[SOLVED] PPP on multiple containers not working

[Shane Kindermans]

Hi,

I am trying to get PPPoE running on multiple containers. I have it running on my first container without any issues. Getting it up and running on the second one gives issues.

My initial setup for container 1:

Loaded the following modules on the host server and added them to /etc/modules.
modprobe tun
modprobe ppp-compress-18
modprobe ppp_mppe
modprobe ppp_deflate
modprobe ppp_async
modprobe pppoatm
modprobe ppp_generic

I added the following statement to the container config file under /var/lib/lxc/ct1/config
lxc.cgroup.devices.allow = c 108:0 rwm
This allows the use of /dev/ppp

Via a startup script I create the /dev/ppp device as it isn't auto created at boot.
mknod /dev/ppp c 108 0

All of this works fine, now adding the same allow statement to a second container config file doesn't work well as this lxc.cgroup.devices.allow line disappears after every reboot. I have created a 3rd container to check and there I have the same issue. Shutting down the first container also doens't help to get it running on the 2nd or 3rd container.
This results in following log under /var/log/pppd.log:
Couldn't open the /dev/ppp device: Operation not permitted
pppd: Sorry - this system lacks PPP kernel support

I am running Proxmox VE 5.3-11

Any help or insight on why this happens is highly appreciated!

Thanks,
Shane

 

[oguz]

hi.

I added the following statement to the container config file under /var/lib/lxc/ct1/config

that's the first mistake. config edits should be done in /etc/pve/lxc/CTID.conf or they won't be persistent.
that's probably why your stuff is disappearing from the container configs after reboot.

lxc.cgroup.devices.allow = c 108:0 rwm

also i think that may not be needed.

lxc.cap.keep = net_admin
lxc.mount.entry: /dev/ppp dev/ppp none bind,create=file

at the end of the container config should be enough.

also if your containers are unprivileged, you'll want to set the owner:group correctly outside of the host, since otherwise it'll have nobody:nobody and won't work[0].

Loaded the following modules on the host server and added them to /etc/modules.
modprobe tun
modprobe ppp-compress-18
modprobe ppp_mppe
modprobe ppp_deflate
modprobe ppp_async
modprobe pppoatm
modprobe ppp_generic

also idk if these ones are necessary. which guide are you following? maybe it's old.

[0]: https://forum.proxmox.com/threads/unprivileged-lxc-with-ppp.51928/#post-241213

 

[Shane Kindermans]

Hi Oguz,

Thanks for the quick response!

that's the first mistake. config edits should be done in /etc/pve/lxc/CTID.conf or they won't be persistent.
that's probably why your stuff is disappearing from the container configs after reboot.

That is exactly what was going wrong and what I was overlooking.

Code:
lxc.cap.keep = net_admin
lxc.mount.entry: /dev/ppp dev/ppp none bind,create=file

With the cap.keep my container won't boot no more and with the mount entry the /dev/ppp still gives Operation not permitted.
On the other hand adding lxc.cgroup.devices.allow = c 108:0 rwm to the config file makes my PPPoE connection work.

which guide are you following? maybe it's old.

I was following my own guide that I made after getting my first container up and running. Aparantly I made some mistakes in there.
I was asking myself the wrong questions as it looked like proxmox was not able to share /dev/ppp of the host between containers which it definitely can now.

Thanks for the help!
Shane

 

[oguz]

hi.

With the cap.keep my container won't boot no more and with the mount entry the /dev/ppp still gives Operation not permitted.

i think the "Operation not permitted" appears because /dev/ppp needs CAP_NET_ADMIN and those won't be transferred into an unprivileged container normally. can you run `getcap /dev/ppp` to see if it has the capabilities needed? also the user:group might be causing the permission denied.

but if everything works now, you can just leave it as is.

Thanks for the help!

you're very welcome. you can mark this thread [SOLVED] if you edit your first post.

 

[Shane Kindermans]

Hi Oguz,

i think the "Operation not permitted" appears because /dev/ppp needs CAP_NET_ADMIN and those won't be transferred into an unprivileged container normally. can you run `getcap /dev/ppp` to see if it has the capabilities needed? also the user:group might be causing the permission denied.

The getcap /dev/ppp returns nothing for me, also I am running privileged containers. user:group is root:root for me.
I will leave it as is for now. It's working perfect for me.