Synology - ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1), Container goes to Fatal

[TRBrennan]

Describe the problem
After updating to the latest tag on my Synology NAS when trying to start the container, it ends up going to Fatal. Was working on older versions with no issues.

Add your docker run command
{
"cap_add" : null,
"cap_drop" : null,
"cmd" : "dumb-init /etc/openvpn/start.sh",
"cpu_priority" : 50,
"devices" : null,
"enable_publish_all_ports" : false,
"enable_restart_policy" : false,
"enabled" : true,
"env_variables" : [
{
"key" : "OPENVPN_CONFIG",
"value" : "CA Toronto"
},
{
"key" : "PATH",
"value" : "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
},
{
"key" : "OPENVPN_USERNAME",
"value" : "XXXXX"
},
{
"key" : "OPENVPN_PASSWORD",
"value" : "XXXXXX"
},
{
"key" : "OPENVPN_PROVIDER",
"value" : "pia"
},
{
"key" : "GLOBAL_APPLY_PERMISSIONS",
"value" : "true"
},
{
"key" : "TRANSMISSION_HOME",
"value" : "/data/transmission-home"
},
{
"key" : "TRANSMISSION_RPC_PORT",
"value" : "9091"
},
{
"key" : "TRANSMISSION_DOWNLOAD_DIR",
"value" : "/data/completed"
},
{
"key" : "TRANSMISSION_INCOMPLETE_DIR",
"value" : "/data/incomplete"
},
{
"key" : "TRANSMISSION_WATCH_DIR",
"value" : "/data/watch"
},
{
"key" : "CREATE_TUN_DEVICE",
"value" : "true"
},
{
"key" : "ENABLE_UFW",
"value" : "false"
},
{
"key" : "UFW_ALLOW_GW_NET",
"value" : "false"
},
{
"key" : "UFW_EXTRA_PORTS",
"value" : ""
},
{
"key" : "UFW_DISABLE_IPTABLES_REJECT",
"value" : "false"
},
{
"key" : "PUID",
"value" : "1024"
},
{
"key" : "PGID",
"value" : "101"
},
{
"key" : "DROP_DEFAULT_ROUTE",
"value" : ""
},
{
"key" : "WEBPROXY_ENABLED",
"value" : "false"
},
{
"key" : "WEBPROXY_PORT",
"value" : "8888"
},
{
"key" : "WEBPROXY_USERNAME",
"value" : ""
},
{
"key" : "WEBPROXY_PASSWORD",
"value" : ""
},
{
"key" : "LOG_TO_STDOUT",
"value" : "false"
},
{
"key" : "HEALTH_CHECK_HOST",
"value" : "google.com"
},
{
"key" : "REVISION",
"value" : "baed33520630e88ba34842cab05f2cd3fd6cf28f"
}
],
"exporting" : false,
"id" : "4280c3f25db51ae7127ff47b2c6339df15842791b7575b2dd96091df488b2531",
"image" : "haugene/transmission-openvpn:latest",
"is_ddsm" : false,
"is_package" : false,
"links" : [],
"memory_limit" : 0,
"name" : "TransmissionVPN",
"network" : [
{
"driver" : "bridge",
"name" : "bridge"
}
],
"network_mode" : "bridge",
"port_bindings" : [
{
"container_port" : 7878,
"host_port" : 7878,
"type" : "tcp"
},
{
"container_port" : 8989,
"host_port" : 8989,
"type" : "tcp"
},
{
"container_port" : 9091,
"host_port" : 9091,
"type" : "tcp"
},
{
"container_port" : 9117,
"host_port" : 9117,
"type" : "tcp"
}
],
"privileged" : false,
"shortcut" : {
"enable_shortcut" : false
},
"use_host_network" : false,
"volume_bindings" : [
{
"host_volume_file" : "/Downloads",
"mount_point" : "/data",
"type" : "rw"
},
{
"host_volume_file" : "/VPN/resolv.conf",
"mount_point" : "/etc/resolv.conf",
"type" : "rw"
}
]
}

Logs

date	stream	content
2020-11-23 16:29:52	stdout	Mon Nov 23 16:29:52 2020 Exiting due to fatal error
2020-11-23 16:29:52	stdout	Mon Nov 23 16:29:52 2020 ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
2020-11-23 16:29:52	stdout	Mon Nov 23 16:29:52 2020 OpenVPN ROUTE: failed to parse/resolve route for host/network: 2000::/3
2020-11-23 16:29:52	stdout	Mon Nov 23 16:29:52 2020 OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
2020-11-23 16:29:51	stdout	Mon Nov 23 16:29:51 2020 [toronto423] Peer Connection Initiated with [AF_INET]154.3.42.51:1198
2020-11-23 16:29:50	stdout	Mon Nov 23 16:29:50 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2020-11-23 16:29:50	stdout	Mon Nov 23 16:29:50 2020 UDP link remote: [AF_INET]154.3.42.51:1198
2020-11-23 16:29:50	stdout	Mon Nov 23 16:29:50 2020 UDP link local: (not bound)
2020-11-23 16:29:50	stdout	Mon Nov 23 16:29:50 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]154.3.42.51:1198
2020-11-23 16:29:50	stdout	Mon Nov 23 16:29:50 2020 CRL: loaded 1 CRLs from file [[INLINE]]
2020-11-23 16:29:50	stdout	Mon Nov 23 16:29:50 2020 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2020-11-23 16:29:50	stdout	Mon Nov 23 16:29:50 2020 library versions: OpenSSL 1.1.1g  21 Apr 2020, LZO 2.10
2020-11-23 16:29:50	stdout	Mon Nov 23 16:29:50 2020 OpenVPN 2.4.9 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 20 2020
2020-11-23 16:29:50	stdout	Setting OpenVPN credentials...
2020-11-23 16:29:50	stdout	Modifying /etc/openvpn/pia/CA Toronto.ovpn for best behaviour in this container
2020-11-23 16:29:50	stdout	Starting OpenVPN using config CA Toronto.ovpn
2020-11-23 16:29:50	stdout	Extract OpenVPN config bundle into PIA directory /etc/openvpn/pia
2020-11-23 16:29:50	stdout	Downloading OpenVPN config bundle openvpn-nextgen into temporary file /tmp/tmp.laBOgD
2020-11-23 16:29:50	stdout	Provider pia has a custom setup script, executing it
2020-11-23 16:29:50	stdout	Using OpenVPN provider: PIA
2020-11-23 16:29:50	stdout	Creating TUN device /dev/net/tun
2020-11-23 16:29:50	stdout	Starting container with revision: baed33520630e88ba34842cab05f2cd3fd6cf28f

Host system:
Synology

[xoverride]

Please add --cap-add=NET_ADMIN

[MartenvanWezel]

I've managed to fix this by enabling 'run as administrator' but that's not an elegant fix, and it means that evil haugene could do stuff to your system ;)

Slight addendum, in some documentation there is a 'tun.sh' script that indeed creates a tunnel. I tried that instead, even chown-ing it to the transmission user but it didnt help.

[haugene]

😈

I think we might need to bring the Synology tun.sh script back into the docs. I thought that the creation of the interface within the container was a cross-platform solution but it seems some are reporting errors on it. Weirdly it seems that it works for other. Might be version of the synology software, i don't know.

But you have no success with that script @MartenvanWezel? Running it on synology, then mounting the device and setting CREATE_TUN_DEVICE=false?

[Beholder1984]

I have the same issue on my DS1621+. I cannot seem to run the docker without "high privileges".

I cannot seem to find any information about how to run the tun.sh script. Can you point me in the right direction @haugene ?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[esimonds]

I just had the same issue on a DS920+ running DSM 7 Beta and revision c9200cb. I do not have "high privileges" enabled.

ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)

[pkishino]

could this help resolve the problem? discussion around startup script for synology : #1542

[avillev]

It works without enabling high privileges by giving that permission to the container: "NET_ADMIN"