting
2023-12-17 19:08:47 Starting container with revision: 07f5a2b9aea5028c9bb75438c1552708e91dde71
2023-12-17 19:08:47 TRANSMISSION_HOME is currently set to: /config/transmission-home
2023-12-17 19:08:47 Creating TUN device /dev/net/tun
2023-12-17 19:08:48 Using OpenVPN provider: PIA
2023-12-17 19:08:48 Running with VPN_CONFIG_SOURCE auto
2023-12-17 19:08:48 Provider PIA has a bundled setup script. Defaulting to internal config
2023-12-17 19:08:48 Executing setup script for PIA
2023-12-17 19:08:48 Downloading OpenVPN config bundle openvpn into temporary file /tmp/tmp.O7aiHSBD4q
2023-12-17 19:08:48 Extract OpenVPN config bundle into PIA directory /etc/openvpn/pia
2023-12-17 19:08:48 Starting OpenVPN using config ca_ontario.ovpn
2023-12-17 19:08:48 Modifying /etc/openvpn/pia/ca_ontario.ovpn for best behaviour in this container
2023-12-17 19:08:48 Modification: Point auth-user-pass option to the username/password file
2023-12-17 19:08:48 Modification: Change ca certificate path
2023-12-17 19:08:48 Modification: Change ping options
2023-12-17 19:08:48 Modification: Update/set resolv-retry to 15 seconds
2023-12-17 19:08:48 Modification: Change tls-crypt keyfile path
2023-12-17 19:08:48 Modification: Set output verbosity to 3
2023-12-17 19:08:48 Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
2023-12-17 19:08:48 Modification: Updating status for config failure detection
2023-12-17 19:08:48 Setting OpenVPN credentials...
2023-12-17 19:08:48 adding route to local network 10.0.0.0/24 via 172.18.0.1 dev eth0
2023-12-17 19:08:48 2023-12-17 19:08:48 DEPRECATED OPTION: --cipher set to 'aes-128-cbc' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'aes-128-cbc' to --data-ciphers or change --cipher 'aes-128-cbc' to --data-ciphers-fallback 'aes-128-cbc' to silence this warning.
2023-12-17 19:08:48 2023-12-17 19:08:48 OpenVPN 2.5.9 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 29 2023
2023-12-17 19:08:48 2023-12-17 19:08:48 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
2023-12-17 19:08:48 2023-12-17 19:08:48 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2023-12-17 19:08:48 2023-12-17 19:08:48 CRL: loaded 1 CRLs from file -----BEGIN X509 CRL-----
[REDACTED]
2023-12-17 19:08:48 -----END X509 CRL-----
2023-12-17 19:08:48 
2023-12-17 19:08:48 2023-12-17 19:08:48 TCP/UDP: Preserving recently used remote address: [AF_INET]198.8.95.209:1198
2023-12-17 19:08:48 2023-12-17 19:08:48 Socket Buffers: R=[212992->212992] S=[212992->212992]
2023-12-17 19:08:48 2023-12-17 19:08:48 UDP link local: (not bound)
2023-12-17 19:08:48 2023-12-17 19:08:48 UDP link remote: [AF_INET]198.8.95.209:1198
2023-12-17 19:08:48 2023-12-17 19:08:48 TLS: Initial packet from [AF_INET]198.8.95.209:1198, sid=605105aa 95f20687
2023-12-17 19:08:48 2023-12-17 19:08:48 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-12-17 19:08:48 2023-12-17 19:08:48 VERIFY OK: depth=1, C=US, ST=CA, L=LosAngeles, O=Private Internet Access, OU=Private Internet Access, CN=Private Internet Access, name=Private Internet Access, [email protected]
2023-12-17 19:08:48 2023-12-17 19:08:48 VERIFY KU OK
2023-12-17 19:08:48 2023-12-17 19:08:48 Validating certificate extended key usage
2023-12-17 19:08:48 2023-12-17 19:08:48 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2023-12-17 19:08:48 2023-12-17 19:08:48 VERIFY EKU OK
2023-12-17 19:08:48 2023-12-17 19:08:48 VERIFY OK: depth=0, C=US, ST=CA, L=LosAngeles, O=Private Internet Access, OU=Private Internet Access, CN=ontario413, name=ontario413
2023-12-17 19:08:48 2023-12-17 19:08:48 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA512
2023-12-17 19:08:48 2023-12-17 19:08:48 [ontario413] Peer Connection Initiated with [AF_INET]198.8.95.209:1198
2023-12-17 19:08:48 2023-12-17 19:08:48 PUSH: Received control message: 'PUSH_REPLY,comp-lzo no,redirect-gateway def1,route-ipv6 2000::/3,dhcp-option DNS 10.0.0.243,route-gateway 10.15.112.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.15.112.30 255.255.255.0,peer-id 5,cipher AES-128-GCM'
2023-12-17 19:08:48 2023-12-17 19:08:48 OPTIONS IMPORT: timers and/or timeouts modified
2023-12-17 19:08:48 2023-12-17 19:08:48 OPTIONS IMPORT: compression parms modified
2023-12-17 19:08:48 2023-12-17 19:08:48 OPTIONS IMPORT: --ifconfig/up options modified
2023-12-17 19:08:48 2023-12-17 19:08:48 OPTIONS IMPORT: route options modified
2023-12-17 19:08:48 2023-12-17 19:08:48 OPTIONS IMPORT: route-related options modified
2023-12-17 19:08:48 2023-12-17 19:08:48 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2023-12-17 19:08:48 2023-12-17 19:08:48 OPTIONS IMPORT: peer-id set
2023-12-17 19:08:48 2023-12-17 19:08:48 OPTIONS IMPORT: adjusting link_mtu to 1625
2023-12-17 19:08:48 2023-12-17 19:08:48 OPTIONS IMPORT: data channel crypto options modified
2023-12-17 19:08:48 2023-12-17 19:08:48 Data Channel: using negotiated cipher 'AES-128-GCM'
2023-12-17 19:08:48 2023-12-17 19:08:48 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
2023-12-17 19:08:48 2023-12-17 19:08:48 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
2023-12-17 19:08:48 2023-12-17 19:08:48 net_route_v4_best_gw query: dst 0.0.0.0
2023-12-17 19:08:48 2023-12-17 19:08:48 net_route_v4_best_gw result: via 172.18.0.1 dev eth0
2023-12-17 19:08:48 2023-12-17 19:08:48 ROUTE_GATEWAY 172.18.0.1/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:12:00:02
2023-12-17 19:08:48 2023-12-17 19:08:48 GDG6: remote_host_ipv6=n/a
2023-12-17 19:08:48 2023-12-17 19:08:48 net_route_v6_best_gw query: dst ::
2023-12-17 19:08:48 2023-12-17 19:08:48 sitnl_send: rtnl: generic error (-101): Network is unreachable
2023-12-17 19:08:48 2023-12-17 19:08:48 ROUTE6: default_gateway=UNDEF
2023-12-17 19:08:48 2023-12-17 19:08:48 TUN/TAP device tun0 opened
2023-12-17 19:08:48 2023-12-17 19:08:48 net_iface_mtu_set: mtu 1500 for tun0
2023-12-17 19:08:48 2023-12-17 19:08:48 net_iface_up: set tun0 up
2023-12-17 19:08:48 2023-12-17 19:08:48 net_addr_v4_add: 10.15.112.30/24 dev tun0
2023-12-17 19:08:48 2023-12-17 19:08:48 net_route_v4_add: 198.8.95.209/32 via 172.18.0.1 dev [NULL] table 0 metric -1
2023-12-17 19:08:48 2023-12-17 19:08:48 net_route_v4_add: 0.0.0.0/1 via 10.15.112.1 dev [NULL] table 0 metric -1
2023-12-17 19:08:48 2023-12-17 19:08:48 net_route_v4_add: 128.0.0.0/1 via 10.15.112.1 dev [NULL] table 0 metric -1
2023-12-17 19:08:48 2023-12-17 19:08:48 WARNING: OpenVPN was configured to add an IPv6 route. However, no IPv6 has been configured for tun0, therefore the route installation may fail or may not work as expected.
2023-12-17 19:08:48 2023-12-17 19:08:48 add_route_ipv6(2000::/3 -> :: metric -1) dev tun0
2023-12-17 19:08:48 2023-12-17 19:08:48 net_route_v6_add: 2000::/3 via :: dev tun0 table 0 metric -1
2023-12-17 19:08:48 2023-12-17 19:08:48 sitnl_send: rtnl: generic error (-13): Permission denied
2023-12-17 19:08:48 2023-12-17 19:08:48 ERROR: Linux IPv6 route can't be added
2023-12-17 19:08:48 Up script executed with device=tun0 ifconfig_local=10.15.112.30
2023-12-17 19:08:48 Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 10.15.112.30
2023-12-17 19:08:48 Using Combustion UI, overriding TRANSMISSION_WEB_HOME
2023-12-17 19:08:48 
2023-12-17 19:08:48 -------------------------------------
2023-12-17 19:08:48 Transmission will run as
2023-12-17 19:08:48 -------------------------------------
2023-12-17 19:08:48 User name:   root
2023-12-17 19:08:48 User uid:    0
2023-12-17 19:08:48 User gid:    0
2023-12-17 19:08:48 -------------------------------------
2023-12-17 19:08:48 
2023-12-17 19:08:48 Updating Transmission settings.json with values from env variables
2023-12-17 19:08:48 Attempting to use existing settings.json for Transmission
2023-12-17 19:08:48 Successfully used existing settings.json /config/transmission-home/settings.json
2023-12-17 19:08:48 Overriding bind-address-ipv4 because TRANSMISSION_BIND_ADDRESS_IPV4 is set to 10.15.112.30
2023-12-17 19:08:48 Overriding download-dir because TRANSMISSION_DOWNLOAD_DIR is set to /data
2023-12-17 19:08:48 Overriding incomplete-dir because TRANSMISSION_INCOMPLETE_DIR is set to /data/Incomplete
2023-12-17 19:08:48 Overriding rpc-password because TRANSMISSION_RPC_PASSWORD is set to [REDACTED]
2023-12-17 19:08:48 Overriding rpc-port because TRANSMISSION_RPC_PORT is set to 9091
2023-12-17 19:08:48 Overriding rpc-username because TRANSMISSION_RPC_USERNAME is set to [REDACTED]
2023-12-17 19:08:48 Overriding watch-dir because TRANSMISSION_WATCH_DIR is set to /data
2023-12-17 19:08:48 sed'ing True to true
2023-12-17 19:08:48 STARTING TRANSMISSION
2023-12-17 19:08:48 Provider PIA has a script for automatic port forwarding. Will run it now.
2023-12-17 19:08:48 If you want to disable this, set environment variable DISABLE_PORT_UPDATER=true
2023-12-17 19:08:48 Transmission startup script complete.
2023-12-17 19:08:48 2023-12-17 19:08:48 Initialization Sequence Completed
2023-12-17 19:08:53 Running functions for token based port fowarding
2023-12-17 19:08:53 Reserved Port: 50992  Sun Dec 17 19:08:53 EST 2023
2023-12-17 19:08:53 transmission auth required
2023-12-17 19:08:53 waiting for transmission to become responsive
2023-12-17 19:08:53 transmission became responsive
2023-12-17 19:08:53 setting transmission port to 50992
2023-12-17 19:08:53 localhost:9091/transmission/rpc/ responded: success
2023-12-17 19:08:53 Checking port...
2023-12-17 19:09:05 Port is open: Yes
2023-12-17 19:09:05 #######################
2023-12-17 19:09:05         SUCCESS        
2023-12-17 19:09:05 #######################
2023-12-17 19:09:05 Port: 50992
2023-12-17 19:09:05 Expiration Sun Feb 18 07:08:53 EST 2024
2023-12-17 19:09:05 #######################
2023-12-17 19:09:05 Entering infinite while loop
2023-12-17 19:09:05 Every 15 minutes, check port status