OpenVPN no longer needs lxc.cgroup.devices.allow and lxc.hook.autodev

naisanza

Member
Aug 11, 2016
31
1
6
Upon 2 nights and 14 hours of troubleshooting later, it turns out Proxmox 4.4-1/eb2d6f1e no longer needs the following lines of code inside /etc/pve/lxc/<container>.conf

Code:
lxc.cgroup.devices.allow = c 10:200 rwm
lxc.hook.autodev = sh -c "modprobe tun; cd ${LXC_ROOTFS_MOUNT}/dev; mkdir net; mknod net/tun c 10 200; chmod 0666 net/tun"

With these two lines of code that was needed before, an OpenVPN client could connect to the VPN service, but client traffic would never leave the container (as seen from traffic analysis from the client, firewall, and container)

I don't know why this is, maybe a kernel update, maybe something else. I don't know, but I'm just glad it's back to working again
 
Maybe you changed something inside your LXC policies, but it does not work without the setting in vanilla pve-manager/4.4-13/7ea56165:

Code:
Jun 10 13:24:58 gateway daemon.err /etc/init.d/openvpn[212]: TUN/TAP support is not available in this kernel

Jun 10 13:24:58 gateway daemon.err /etc/init.d/openvpn[198]: ERROR: openvpn failed to start

(for the test i commented the lxc-stuff out and afterwards back in to ensure that it works again)
 
Maybe you changed something inside your LXC policies, but it does not work without the setting in vanilla pve-manager/4.4-13/7ea56165:

Unless it changed when the server was turned off for maintenance and back on again. I don't know what changed.

Everything is vanilla on the server with zero system-wide changes, except for the container config in /etc/pve/lxc/<container>.conf

Where can you find the global LXC policies?
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!