RTNETLINK answers: Permission denied

[SamSepiolProxy]

Describe the problem
I am currently using mullvad VPN and when trying to connect I get the following error: RTNETLINK answers: Permission denied.

Logs

2019-11-29 02:11:41	stdout	adding route to local network 192.168.0.0/24 via 172.17.0.1 dev eth0
2019-11-29 02:11:41	stdout	Setting OPENVPN credentials...
2019-11-29 02:11:41	stdout	Starting OpenVPN using config default.ovpn
2019-11-29 02:11:41	stdout	Using OpenVPN provider: CUSTOM
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 Exiting due to fatal error
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 Linux ip -6 addr add failed: external program exited with error status: 2
2019-11-29 02:11:36	stdout	RTNETLINK answers: Permission denied
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 /sbin/ip -6 addr add fdda:d0d0:cafe:443::1007/64 dev tun0
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 /sbin/ip addr add dev tun0 10.5.0.9/16 broadcast 10.5.255.255
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 /sbin/ip link set dev tun0 up mtu 1500
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=1
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 TUN/TAP TX queue length set to 100
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 TUN/TAP device tun0 opened
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 ROUTE6: default_gateway=UNDEF
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 GDG6: remote_host_ipv6=n/a
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 ROUTE_GATEWAY ****** IFACE=eth0 HWADDR=**
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 Data Channel: using negotiated cipher 'AES-256-GCM'
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 OPTIONS IMPORT: data channel crypto options modified
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 OPTIONS IMPORT: adjusting link_mtu to 1626
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 OPTIONS IMPORT: peer-id set
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 OPTIONS IMPORT: route-related options modified
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 OPTIONS IMPORT: route options modified
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 OPTIONS IMPORT: --ifconfig/up options modified
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 Socket flags: TCP_NODELAY=1 succeeded
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 OPTIONS IMPORT: --socket-flags option modified
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 OPTIONS IMPORT: compression parms modified
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 10.5.0.1,redirect-gateway def1 bypass-dhcp,route-ipv6 0000::/2,route-ipv6 4000::/2,route-ipv6 8000::/2,route-ipv6 C000::/2,comp-lzo no,route-gateway 10.5.0.1,topology subnet,socket-flags TCP_NODELAY,ifconfig-ipv6 fdda:d0d0:cafe:443::1007/64 fdda:d0d0:cafe:443::,ifconfig 10.5.0.9 255.255.0.0,peer-id 0,cipher AES-256-GCM'
2019-11-29 02:11:36	stdout	Fri Nov 29 02:11:36 2019 SENT CONTROL [se-got-002.mullvad.net]: 'PUSH_REQUEST' (status=1)
2019-11-29 02:11:31	stdout	Fri Nov 29 02:11:31 2019 SENT CONTROL [se-got-002.mullvad.net]: 'PUSH_REQUEST' (status=1)
2019-11-29 02:11:30	stdout	Fri Nov 29 02:11:30 2019 [se-got-002.mullvad.net] Peer Connection Initiated with [AF_INET]185.213.154.132:443
2019-11-29 02:11:30	stdout	Fri Nov 29 02:11:30 2019 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
2019-11-29 02:11:30	stdout	Fri Nov 29 02:11:30 2019 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2019-11-29 02:11:30	stdout	Fri Nov 29 02:11:30 2019 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1559', remote='link-mtu 1560'
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 VERIFY OK: depth=0, C=SE, ST=Gotaland, O=Amagicom AB, OU=Mullvad, CN=se-got-002.mullvad.net, emailAddress=security@mullvad.net
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 VERIFY EKU OK
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 Validating certificate extended key usage
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 VERIFY KU OK
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 VERIFY OK: depth=1, C=SE, ST=Gotaland, O=Amagicom AB, OU=Mullvad, CN=Mullvad Intermediate CA v2, emailAddress=security@mullvad.net
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 VERIFY OK: depth=2, C=SE, ST=Gotaland, L=Gothenburg, O=Amagicom AB, OU=Mullvad, CN=Mullvad Root CA v2, emailAddress=security@mullvad.net
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 TLS: Initial packet from [AF_INET]185.213.154.132:443, sid=c1d1efc0 fcd77d94
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 TCP_CLIENT link remote: [AF_INET]185.213.154.132:443
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 TCP_CLIENT link local: (not bound)
2019-11-29 02:11:29	stdout	Fri Nov 29 02:11:29 2019 TCP connection established with [AF_INET]185.213.154.132:443
2019-11-29 02:11:28	stdout	Fri Nov 29 02:11:28 2019 Attempting to establish TCP connection with [AF_INET]185.213.154.132:443 [nonblock]
2019-11-29 02:11:28	stdout	Fri Nov 29 02:11:28 2019 Socket Buffers: R=[87380->425984] S=[16384->425984]
2019-11-29 02:11:28	stdout	Fri Nov 29 02:11:28 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]185.213.154.132:443
2019-11-29 02:11:28	stdout	Fri Nov 29 02:11:28 2019 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2019-11-29 02:11:28	stdout	Fri Nov 29 02:11:28 2019 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
2019-11-29 02:11:28	stdout	Fri Nov 29 02:11:28 2019 OpenVPN 2.4.6 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2018
2019-11-29 02:11:28	stdout	Fri Nov 29 02:11:28 2019 Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.
2019-11-29 02:11:28	stdout	adding route to local network ***** via ******* dev eth0

Host system:
Synology NAS

I found running the commands sysctl net.ipv6.conf.all.disable_ipv6=0 fixed the issue. I am unsure if this an issue with my setup or the container itself

[starkgate]

Same problem here on a QNAP NAS. Adding --sysctl net.ipv6.conf.all.disable_ipv6=0 to the docker command as suggested in #279 solved the problem.

[SamSepiolProxy]

Thanks :) The synology nas is a bit weird in the fact it wants you to use the GUI. When trying to do via ssh it just seems to fail in my case. I have no issues with the image on my desktop though. If anyone has any experience of building an image for the synology nas I would be interested to hear how they did it.

[Motophan]

Hi, sending a sysctl command is no longer possible in current versions of docker, is this possible to fix?

[steelcowboy]

This might be somewhat related to dperson/openvpn-client#75, although I'm having issues finding anything within the last few months that changed this functionality :/

[ghost]

I'm running into the exact same issue as @SamSepiolProxy with Mullvad and this image. Adding this to my docker compose config (for this image) fixed it:

sysctls:
  - net.ipv6.conf.all.disable_ipv6=0

See: dperson/openvpn-client#75

[steelcowboy]

I'm wondering if this could be related? moby/moby#5618

I never saw this message until I set this setting, but I don't know enough about networking to know if somehow disabling IPv6 could leave a network in a bad state. Maybe it's trying to destroy the IPv6 interface (e.g. docker brings it up before reading the sysctl) and it's hanging the system?

[ghost]

Mullvad uses ipv6 with their vpn. Not sure how or why, but it's apparently necessary for their vpn to work. Which is why things break if ipv6 is not available.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

Note: The stale bot was recently added to this project to help weed out outdated issues. This will help us to focus time and energy on issues that are important and move the others out of the way. There could however be many issues that are still relevant but have gotten old without ever being fixed. As this is the first round of cleaning it might have been too eager. Feel free to re-open this issue if you think it deserves another look.

[joeblack2k]

Yes same here, on DSM Synology.. is there a ENV to disable IPV6? its useless anyway