hassio-addons: [qbittorrent] Mullvad vpn : udp4 permission denied
Description
Long-time user. Addon doesn’t start after the 4.6.2 updates. I did read the breaking changes but fail to see what I need to do. I see the info about required password but the migration script did not add any. Tried adding QBT_PASSWORD: homeassistant into the config, to no avail. I use network SMB share and Mullvad VPN, have for years. HA 2023.12.1 as a Proxmox VM.
Reproduction steps
1. start addon
Addon Logs
2023-12-11 05:16:22 [INFO] Starting OpenVPN...
--------------------
2023-12-11 05:16:22 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
2023-12-11 05:16:22 WARNING: file '/config/openvpn/mullvad_cz_prg_credentials.conf' is group or others accessible
2023-12-11 05:16:22 OpenVPN 2.6.5 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2023-12-11 05:16:22 library versions: OpenSSL 3.1.4 24 Oct 2023, LZO 2.10
2023-12-11 05:16:22 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2023-12-11 05:16:22 TCP/UDP: Preserving recently used remote address: [AF_INET]146.70.129.162:1301
2023-12-11 05:16:22 Socket Buffers: R=[212992->1048576] S=[212992->1048576]
2023-12-11 05:16:22 UDPv4 link local: (not bound)
2023-12-11 05:16:22 UDPv4 link remote: [AF_INET]146.70.129.162:1301
2023-12-11 05:16:22 TLS: Initial packet from [AF_INET]146.70.129.162:1301, sid=7d24ce38 94fb0e7a
2023-12-11 05:16:22 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2023-12-11 05:16:22 VERIFY OK: depth=2, C=SE, ST=Gotaland, L=Gothenburg, O=Amagicom AB, OU=Mullvad, CN=Mullvad Root CA v2, emailAddress=security@mullvad.net
2023-12-11 05:16:22 VERIFY OK: depth=1, C=SE, ST=Gotaland, O=Amagicom AB, OU=Mullvad, CN=Mullvad Intermediate CA v6, emailAddress=security@mullvad.net
2023-12-11 05:16:22 VERIFY KU OK
2023-12-11 05:16:22 Validating certificate extended key usage
2023-12-11 05:16:22 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2023-12-11 05:16:22 VERIFY EKU OK
2023-12-11 05:16:22 VERIFY OK: depth=0, C=SE, ST=Gotaland, O=Amagicom AB, OU=Mullvad, CN=cz-prg-ovpn-101.mullvad.net, emailAddress=security@mullvad.net
2023-12-11 05:16:22 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, peer certificate: 4096 bit RSA, signature: RSA-SHA256
2023-12-11 05:16:22 [cz-prg-ovpn-101.mullvad.net] Peer Connection Initiated with [AF_INET]146.70.129.162:1301
2023-12-11 05:16:22 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
2023-12-11 05:16:22 TLS: tls_multi_process: initial untrusted session promoted to trusted
2023-12-11 05:16:23 SENT CONTROL [cz-prg-ovpn-101.mullvad.net]: 'PUSH_REQUEST' (status=1)
2023-12-11 05:16:24 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 10.15.0.1,redirect-gateway def1 bypass-dhcp,route-ipv6 0000::/2,route-ipv6 4000::/2,route-ipv6 8000::/2,route-ipv6 C000::/2,route-gateway 10.15.0.1,topology subnet,socket-flags TCP_NODELAY,ifconfig-ipv6 fdda:d0d0:cafe:1301::1002/64 fdda:d0d0:cafe:1301::,ifconfig 10.15.0.4 255.255.0.0,peer-id 2,cipher AES-256-GCM,protocol-flags cc-exit tls-ekm dyn-tls-crypt,tun-mtu 1500'
2023-12-11 05:16:24 Pushed option removed by filter: 'route-ipv6 0000::/2'
2023-12-11 05:16:24 Pushed option removed by filter: 'route-ipv6 4000::/2'
2023-12-11 05:16:24 Pushed option removed by filter: 'route-ipv6 8000::/2'
2023-12-11 05:16:24 Pushed option removed by filter: 'route-ipv6 C000::/2'
2023-12-11 05:16:24 Pushed option removed by filter: 'ifconfig-ipv6 fdda:d0d0:cafe:1301::1002/64 fdda:d0d0:cafe:1301::'
2023-12-11 05:16:24 OPTIONS IMPORT: --socket-flags option modified
2023-12-11 05:16:24 NOTE: setsockopt TCP_NODELAY=1 failed
2023-12-11 05:16:24 OPTIONS IMPORT: --ifconfig/up options modified
2023-12-11 05:16:24 OPTIONS IMPORT: route options modified
2023-12-11 05:16:24 OPTIONS IMPORT: route-related options modified
2023-12-11 05:16:24 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2023-12-11 05:16:24 OPTIONS IMPORT: tun-mtu set to 1500
2023-12-11 05:16:24 ROUTE_GATEWAY 172.30.32.1/255.255.254.0 IFACE=eth0 HWADDR=02:42:ac:1e:21:05
2023-12-11 05:16:24 TUN/TAP device tun0 opened
2023-12-11 05:16:24 /sbin/ip link set dev tun0 up mtu 1500
2023-12-11 05:16:24 /sbin/ip link set dev tun0 up
2023-12-11 05:16:24 /sbin/ip addr add dev tun0 10.15.0.4/16
2023-12-11 05:16:24 /sbin/ip route add 146.70.129.162/32 via 172.30.32.1
2023-12-11 05:16:24 /sbin/ip route add 0.0.0.0/1 via 10.15.0.1
2023-12-11 05:16:24 /sbin/ip route add 128.0.0.0/1 via 10.15.0.1
2023-12-11 05:16:24 Initialization Sequence Completed
2023-12-11 05:16:24 Data Channel: cipher 'AES-256-GCM', peer-id: 2
2023-12-11 05:16:24 Timers: ping 10, ping-restart 60
2023-12-11 05:16:24 Protocol options: protocol-flags cc-exit tls-ekm dyn-tls-crypt
--------------------
[cont-init.d] 02-vpn.sh: exited 0.
[cont-init.d] 03-network.sh: executing...
2023-12-11 05:16:25 [INFO] Adding localhost as route via docker eth0
2023-12-11 05:16:25 [WARNING] Error adding route for localhost. The web interface won't be reachable for the affected network
2023-12-11 05:16:25 [INFO] Adding 127.0.0.1 as route via docker eth0
2023-12-11 05:16:25 [INFO] Adding 172.30.0.0/16 as route via docker eth0
2023-12-11 05:16:25 [INFO] Adding 192.168.0.0/16 as route via docker eth0
2023-12-11 05:16:25 [INFO] Adding additional incoming port 59595 for eth0
2023-12-11 05:16:25 [INFO] Adding additional incoming port 6882 for eth0
2023-12-11 05:16:25 [INFO] Adding additional outgoing port 59595 for eth0
2023-12-11 05:16:25 [INFO] Adding additional outgoing port 6882 for eth0
[cont-init.d] 03-network.sh: exited 0.
[cont-init.d] 03-nginx_ssl.sh: executing...
[cont-init.d] 03-nginx_ssl.sh: exited 0.
[cont-init.d] 04-qbittorrent-setup.sh: executing...
2023-12-11 05:16:25 [WARNING] ENABLE_SSL is set to no, SSL is not enabled. This could cause issues with logging if other apps use the same Cookie name (SID).
2023-12-11 05:16:25 [WARNING] If you manage the SSL config yourself, you can ignore this.
2023-12-11 05:16:25 [WARNING] UMASK not defined (via -e UMASK), defaulting to '002'
[cont-init.d] 04-qbittorrent-setup.sh: exited 0.
[cont-init.d] 05-install.sh: executing...
[cont-init.d] 05-install.sh: exited 0.
[cont-init.d] 90-dns_set.sh: executing...
2023-12-11 05:16:25 write UDPv4 []: Operation not permitted (fd=3,code=1)
[05:16:35] WARNING: DNS 8.8.8.8 was requested but can't be pinged. It won't be used
2023-12-11 05:16:35 write UDPv4 []: Operation not permitted (fd=3,code=1)
[05:16:45] WARNING: DNS 1.1.1.1 was requested but can't be pinged. It won't be used
2023-12-11 05:16:45 write UDPv4 []: Operation not permitted (fd=3,code=1)
[05:16:55] WARNING: DNS 192.168.0.1 was requested but can't be pinged. It won't be used
[05:16:55] WARNING: No valid DNS were found. Using default router (or HA) dns servers.
[cont-init.d] 90-dns_set.sh: exited 0.
[cont-init.d] 91-qbittorrent_configuration.sh: executing...
2023-12-11 05:16:55 write UDPv4 []: Operation not permitted (fd=3,code=1)
[05:16:55] INFO: Downloads can be found in /mnt/Public/Downloads
2023-12-11 05:17:06 write UDPv4 []: Operation not permitted (fd=3,code=1)
2023-12-11 05:17:16 write UDPv4 []: Operation not permitted (fd=3,code=1)
2023-12-11 05:17:24 [cz-prg-ovpn-101.mullvad.net] Inactivity timeout (--ping-restart), restarting
2023-12-11 05:17:24 SIGUSR1[soft,ping-restart] received, process restarting
2023-12-11 05:17:24 Restart pause, 1 second(s)
2023-12-11 05:17:25 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2023-12-11 05:17:25 TCP/UDP: Preserving recently used remote address: [AF_INET]146.70.129.162:1301
2023-12-11 05:17:25 Socket Buffers: R=[212992->1048576] S=[212992->1048576]
2023-12-11 05:17:25 NOTE: setsockopt TCP_NODELAY=1 failed
2023-12-11 05:17:25 UDPv4 link local: (not bound)
2023-12-11 05:17:25 UDPv4 link remote: [AF_INET]146.70.129.162:1301
2023-12-11 05:17:25 write UDPv4 []: Operation not permitted (fd=3,code=1)
2023-12-11 05:17:28 write UDPv4 []: Operation not permitted (fd=3,code=1)
2023-12-11 05:17:32 write UDPv4 []: Operation not permitted (fd=3,code=1)
2023-12-11 05:17:40 write UDPv4 []: Operation not permitted (fd=3,code=1)
2023-12-11 05:17:56 write UDPv4 []: Operation not permitted (fd=3,code=1)
### Architecture
amd64
### OS
Virtual Machine
About this issue
- Original URL
- State: closed
- Created 7 months ago
- Comments: 66 (34 by maintainers)
Commits related to this issue
- Update Dockerfile https://github.com/alexbelgium/hassio-addons/issues/1127#issuecomment-1854317550 — committed to alexbelgium/hassio-addons by alexbelgium 7 months ago
- ovpn sanitization https://github.com/alexbelgium/hassio-addons/issues/1127 — committed to alexbelgium/hassio-addons by alexbelgium 7 months ago
- Update run https://github.com/alexbelgium/hassio-addons/issues/1127#issuecomment-1867877534 — committed to alexbelgium/hassio-addons by alexbelgium 6 months ago
it’s all rather brittle and hard to diagnose, but we’ve made it .) thanks!
I tried with your script changing only
ca mullvad_ca.crt
toca /etc/openvpn/mullvad_ca.crt
and it worked too!Here is my config :
thank you for sticking with it 😃 i do enjoy it very much
So I was indeed placing the new VPN config files in the wrong folder AGAIN (/config/openvpn instead of /addon_config/db21ed7f_qbittorrent/openvpn - please update the addon’s docs as they tell me to put it in /config/openvpn) 😃 But even in the correct folder it does THIS
that’s new… hanging on this for half an hour now
Wow, that is crazy. When wireguard is in the right place, i get this:
Trying empty line in ovpn next, thats even more insane 😃))
(BTW I do have valid Mullvad sub, I have had similar errors before when it ran out, but thats not the case now)
I might be a complete eejit but I only see “Sponsoring” which is where I see you sponsor Frenck but no way for me to tip you 😃
I have paid for a mullvad account and can replicate with your exact setup. Therefore I’ll be able to provide a solution. A quick one could be to use the TCP config instead of UDP, but I’ll see for another solution.
With the new script I see this repeating bit:
2023-12-12 15:32:10 Restart pause, 1 second(s) 2023-12-12 15:32:11 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2023-12-12 15:32:11 NOTE: --fast-io is disabled since we are not using UDP 2023-12-12 15:32:11 TCP/UDP: Preserving recently used remote address: [AF_INET]146.70.129.162:1301 2023-12-12 15:32:11 Socket Buffers: R=[131072->1048576] S=[16384->1048576] 2023-12-12 15:32:11 Attempting to establish TCP connection with [AF_INET]146.70.129.162:1301 2023-12-12 15:34:11 TCP: connect to [AF_INET]146.70.129.162:1301 failed: Operation timed out 2023-12-12 15:34:11 SIGUSR1[connection failed(soft),connection-failed] received, process restarting 2023-12-12 15:34:11 Restart pause, 1 second(s) 2023-12-12 15:34:12 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2023-12-12 15:34:12 NOTE: --fast-io is disabled since we are not using UDP 2023-12-12 15:34:12 TCP/UDP: Preserving recently used remote address: [AF_INET]217.138.199.82:1301 2023-12-12 15:34:12 Socket Buffers: R=[131072->1048576] S=[16384->1048576] 2023-12-12 15:34:12 Attempting to establish TCP connection with [AF_INET]217.138.199.82:1301 2023-12-12 15:34:12 TCP: connect to [AF_INET]217.138.199.82:1301 failed: Connection refused 2023-12-12 15:34:12 SIGUSR1[connection failed(soft),connection-failed] received, process restarting 2023-12-12 15:34:12 Restart pause, 1 second(s) 2023-12-12 15:34:13 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2023-12-12 15:34:13 NOTE: --fast-io is disabled since we are not using UDP 2023-12-12 15:34:13 TCP/UDP: Preserving recently used remote address: [AF_INET]185.216.35.242:1301 2023-12-12 15:34:13 Socket Buffers: R=[131072->1048576] S=[16384->1048576] 2023-12-12 15:34:13 Attempting to establish TCP connection with [AF_INET]185.216.35.242:1301
here’s the output:
This is my ovpn file: