Solved --device /dev/net/tun not working anymore after Docker update 18.09.0-0513

Shadow · 31. May 2020

This morning I decided to update all my NAS'es. Running DSM updates and updating packages
One of the packages to be updated is Docker, going to version 18.09.0-0513 .

After the update, I noticed my NordVPN ( azinchen/nordvpn ) container no longer wants to reboot. After re-creating the container, I get this error message:

Code:

docker: Error response from daemon: linux runtime spec devices: error gathering device information while adding custom device "/dev/net/tun": no such file or directory.

The command I use to re-create the container is:

docker run -ti --cap-add=NET_ADMIN --device /dev/net/tun --name nordvpn4 --hostname nordvpn4 --restart=always --network physical_network_noproxy --ip 192.168.0.196 --dns 192.168.1.194 \

-e USER=[email protected] -e PASS='****' -e COUNTRY=Switzerland -e RECREATE_VPN_CRON="5 */3 * * *" -e NETWORK='192.168.0.0/24;192.168.1.0/24;192.168.3.0/24' -e RANDOM_TOP=10 -e TECHNOLOGY=OpenVPN -e PROTOCOL=openvpn_udp -e CATEGORY='Standard VPN servers' -e TZ='Europe\Amsterdam' -e OPENVPN_OPTS='--pull-filter ignore "ping-restart" --ping-exit 180' -p 8080:80 -d azinchen/nordvpn

According to the Docker Hub documentation the " --cap-add=NET_ADMIN --device /dev/net/tun" method is to give the container some extra, but restricted, priviliges to what it needs to run. This ofcourse has the preference then giving it full privileges.

Does anyone know what I can do to find a solution? I could try to start the container with full priviliges, but I'd rather not do that.
Should I open a ticket with Synology to ask why this method has stopped working?

one-eyed-king · 31. May 2020

Even though, I doubt that I can contribute a solution, i'd like to share some thoughts/details.

Judging be the man pages, I can see why a vpn container requires NET_ADMIN to perform actions that need privilged permissions.

https://www.man7.org/linux/man-pages/man7/capabilities.7.html said:
CAP_NET_ADMIN
Perform various network-related operations:
* interface configuration;
* administration of IP firewall, masquerading, and accounting;
* modify routing tables;
* bind to any address for transparent proxying;
* set type-of-service (TOS)
* clear driver statistics;
* set promiscuous mode;
* enabling multicasting;
* use setsockopt(2) to set the following socket options:
SO_DEBUG, SO_MARK, SO_PRIORITY (for a priority outside the
range 0 to 6), SO_RCVBUFFORCE, and SO_SNDBUFFORCE.

On a DS918+ I can not see either the device /dev/net or the subdevice /dev/net/tun. The --device argument just "passes in" an existing device. If it's not existing, there is nothing to pass-in.

You must have had something like a vpn client installed on the ds that actualy created the /dev/net/tun device for you. Are you sure you just updated the docker package and did nothing else?

Maybee, I am completly mistaken and it gets created magicaly (witch would kind of surprise me), but could someone with working vpn connection check his system if /dev/net/tun exists?

Deleted member 1158 · 31. May 2020

Hello,
Sorry i'm french

Download TUN.sh : https://download.gg/en/file-10531520_e405828393a12e7a
Or create :

Code:

#!/bin/sh

# Create the necessary file structure for /dev/net/tun
if ( [ ! -c /dev/net/tun ] ); then
  if ( [ ! -d /dev/net ] ); then
    mkdir -m 755 /dev/net
  fi
  mknod /dev/net/tun c 10 200
  chmod 0755 /dev/net/tun
fi

# Load the tun module if not already loaded
if ( !(lsmod | grep -q "^tun\s") ); then
  insmod /lib/modules/tun.ko
fi

In SSH :
( in example TUN.sh is located to /volume1/folder )
sudo su -

cd /volume1/folder

make executable
chmod 0755 TUN.sh

execute
./TUN.sh

Source : [TUTO] rtorrent/rutorrent au travers d'un VPN OpenVPN

Shadow · 31. May 2020

one-eyed-king said:
You must have had something like a vpn client installed on the ds that actualy created the /dev/net/tun device for you. Are you sure you just updated the docker package and did nothing else?

Well I also updated my DSM to 6.2.3-25426 ...

And isn't a VPN client available by default in DSM?

one-eyed-king said:
Maybee, I am completly mistaken and it gets created magicaly (witch would kind of surprise me), but could someone with working vpn connection check his system if /dev/net/tun exists?

Well when I discovered this, I held off updating my other NAS (DS718+) which is also running NordVPN docker containers. Sorry I'm a linux noob. How can I show you the /dev/net/tun, on that NAS?

one-eyed-king · 31. May 2020

My company is originated in france.. been a couple of times to paris for training

If the TUN.sh script creates the tun device and the loaded kernel module works, you should have /dev/net/tun, can you confirm that it exists?

Rusty · 31. May 2020

one-eyed-king said:
but could someone with working vpn connection check his system if /dev/net/tun exists

I have it on all my NAS regardless of VPN being active or not

Shadow · 31. May 2020

EVOTk said:
execute
./TUN.sh

What am I doing wrong?

Deleted member 1158 · 31. May 2020

The encoding of the file is not good.
Did you use the downloaded file or copy paste?

one-eyed-king · 31. May 2020

this is a typical encoding problem. You might want to edit the file in an editor like notepad++, sublime text3 or visual studio code, that allow you to change the symbols for line ending.

one-eyed-king · 31. May 2020

Rusty said:
I have it on all my NAS regardless of VPN being active or not

As the device is missing on my system, I was trying to figure out wheter you guys installed something that created it or my installation is just messed up ^^ Though, shadows post about the TUN.sh script makes be thing that it isn't there by default and is created by an installed package or an executed command...

Rusty · 31. May 2020

one-eyed-king said:
As the device is missing on my system, I was trying to figure out wheter you guys installed something that created it or my installation is just messed up ^^ Though, shadows post about the TUN.sh script makes be thing that it isn't there by default and is created by an installed package or an executed command...

Well on one nas I have never had a need to use vpn in any shape or form and yet, its there

Shadow · 31. May 2020

EVOTk said:
The encoding of the file is not good.
Did you use the downloaded file or copy paste?

one-eyed-king said:
As the device is missing on my system, I was trying to figure out wheter you guys installed something that created it or my installation is just messed up ^^ Though, shadows post about the TUN.sh script makes be thing that it isn't there by default and is created by an installed package or an executed command...

Funny enough I copy/pasted the contect in Notepad++ and saved it accordingly. So after that I downloaded it based on your replies.

EVOTk said:
Download TUN.sh : https://download.gg/en/file-10531520_e405828393a12e7a

And now it works! Also my NordVPN docker container is working again. Thank you all!

Now I can start updating my other NAS.

one-eyed-king said:
As the device is missing on my system, I was trying to figure out wheter you guys installed something that created it or my installation is just messed up ^^ Though, shadows post about the TUN.sh script makes be thing that it isn't there by default and is created by an installed package or an executed command...

I wouldn't know what it may be. The containers worked before..
And when setting up my new DS718+ I didn't do anything VPN related except for running the VPN client on vDSM, before moving to NordVPN on Docker..

one-eyed-king · 31. May 2020

I am glad that its working again!

Shadow said:
And when setting up my new DS718+ I didn't do anything VPN related except for running the VPN client on vDSM, before moving to NordVPN on Docker..

If NordVPN is not running in vDSM then it's unrelated.
I will have to live with this mystery ^^

Shadow · 2. Aug 2020

Hmm. This problem re-appeared after updating DSM to version 6.2.3-25426 Update 2 ...

Rusty · 10. Aug 2020

Shadow said:
Hmm. This problem re-appeared after updating DSM to version 6.2.3-25426 Update 2 ...

Have you tried this Fix TUN/TAP not available on a Synology NAS - Rui Marinho

I know for a fact that this works and has helped people that had problems with starting and running VPN docker containers.

Solved --device /dev/net/tun not working anymore after Docker update 18.09.0-0513

Currently reading
Solved --device /dev/net/tun not working anymore after Docker update 18.09.0-0513

Shadow

one-eyed-king

Deleted member 1158

Shadow

one-eyed-king

Rusty

Shadow

Deleted member 1158

one-eyed-king

one-eyed-king

Rusty

Shadow

one-eyed-king

Shadow

Rusty

Similar threads

Trending threads

Forum statistics

We value your privacy

Solved --device /dev/net/tun not working anymore after Docker update 18.09.0-0513

Currently reading Solved --device /dev/net/tun not working anymore after Docker update 18.09.0-0513

Deleted member 1158

Deleted member 1158

Similar threads

We value your privacy

Currently reading
Solved --device /dev/net/tun not working anymore after Docker update 18.09.0-0513