LCX Containers: VPN client won't connect OpenVPN, Wireguard GO

[squirrelbeach]

PIA's VPN client will login, but not connect on LCX containers.

The same configuration does work with a debian 12 VM running under proxmox.

Tested and not working with:

• debian-12-standard_12.2-1_amd64.tar.zst privileged
• debian-12-standard_12.2-1_amd64.tar.zst non-privileged
• ubuntu-24.04-standard_24.04-2_amd64.tar.zst non-privileged

The end result with either OpenVPN or Wireguard is that the TUN device fails to be created:

wireguard:

[src/posix/wireguardgobackend.cpp:440][info] wireguard-go: ERROR: (wgpia0) 2024/08/22 02:55:36 Failed to create TUN device: CreateTUN("wgpia0") failed; /dev/net/tun does not exist

OpenVPN

[2024-08-22 03:06:36.583][d8f7][daemon.openvpnmethod][src/openvpnmethod.cpp:678][debug] "2024-08-22 03:06:36 us=581930 ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)"

Full output of OpenVPN logs are attached as a file to this post.

Full output of wireguard logs:

[2024-08-22 02:54:35.031][d8f7][daemon.processrunner][src/processrunner.cpp:108][info] Process "wireguard-go" startup succeeded
[2024-08-22 02:54:45.031][d8f7][daemon.wireguardmethod][src/wireguardmethod.cpp:521][warning] Could not create interface: "Unknown error code 1404: TaskTimedOut" [common.async] src/async.h:645
[2024-08-22 02:54:45.031][d8f7][daemon.vpnmethod][src/vpnmethod.cpp:61][info] VPN method error: "Unknown error code 1404: TaskTimedOut" [common.async] src/async.h:645
[2024-08-22 02:54:45.031][d8f7][common.error][src/builtin/error.cpp:97][error] "Unknown error code 1404: TaskTimedOut" [common.async] src/async.h:645
[2024-08-22 02:55:35.076][d8f7][daemon.wireguardmethod][src/wireguardmethod.cpp:1176][warning] Backend shutdown rejected - "Unknown error code 1404: TaskTimedOut" [common.async] src/async.h:846
[2024-08-22 02:55:35.076][d8f7][daemon.wireguardmethod][src/wireguardmethod.cpp:1180][info] Tearing down WireGuard connection
[2024-08-22 02:55:35.086][d8f7][daemon.wireguardmethod.stdout][src/exec.cpp:105][info] Tearing down DNS.
[2024-08-22 02:55:35.093][d8f7][daemon.wireguardmethod][src/exec.cpp:100][warning] (2)$ ip rule del not from all fwmark 12819 lookup piavpnWgrt
[2024-08-22 02:55:35.093][d8f7][daemon.wireguardmethod.stderr][src/exec.cpp:109][warning] RTNETLINK answers: No such file or directory
[2024-08-22 02:55:35.100][d8f7][daemon.wireguardmethod][src/exec.cpp:100][warning] (2)$ ip route delete 173.239.194.213
[2024-08-22 02:55:35.100][d8f7][daemon.wireguardmethod.stderr][src/exec.cpp:109][warning] RTNETLINK answers: No such process
[2024-08-22 02:55:35.601][d8f7][daemon.wireguardmethod][src/wireguardmethod.cpp:1189][warning] WireGuard shutdown complete
[2024-08-22 02:55:35.601][d8f7][daemon.vpnmethod][src/vpnmethod.cpp:34][info] State advanced from Exiting to Exited
[2024-08-22 02:55:35.601][d8f7][daemon.vpn][src/vpn.cpp:1256][info] Initial netScan for VPN method Network(gatewayIp: , interfaceName: , ipAddress: , ipAddress6: , gatewayIp6: )
[2024-08-22 02:55:35.601][d8f7][daemon.vpn][src/vpn.cpp:1530][info] Connection attempt count updated from 7 to 8
[2024-08-22 02:55:35.601][d8f7][daemon.vpnmethod][src/vpnmethod.cpp:34][info] State advanced from Created to Connecting
[2024-08-22 02:55:35.602][d8f7][daemon.wireguardmethod][src/wireguardmethod.cpp:1115][info] Authenticating with server "https://181.214.199.106:1337" with expected common name "melbourne414"
[2024-08-22 02:55:35.602][d8f7][common.networktaskwithretry][src/networktaskwithretry.cpp:128][debug] requesting: "https://181.214.199.106:1337/addKey?pubkey=...&pt=..." using peer name "melbourne414"
[2024-08-22 02:55:35.603][d8f7][common.apiretry][src/apiretry.cpp:73][info] Begin attempt 1 for resource "addKey?pubkey=...&pt=..."
[2024-08-22 02:55:35.686][d8f7][common.openssl][src/openssl.cpp:489][info] Accepted matching name "melbourne414" for peer "melbourne414"
[2024-08-22 02:55:35.686][d8f7][common.networktaskwithretry][src/networktaskwithretry.cpp:361][info] Accepted certificate for "melbourne414"
[2024-08-22 02:55:35.686][d8f7][common.networktaskwithretry][src/networktaskwithretry.cpp:318][info] Certificate for "addKey?pubkey=...&pt=..." has 1 common names, 0 serial numbers, and 1 subject alternative names
[2024-08-22 02:55:35.686][d8f7][common.networktaskwithretry][src/networktaskwithretry.cpp:323][info]  - CN: "melbourne414"
[2024-08-22 02:55:35.686][d8f7][common.networktaskwithretry][src/networktaskwithretry.cpp:331][info]  - SAN: "melbourne414" - type: QSsl::DnsEntry
[2024-08-22 02:55:36.017][d8f7][common.networktaskwithretry][src/networktaskwithretry.cpp:240][info] Request for "addKey?pubkey=...&pt=..." - 200 OK - error code: QNetworkReply::NoError
[2024-08-22 02:55:36.017][d8f7][daemon.wireguardmethod][src/wireguardmethod.cpp:354][info] Server address: QHostAddress("181.214.199.106"):1337 peer IP: "10.8.251.157"/32 server pubkey: "deom89SVH1ztI1MEevHbpppfx081x/Gahx9i3RfVB2M=" server virtual ip:QHostAddress("10.8.128.1")
[2024-08-22 02:55:36.017][d8f7][daemon.processrunner][src/processrunner.cpp:313][info] Enabling "wireguard-go" with "/opt/piavpn/bin/pia-wireguard-go" ("--foreground", "wgpia0")
[2024-08-22 02:55:36.019][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:485][info] wireguard-go PID: 2576
[2024-08-22 02:55:36.023][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:199][warning] Connection to "" failed, error QLocalSocket::ServerNotFoundError
[2024-08-22 02:55:36.023][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:285][warning] Attempt for "/var/run/wireguard/wgpia0.sock" failed - "Unknown error code 1900: LocalSocketNotFound" [daemon.wireguardgobackend] src/posix/wireguardgobackend.cpp:209
[2024-08-22 02:55:36.023][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:301][info] Wait for "/var/run/wireguard/wgpia0.sock" to be created before trying again
[2024-08-22 02:55:36.026][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:440][info] wireguard-go: DEBUG: (wgpia0) 2024/08/22 02:55:36 Starting wireguard-go version 0.0.20210424
[2024-08-22 02:55:36.026][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:440][info] wireguard-go: ERROR: (wgpia0) 2024/08/22 02:55:36 Failed to create TUN device: CreateTUN("wgpia0") failed; /dev/net/tun does not exist
[2024-08-22 02:55:36.027][d8f7][daemon.processrunner][src/processrunner.cpp:268][info] "wireguard-go" - Process exited with code 1 and status QProcess::NormalExit
[2024-08-22 02:55:36.027][d8f7][daemon.processrunner][src/processrunner.cpp:212][warning] "wireguard-go" - Process exited unexpectedly
[2024-08-22 02:55:36.027][d8f7][daemon.processrunner][src/processrunner.cpp:226][warning] "wireguard-go" - Has been failing for 0.007 sec - restart after 0.1 sec
[2024-08-22 02:55:36.027][d8f7][daemon.processrunner][src/processrunner.cpp:348][info] Disabling "wireguard-go"
[2024-08-22 02:55:36.027][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:505][warning] wireguard-go exited unexpectedly
[2024-08-22 02:55:36.027][d8f7][daemon.wireguardbackend][src/wireguardbackend.cpp:84][warning] WireGuard backend error: "Unknown error code 1705: WireguardProcessFailed" [daemon.wireguardgobackend] src/posix/wireguardgobackend.cpp:510
[2024-08-22 02:55:36.027][d8f7][daemon.vpnmethod][src/vpnmethod.cpp:61][info] VPN method error: "Unknown error code 1705: WireguardProcessFailed" [daemon.wireguardgobackend] src/posix/wireguardgobackend.cpp:510
[2024-08-22 02:55:36.027][d8f7][daemon.vpnmethod][src/vpnmethod.cpp:34][info] State advanced from Connecting to Exiting
[2024-08-22 02:55:36.027][d8f7][daemon.wireguardmethod][src/wireguardmethod.cpp:1162][info] Shut down WireGuard backend
[2024-08-22 02:55:36.027][d8f7][daemon.processrunner][src/processrunner.cpp:385][info] "wireguard-go" - terminating process
[2024-08-22 02:55:36.027][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:622][info] Signaled wireguard-go to terminate
[2024-08-22 02:55:36.027][d8f7][common.error][src/builtin/error.cpp:97][error] "Unknown error code 1705: WireguardProcessFailed" [daemon.wireguardgobackend] src/posix/wireguardgobackend.cpp:510
[2024-08-22 02:55:36.027][d8f7][daemon.processrunner][src/processrunner.cpp:287][info] "wireguard-go" - Cleaned up after process exit, now idle

 

[squirrelbeach]

I tried the suggestion listed here https://forum.proxmox.com/threads/proxmox-5-and-openvpn.46614/#post-220681 : adding the following two lines to the LCX's .conf file

lxc.cgroup.devices.allow: c 10:200 rwm
lxc.hook.autodev: sh -c "modprobe tun; cd ${LXC_ROOTFS_MOUNT}/dev; mkdir net; mknod net/tun c 10 200; chmod 0666 net/tun"

This gave a slightly different output: on the 3rd line the error changes from "/dev/net/tun does not exist" to "operation not permitted"

Old output:

[2024-08-22 02:55:36.023][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:301][info] Wait for "/var/run/wireguard/wgpia0.sock" to be created before trying again
[2024-08-22 02:55:36.026][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:440][info] wireguard-go: DEBUG: (wgpia0) 2024/08/22 02:55:36 Starting wireguard-go version 0.0.20210424
[2024-08-22 02:55:36.026][d8f7][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:440][info] wireguard-go: ERROR: (wgpia0) 2024/08/22 02:55:36 Failed to create TUN device: CreateTUN("wgpia0") failed; /dev/net/tun does not exist
[2024-08-22 02:55:36.027][d8f7][daemon.processrunner][src/processrunner.cpp:268][info] "wireguard-go" - Process exited with code 1 and status QProcess::NormalExit

New output:

[2024-08-22 13:13:43.031][bd4a][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:301][info] Wait for "/var/run/wireguard/wgpia0.sock" to be created before trying again
[2024-08-22 13:13:43.035][bd4a][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:440][info] wireguard-go: DEBUG: (wgpia0) 2024/08/22 13:13:43 Starting wireguard-go version 0.0.20210424
[2024-08-22 13:13:43.035][bd4a][daemon.wireguardgobackend][src/posix/wireguardgobackend.cpp:440][info] wireguard-go: ERROR: (wgpia0) 2024/08/22 13:13:43 Failed to create TUN device: operation not permitted
[2024-08-22 13:13:43.036][bd4a][daemon.processrunner][src/processrunner.cpp:268][info] "wireguard-go" - Process exited with code 1 and status QProcess::NormalExit