GUIDE: Setting up Transmission with OpenVPN and PIA

[saeed]

Hi, I'm hoping someone might have an idea.... I have modifed the process to suit my vpn provider and I'm getting the following error

Sun Apr 12 03:40:15 2015 Could not retrieve default gateway from route socket:: No such process (errno=3)
Sun Apr 12 03:40:15 2015 Cannot allocate TUN/TAP dev dynamically
Sun Apr 12 03:40:15 2015 Exiting due to fatal error

To me that says that it cannot create of find a tun interface to use. Has anyone had issues in getting the tunnel interface to work? Do I need to create a tunnel interface outside of the jail?

thanks in adavnce

I am new here and I have the same problem..Would somebody please help us fix this error?

 

[saeed]

I am new here and I have the same problem..Would somebody please help us fix this error?

Actually never mind. I found the problem..It is because I unchecked the "vimage" option when I first created the jail. I recreated it with the "vimage" option checked and it worked like a charm! :)

 

[denist]

ok i sorted the firewall rules and used yours now i keep getting permission denied when i ping google and transmission not working im guessing i need to change something in the ipfw rules...

not sure about the script.
denis

 

[denist]

any ideas

my freenas is a n40l hp microserver.

freenas ip is 192.168.2.250

jail ip is 192.168.2.253

and the router ip is 192.168.2.254

 

[denist]

and using pia also

 

[denist]

there is this firewall rules

1. ipfw -f flush
2. 
   
3. ipfw -q add 00010 allow ip from any to any via tun0
4. 
   
5. ipfw -q add 00101 allow ip from me to 10.0.0.0/24 via epair0b uid transmission
6. ipfw -q add 00102 allow ip from 10.0.0.0/24 to me via epair0b uid transmission
7. ipfw -q add 00103 deny ip from any to any via epair0b uid transmission
8. 
   
9. ipfw -q add 65535 allow all from any to any

but when i use it it say cant find transmission

i guess the epairob is the problem

how can you find the netwrok interface.... from freenas jail.

 

[Rilo Ravestein]

You shouldn't ask the same question in different threads, forum guards usually don't like that. I'll respond on the other thread later, have to finish some work for the higher management (aka wife) first

 

[denist]

i didnt know which thread i responded to but i fixed that error that was in the other thread as i had type instead of script thats why i was getting the error

the question in this thread was regarding the permission denied. and for what ip i should put...

 

[denist]

is this the cron for every min u r using


* * * * * root sh /sabnzbd/scripts/script.sh

or you dont use root.

 

[Rilo Ravestein]

Sorry for the delay. As far as i know i only have

Code:

jexec jailname /path/to/script.sh

So no 'root' and no 'sh'. I am at work now, so i cannot check. Will be late this evening before i can get to it. Make sure the file is executable.
Question, why you put it in sab folder?

 

[denist]

Cool that's ok

I think I just have ip rules error where I have to play with tonight.


Sent from my iPhone using Tapatalk

 

[denist]

ok when i start ipfw service using you script ipfw_rules i get this in the output.

Flushed all rules.
01006 allow ip from 192.168.2.0/24 to 192.168.2.0/24
/sabnzbd/scripts/ipfw_rules: keep-state: not found
ipfw: hostname ``xxx.xxx.xxx.xxx'' unknown
/sabnzbd/scripts/ipfw_rules: keep-state: not found
04000 allow ip from 127.0.0.1 to any
65534 deny ip from any to any
Firewall rules loaded.

when i run the script the one you used i get this as output.

script.sh: changed: not found
New IP Address
Flushed all rules.
ipfw: missing dst address
script.sh: 37.235.1.174: not found
ipfw: missing dst address
script.sh: 37.235.1.177: not found
ipfw: missing dst address
script.sh: 192.168.2.0/24: not found
ipfw: missing dst address
script.sh: 37.48.80.165: not found
04000 allow ip from 127.0.0.1 to any
05000 allow ip from 10.176.1.6 to any
05002 allow ip from any to 10.176.1.6
05004 allow ip from 10.176.1.5 to any
05006 allow ip from any to 10.176.1.5
65534 deny ip from any to any

from what i can see i need to change some stuff. so i can access transmission sabnzbd and couchpotato, and sickrage. also have nginx installed also.

just to recap my ip address is as follows

Freenas Box Is on 192.168.2.250

Jail is on 192.168.2.253 which has all the above installed

and router ip is 192.168.2.254

what i am trying to figure out is what do i change so i can understand it...

Thanx

Denis

 

[denist]

the ipfw_rules are these

#!/bin/sh

# Set rules command prefix
fwcmd="/sbin/ipfw"

# Flush out the list before we begin.
${fwcmd} -f flush

${fwcmd} add 01006 allow ip from 192.168.2.0/24 to 192.168.2.0/24 keep-state
${fwcmd} add 02000 allow ip from 192.168.2.0/24 to xxx.xxx.xxx.xxx keep-state
${fwcmd} add 04000 allow ip from 127.0.0.1 to any
${fwcmd} add 65534 deny ip from any to any
echo "" > /sabnzbd/scripts/Firewall_IP.log

the script which i have set to run every minute is as follows.

!/bin/sh

export IP_ADDR_1=""
export IP_ADDR_2=""

# Main Routines
###########
write_file ()
{
# Write the IP Address to Firewall_IP.log
echo "${IP_ADDR_1}" > /sabnzbd/scripts/Firewall_IP.log
echo "${IP_ADDR_2}" >> /sabnzbd/scripts/Firewall_IP.log
quit
}

###########
quit ()
{
exit 0
}

###########
check_ip ()
{
# Lets see what the current values are:
IP_ADDR_1="$(/sbin/ifconfig | grep 'inet 10.' | cut -d" " -f2)"
IP_ADDR_2="$(/sbin/ifconfig | grep 'inet 10.' | cut -d" " -f4)"
# Lets see what the previous values are:
TEMP1="$(sed '1q;d' /sabnzbd/scripts/Firewall_IP.log)"
TEMP2="$(sed '2q;d' /sabnzbd/scripts/Firewall_IP.log)"
# Lets compare
if [ "${TEMP1}" = "$IP_ADDR_1" ] && [ "${TEMP2}" = "$IP_ADDR_2" ]
then
# IP has not changed
echo No change required
quit
else
# IP has changed
set_rules
fi
}

###########
set_rules ()
{
# This function is only called if one of the IP addresses has changed
if [ "$IP_ADDR_1" != "" ] && [ "$IP_ADDR_2" != "" ]
then
echo "New IP Address"
# Flush the current rules
fwcmd="/sbin/ipfw"
${fwcmd} -f flush
# Set New OpenVPN Rules
${fwcmd} add 01000 allow log udp from 192.168.2.0/24 to 37.235.1.174 dst-port 53 keep-state #DNS IP 1
${fwcmd} add 01002 allow log udp from 192.168.2.0/24 to 37.235.1.177 dst-port 53 keep-state #DNS IP 1
${fwcmd} add 01006 allow ip from 192.168.2.0/24 to 192.168.2.0/24 keep-state
${fwcmd} add 02000 allow ip from 192.168.2.0/24 to 37.48.80.165 keep-state #VPN IP
${fwcmd} add 04000 allow ip from 127.0.0.1 to any
${fwcmd} add 05000 allow ip from "${IP_ADDR_1}" to any
${fwcmd} add 05002 allow ip from any to "${IP_ADDR_1}"
${fwcmd} add 05004 allow ip from "${IP_ADDR_2}" to any
${fwcmd} add 05006 allow ip from any to "${IP_ADDR_2}"
${fwcmd} add 65534 deny ip from any to any
write_file
else
echo No IP Address found, Change to default rules
set_default_rules
write_file
fi
}

###########
set_default_rules ()
{
# Flush the current rules
fwcmd="/sbin/ipfw"
${fwcmd} -f flush
# Default setup for when there is no VPN tunnel.
${fwcmd} add 01006 allow ip from 192.168.2.0/24 to 192.168.2.0/24 keep-state
${fwcmd} add 02000 allow ip from 192.168.2.0/24 to 37.48.80.165 keep-state
${fwcmd} add 04000 allow ip from 127.0.0.1 to any
${fwcmd} add 65534 deny ip from any to any
}

# Main Program
check_ip
exit

 

[denist]

thenax to Rilo Ravestein


also i have the script in the sab folder as i ahve my other scripts there also.

 

[Rilo Ravestein]

thenax to Rilo Ravestein.

Does this mean you got it working?

 

[denist]

No I haven't yet when I turn on the ipfw ms the script it stops everything I was just putting in the values I was using to see if someone can see what is wrong with mine


Sent from my iPhone using Tapatalk

 

[Rilo Ravestein]

You have to replace all IP addresses and xx.xxx.xxx.xxx things in the script to reflect your network & DNS settings.
Its marked with DNS IP 1, DNS IP 2 (you set your DNS servers in the /etc/rc.conf file), VPN IP (that is the VPN remote server address OpenVPN connects with. It's in your VPN provider's config file). Addresses for you local LAN seem to be correct. Provided that your local VPN address (tun) is in the 10.xx range, the script will fill in the other IP addresses for that.

 

[denist]

Is this only in the script or both the ipfw rules


Sent from my iPhone using Tapatalk

 

[denist]

My config file is Pia so I'm not sure what the address us


Sent from my iPhone using Tapatalk

 

[denist]

When I open it it does not have a IP address it has

Client
Dev tun
Proto udp
Remote server address
Nobind
Persist-key
Persist-tun
Location for ca.crt
Tls-client
Remote-very
Auth-user-pass
Comp-lzo
Verb 1
Reneg-sec 0
Crl-verify location
Auth user location


Sent from my iPhone using Tapatalk