Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Two questions #82

Closed
VR-Punk opened this issue May 4, 2021 · 28 comments
Closed

Two questions #82

VR-Punk opened this issue May 4, 2021 · 28 comments

Comments

@VR-Punk
Copy link

VR-Punk commented May 4, 2021

  1. PrivateInternetAccess:
    Where can i see my portforwarding port ?

  2. transmission-daemon:
    The settings will be reset every time i launch vopono,
    where are the settings to change that ?

vopono is a cool software ! thx !!!

@jamesmcm
Copy link
Owner

jamesmcm commented May 4, 2021

For 1. I'm not sure, I think we can probably adapt PIA's script to do this automatically, but I'm no longer a PIA customer myself so I can't really do it right now.

For 2. which settings do you refer to? The main ones can be saved in the vopono config file in ~/.config/vopono/config.toml

@VR-Punk
Copy link
Author

VR-Punk commented May 4, 2021

For 1: i tried https://github.com/pia-foss/manual-connections, and after launching vopono, i got a pia token with

PIA_USER=p0123456 PIA_PASS=xxx ./get_token.sh

then and want to get signature

curl -k "https://10.4.128.1:19999/getSignature?token=$TOKEN"

but get this error
{
"status": "ERROR",
"message": "Unauthorized client"
}

For 2: The settings of the transmission-daemon itself, in /etc/transmission-daemon/settings.json, will be reset every time i launch vopono. The only parts which are loaded correctly are the rpc parts of the settings.json for the tansmission remote-gui, everything else is wrong. Without vopono everything works well, so it's a vopono thing.

@jamesmcm
Copy link
Owner

jamesmcm commented May 4, 2021

For PIA:

In their script they run:

  payload_and_signature="$(curl -s -m 5 \
    --connect-to "$PF_HOSTNAME::$PF_GATEWAY:" \
    --cacert "ca.rsa.4096.crt" \
    -G --data-urlencode "token=${PIA_TOKEN}" \
    "https://${PF_HOSTNAME}:19999/getSignature")"

So maybe try that?


Regarding transmission-daemon:

Is the file itself overwritten? What if you pass the config dir in with --config-dir?

Could you please paste the exact command you run and I can try to test it.

@VR-Punk
Copy link
Author

VR-Punk commented May 5, 2021

For PIA:

Is that correct ?
payload_and_signature="$(curl -s -m 5
--connect-to "12.345.6.7::987.654.321.0:"
--cacert "ca.rsa.4096.crt"
-G --data-urlencode "token=12345ExampleDJAR&j~q:.SF<kG7M^$5{*BqK;hWo^4321?="
"https://12.345.6.7:19999/getSignature")"

I'm not sure about the pia ip and gateway

i have one pia ip if i do

sudo route

if have a second pia ip if i do

http://ipmagnet.services.cbcdn.com/?hash=c1d7e72180231b4f7c6b317e90c57828cd63d419

and i have a third in the vopono verbose output if i do

vopono -v exec -k -f 9091 --provider privateinternetaccess --server switzerland-ch.ovpn "transmission-daemon -a ..."

For transmission:

without vopono i start it with

sudo systemctl start transmission-daemon

with vopono i use this

vopono -v exec -k -f 9091 --provider privateinternetaccess --server switzerland-ch.ovpn "transmission-daemon -a ..."

@VR-Punk
Copy link
Author

VR-Punk commented May 5, 2021

i have installed the full run_setup.sh from https://github.com/pia-foss/manual-connections on my ubuntu notebook and now i have a Payload, a Signature and a Pia_Token ! I will use the data for vopono on my Debian NAS !

I have the address of the server with my open portforwarding ports

PF_HOSTNAME=zurichxxx
PF_GATEWAY=10.x.xxx..x
OVPN_SERVER_IP=156.xxx.xx.xxx
OVPN_HOSTNAME=zurichxxx

I also have two files called standard.ovpn and strong.ovpn, which i guess have the login data for the PIA server in zurich, but the files are not compatible with vopono !

if i try to use the new *.ovpn files with vopono

vopono -v exec -k -f 9091 --provider privateinternetaccess --server standard.ovpn "transmission-daemon -a ..."

i got

Error: Failed to extract remotes from config file: /home/xxx/.config/vopono/pia/openvpn/standard.ovpn

How can i connect to the pia zurich ovpn server via vopono ?

@VR-Punk
Copy link
Author

VR-Punk commented May 5, 2021

Is there a better VPN Service with portforwarding, which is full supported by vopono, and has a easier way to use portforwarding ?

@VR-Punk
Copy link
Author

VR-Punk commented May 6, 2021

if i try to use the new PIA *.ovpn files with vopono
I get this Error: Failed to extract remotes from "standard.ovpn" !!!

The official PIA "standard.ovpn"

client
dev tun06
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server

auth-user-pass /opt/piavpn-manual/credentials
compress
verb 1
reneg-sec 0

-----BEGIN CERTIFICATE----- Example1YsGF5ljULTLktXzYt28zwQCv8Fk452zkUyMGoPHipKuFWP4LYNgCdfSntsuc2Ux0BPbebKgOrqcH3WdVaOqCVwM30J2TRFopZRZEC1cSKw1SuTmckR0PGAQMf8NhJJ9teXPAMlQgyLXOrrLGxxDdP0djfyC1sayIw9jv355tPJz342Xb5HoGr6I6CqKlcthGy6DRunVIdOKYeXrsxokvg7RcuAe7Y43ov4uFXkHWXQ3qnvGsEbkrfgYE43ZeIJd6HR2ZzNUes07gvTFClo7KWLxUqFV5iBNs25aV7GpEsUklrEOMX8BtT7B1RLk6Ab5E8W4OY6IkP03VnnZY4Ipdvww8mY7SSkmQMvQ2sRbiPUWZFttD5Kdf0sy7wQnBYbtRQ750YU7SA6dlEimJC4IoVo8MHlHVaakxzqKj6L7z5SnvqmWRM5n0MxdPN1mGBY2sUDOPirCdwkujEFGTVvCvjUYbVsOxKlFayjKgQOiiDGNfbR9wThVIdHGdOHmT7B5wRfOTgLivBO2MPndUhI1e5vSZWeFe4yRPpOdQXKENaomBPfjV9hM1oOwvc0GRBw5BqmU287dAtgjkI6sNyxqM3PaIrIvKuh355CYKUPYXqCDdgNLTab8N2TTNUjWUJzbE7SupnPNdu87DMzu5GGSJjQ0u8r0gH8blb7rHmMAzyyYIwNYPLRQdrG2zrGQO7kTYeaaLzUW5f5eu75MmdspArBTCRw3DvkW5b58wctZLc4R41dHQbYdYZzkDaIpMCqwadH0y96P1iAPedouDzJYzQ7GD4gbixTfyFXKkGl1rzgXXqXnDLB88ugsm0Bdn6H7UPiCscmjerfDkdAJU1oMYpwIwcecQw9IW2tejyNslVIu16TqTcrd0tSGYUpQGCrgrO2h6Ql2u86b0RGL2OxbcKC5sIeZd9i30umlkrsFnALXLEdoRgo6OItZ0HQt296qYDM0eeDgpKDhgKju2PbJlogSaSYeIoah50IoVrzvnafZjDlBNWA8OBIV0x0HccmhExample -----END CERTIFICATE-----

disable-occ
script-security 2
up /opt/piavpn-manual/openvpn_up.sh
down /opt/piavpn-manual/openvpn_down.sh

The bash scripts called in the "standard.ovpn":

openvpn_up.sh:

#!/bin/bash
echo $route_vpn_gateway > /opt/piavpn-manual/route_info

openvpn_down.sh:

#!/bin/bash
rm -rf /opt/piavpn-manual/pia_pid /opt/pia-manual/route_info

The Vopono .ovpn files:

client
dev tun
proto udp
remote swiss.privacy.network 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server

auth-user-pass
compress
verb 1
reneg-sec 0

-----BEGIN X509 CRL-----
ExampleVZj7hOBDrlTxNqgLJ5v1j9ukz6o2ELZhRqew2UWw8D2HqBFyg3hIiXzHmyBIRmFdSXacnq2rsOCcbprz1fQIPVoOhLfKz6RCZLrJckcXrEnGwlF2wrptpthorjt4YDYjCJUog9RHgSRi7Johb5ES8ljcUYTLeXM4wVpiz7QYUqUJJ9nRx0EvUQLICvnDvqRwZaeYJ9YpHsbHxtrj7ZJ9wAdrtytOWWoHScMGHMXjaqT7qPZnwjJaLTOPVhA0gLAgBmIhcLegLwqkUjLHt8G0F3F6dPi2KTmcBgxqIS5d0nMc6ZlrAZiHA5YK2DJ4cOpYktD3XTBWBbIRcW9Y98dEMxXLYheZKwLrc5T971iLXd11FyKkd2jvRFjYlZJ57pcdupjn5oyhe8oHvhAJVKaLTb4s2f0DAB8c7SNKugdJz8m0Myqp5u05LWgDLDdLzK8YfOtFl9oy25CJMLaGExAT2JVMWbodEfuvcvPDzBGKNvHlpfGyqn6ZP6SrJCzuxVa92BHuYbjoFV0IR9pDV6sEl2LmchwFMuMxDbyyPlG4TSK5DHiOlwWojl906ydOOMObrxxwCdB0Qgga4lM3tn1vukZVKlltCztsV4diJ3117QXpcciLh4N0m0rcWLXBePiSrakly2Al7uKqNan4fZnc53D96cPhCm6rabdAepQE21NpyQb0u2eNVSPbZ02WSDtU6UB3LcNkFJYpRXayANqWyAsKahACsxLNlfkOQUGSRzLtOcSxItl4nYcs06My7SF7pULgfcv7VuUScmNWh0OBfjVMy9wpj8NeYgunyiOIV6d3zrRTFSEau9I4icfSL6STeWGnakGQxxYI35gnwvKj13KdqQg8ZrfmNr6FIZljS7py1TawjUD9ibVSgsqh2gDQaPHlhcmy7JQDRsIVBCwwdmh4qhALY7UpewY44HEJLi2hLafonO0HoYyzr4aMTqzZExygwO8zjxdXBDn8OnSjEvSD8uJKJCcFCZBsXfYbrkBLmKM4bUIkEmWma9T3NlCTExample
58A==
-----END X509 CRL-----

-----BEGIN CERTIFICATE----- Example8vPMHOLZLjdR2iNAQLIDdJ1jpv5pRQck3tJgilQ6XU3BDPXW9CFqtL3PmUKJS21D2AbWGWn3pHc11KhrA29kbIkQqBCTjQxdkIVieMYNZXvOSiP5zeJANjmvEVWzsKS8w10JiN8KPfufdngKCs4F6DiIqaU8XQbVVRepbrtUibJI2jph79A9HBao3jSWPyc97To4jp6kC2ad0N1ZF6TskY4xxvABTiFIPNP2jqtKI3iZU15YF86B526DW1o2qMmpQg7tKOzoXB5Du1ZCnr8450zSlZrvHsEUHbDDK2zWliQBjViQWV979NEwR9jHc5bKAf73YvlNDqW4he0qDvabJGYLCCQKXYDZsF8JS0KQ0xBuwNyJRTnMpOUm8QBNk4H6qtQjhmwxw5MIwZ4g0UkZIXJ2HDPdaYXDVmi2AaLZ6yCZCCM1nkT7sKNZEsc94QpHeGGUvv9muHgxpgcfqvYcUqm6pqmaqrMPbnuQ6UAe34aIdwzd4RhMgQKEhhW3bd66bdidEtYOciqp9HDpS15hOJDkYr77tEg03tvI1bPMWdD5dauFe0w6Lr1tnqpqv4pikJwtvO6CwBY662QfGy3LDcGFXf2VeQPQFE90RVWoIKrha2sD3mlQxzuAGiOibRQn9uUu5jmIM1ne1AsnOCPvcndf8TF7TiLjS60yhSPQrtdPHUkjmi8Qsrmrt2QkWgAhRu3Mzq93uwWGCr9PixArajMxEUvh4Ry771R7uCTIiE9hM6WYhEcuRamVsuYggLUFbk74ot4BIce20qkemU0EUeWX96Xn24hiWTAlCvoHbaaZsmLvsithvcqJIvNaryqGn1pcMZwZYIQZPm3UVtZ56xyhmjsU2BQUQ4zun4JcT9ai6n0zgoNdnVXVA3mvumo2b8nRp9r4lUwebfBsNwHbP0wv3plxTmWCjcsqwctJ0hg3BAsPFhPFqjwI2KVs6BHpewRzi7WqYM9wWd6osB3txLgxwxdYFY8cHjP4m2ggU7OBq7oKJoUbr9EoWDRlxbqKExample -----END CERTIFICATE-----

disable-occ

@jamesmcm
Copy link
Owner

jamesmcm commented May 8, 2021

Do you know how PIA has you select the server in that case? It's weird there is no remote server in the .ovpn file.

And I'd recommend Mullvad over PIA, but it really depends what you are using it for (Mullvad do not attempt Netflix ban evasion for example AFAIK, but I don't think PIA do either).

@VR-Punk
Copy link
Author

VR-Punk commented May 9, 2021

I bought pia vpn for one month, only. I will buy Mullvad for one month and try to setup it with vopono. Do you have advises in the setup with vopono ?

@VR-Punk
Copy link
Author

VR-Punk commented May 9, 2021

How can i check or test, that the NAS local lan network is not involved in the Mullvad VPN if i will use it with vopono ? I have only a SSH connection to the NAS on which vopono is installed.

@jamesmcm
Copy link
Owner

jamesmcm commented May 9, 2021

You can use vopono sync and choose Mullvad and it should auto-generate the config files 🙂

Use Mullvad's test page with a browser for example: https://mullvad.net/en/check/

@VR-Punk
Copy link
Author

VR-Punk commented May 9, 2021

I would like to use transmission-daemon on my NAS and if have a website which shows the vpn ip of my torrents. But if i stream a movie on my NAS to my Mediaplayer and my TV it should be done offline without using the vpn connection. Is there a way to check if vopono is working correct ?

@jamesmcm
Copy link
Owner

jamesmcm commented May 9, 2021

Yeah, forward the port for tranmission-daemon with the -k and -f XXXX flags, then Mullvad even has a torrent check you can do with a torrent file from them.

As for the rest you can just double check that it isn't going through the VPN e.g. curl ifconfig.co/json | jq . but it should be fine in any case.

@VR-Punk
Copy link
Author

VR-Punk commented May 9, 2021

curl ifconfig.co/json | jq .

That is what i need, big thx

@VR-Punk
Copy link
Author

VR-Punk commented May 11, 2021

hello,
i bought mullvad and the port forwarding works well !
The settings of transmission-daemon are saved now with the option

--config-dir

Thx for your advices !!!

@VR-Punk
Copy link
Author

VR-Punk commented May 12, 2021

hello,

i would like to launch vopono with any option to keep it running even if iwill close the terminal or the ssh connection doesn't work anymore. Do you know some kind of option ?

I tried to create a system.d service but without success:

[Unit]
Description=VPN Transmission-Daemon
After=network.target
[Service]
User=******
Type=notify
ExecStart=/bin/vopono exec -k -f 9091 -o ****** -u ***** --protocol wireguard --provider mullvad --server romania "transmission-daemon -g /etc/transmission-daemon/ -a *.*.*.*"
ExecStop=/bin/kill -s STOP $MAINPID
ExecReload=/bin/kill -s HUP $MAINPID
NoNewPrivileges=true
[Install]
WantedBy=multi-user.target

@jamesmcm
Copy link
Owner

I'll try to sort out the systemd unit stuff, do you know what the issue is?

For now you could run it in tmux and send it to the background though.

@VR-Punk
Copy link
Author

VR-Punk commented May 12, 2021

The issue is, that the vopono command can't be executed. The rest is the original transmission-daemon.service !

ExecStart=/bin/vopono exec -k -f 9091 -o ****** -u ***** --protocol wireguard --provider mullvad --server romania "transmission-daemon -g /etc/transmission-daemon/ -a *.*.*.*"

But i will try tmux and send it to the background ! Thx !!!

@jamesmcm
Copy link
Owner

I got the systemd unit to work as a user unit if that's good enough:

/etc/systemd/user/vopono.service:

[Service]
ExecStart=/usr/bin/vopono -v exec -k -f 9091 --protocol wireguard --provider mullvad --server romania "transmission-daemon -a *.*.*.*"

Running as root doesn't work, even if you copy the config over (i.e. to /root/.config/vopono/) due to some permissions issue with the TCP proxy. I'll try to work it out.

Specifically:
https://github.com/jamesmcm/basic_tcp_proxy/blob/e3adcff17b46ecd871ff7d6f785de987d4945272/src/lib.rs#L36
fails to bind when a connection is made (even if the connecting process is also running as root).

@VR-Punk
Copy link
Author

VR-Punk commented May 19, 2021

Wow, thx ! I will try that !

@VR-Punk
Copy link
Author

VR-Punk commented Jun 5, 2021

I haven't had time yet, please don't close this issue !

@VR-Punk
Copy link
Author

VR-Punk commented Jun 23, 2021

I would like to use two user accounts on my system, one for the local network with samba and second one specially for vpn and vopono.

I tried this, but without success:

sudo nano /etc/systemd/vpn-.../vopono.service

[Service]
ExecStart=/usr/bin/vopono -v exec -k -f 9091 --protocol wireguard --provider mullvad --server romania "transmission-daemon -a ..."

sudo chown vpn-... /etc/systemd/vpn-.../vopono.service
sudo chmod 777 /etc/systemd/vpn-.../vopono.service
sudo chmod 777 /usr/bin/vopono
sudo chown vpn-
... /usr/bin/vopono

vpn-****:/$ systemctl start vopono.service

Failed to start vopono.service: Access denied
See system logs and 'systemctl status vopono.service' for details.

@jamesmcm
Copy link
Owner

If it's a system unit you'll need to start the service with sudo / as root.

But note then you'll hit issue #84 when trying to run transmission-daemon and vopono as root (I still need to fix this in basic_tcp_proxy). The better alternative is to use a systemd user service (you start it with the --user flag) - see the ArchWiki page

Basically you put the service unit file vopono.service in /etc/systemd/user and then run systemctl --user start vopono

@VR-Punk
Copy link
Author

VR-Punk commented Jun 26, 2021

Error:

$ sudo systemctl --user enable vopono.service
or
$ sudo systemctl --user start vopono

Failed to connect to bus: $DBUS_SESSION_BUS_ADDRESS and $XDG_RUNTIME_DIR not defined (consider using --machine=@.host --user to connect to bus of other user)

In user accounts i can fix this in the .bashrc in the /home directory with

export XDG_RUNTIME_DIR=/run/user/$(id -u)

but i don't know how to fix this in a root account.

The the ArchWiki page shows solutions, but i'm new in ubuntu and can't fix it on my own. Is there a easy way to fix this ?

ArchWiki page:

Environment variables

The user instance of systemd does not inherit any of the environment variables set in places like .bashrc etc. There are several ways to set environment variables for the systemd user instance:

For users with a $HOME directory, create a .conf file in the ~/.config/environment.d/ directory with lines of the form NAME=VAL. Affects only that user's user unit. See environment.d(5) for more information.

Use the DefaultEnvironment option in /etc/systemd/user.conf file. Affects all user units.

Add a drop-in config file in /etc/systemd/system/user@.service.d/. Affects all user units; see #Service example

At any time, use systemctl --user set-environment or systemctl --user import-environment. Affects all user units started after setting the environment variables, but not the units that were already running.

Using the dbus-update-activation-environment --systemd --all command provided by dbus. Has the same effect as systemctl --user import-environment, but also affects the D-Bus session. You can add this to the end of your shell initialization file.

For "global" environment variables for the user environment you can use the environment.d directories which are parsed by some generators. See environment.d(5) and systemd.generator(7) for more information.

You can also write a systemd.environment-generator(7) script which can produce environment variables that vary from user to user, this is probably the best way if you need per-user environments (this is the case for XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS, etc).

One variable you may want to set is PATH.

After configuration, the command systemctl --user show-environment can be used to verify that the values are correct.

@jamesmcm
Copy link
Owner

I'd recommend running it as a user anyway, as it'll avoid issue #84

But the user will need to have passwordless sudo access if you want it to be fully automatic. I did this on my machine with the user systemd unit I posted above and it worked. Then you could add the dbus fix there.

The dbus thing is strange though, I've never had an issue with it, even though at the start I thought this would be a problem (like PulseAudio was) - see issue #45 - but in the end it just works on Arch Linux with no intervention.

@VR-Punk
Copy link
Author

VR-Punk commented Jun 26, 2021

thx, that works ! But if i will close the ssh connection vopono will close too.

Jun 27 01:25:43 LS-QVL sudo[830]: pam_unix(sudo:session): session closed for user root
Jun 27 01:25:43 LS-QVL systemd[372]: Stopping vopono.service...
Jun 27 01:25:44 LS-QVL transmission-daemon[896]: Couldn't save temporary file "/etc/transmis>
Jun 27 01:25:44 LS-QVL transmission-daemon[896]: Closing session
Jun 27 01:25:44 LS-QVL systemd[372]: vopono.service: Succeeded.
Jun 27 01:25:44 LS-QVL systemd[372]: Stopped vopono.service.
Jun 27 01:25:44 LS-QVL systemd[372]: vopono.service: Consumed 3.352s CPU time.

@jamesmcm
Copy link
Owner

Running it in tmux or screen should work - anything to keep it alive.

@VR-Punk
Copy link
Author

VR-Punk commented Jul 5, 2021

thank you very much, that works for me !

@VR-Punk VR-Punk closed this as completed Jul 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants