Can't access UI 403: Forbidden

[zachsteffens]

Is there a pinned issue for this?

• I have read the pinned issues and could not find my issue

Is there an existing or similar issue/discussion for this?

• I have searched the existing issues
• I have searched the existing discussions

Is there any comment in the documentation for this?

• I have read the documentation, especially the FAQ and Troubleshooting parts

Is this related to a provider?

• I have checked the provider repo for issues
• My issue is NOT related to a provider

Are you using the latest release?

• I am using the latest release

Have you tried using the dev branch latest?

• I have tried using dev branch

Docker run config used

version: '2.1'
services:
  transmissionProxy:
    image: haugene/transmission-openvpn-proxy
    links: 
      - transmissionOpenVPN:transmission
    ports: 
      - 8080:8080 
    networks:
      static-network:
        ipv4_address: 172.20.128.18
    

  transmissionOpenVPN:
    image: haugene/transmission-openvpn
    container_name: transmissionOpenVPN
    cap_add:
      - NET_ADMIN
    environment: 
      - CREATE_TUN_DEVICE=true
      - OPENVPN_PROVIDER=PIA
      - OPENVPN_CONFIG=sweden 
      - OPENVPN_USERNAME=XXXXXX
      - OPENVPN_PASSWORD=XXXXXXX
      - OPENVPN_OPTS=--mute-replay-warnings
      - LOCAL_NETWORK=192.168.1.0/24
      - TRANSMISSION_RPC_WHITELIST_ENABLED=false
    volumes:
      - /mnt/servernas/transmission/:/data
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 9091:9091
    restart: on-failure
    networks:
      static-network:
        ipv4_address: 172.20.128.6
        
networks:
  default:

networks:
  static-network:
    ipam:
      config:
        - subnet: 172.20.0.0/16
          #docker-compose v3+ do not use ip_range
          ip_range: 172.28.5.0/24

Current Behavior

Just upgraded for the first time in a long while, I can no longer connect to the web UI and my other containers cannot communicate with Transmission. Error message I get is

403: Forbidden
Unauthorized IP Address.

Either disable the IP address whitelist or add your address to it.

If you're editing settings.json, see the 'rpc-whitelist' and 'rpc-whitelist-enabled' entries.

If you're still using ACLs, use a whitelist instead. See the transmission-daemon manpage for details.

I've tried standing up the proxy container as well. Once configured properly and started up, I get the exact same error message when I navigate to the proxy address (8080)

Originally my configuration did not contain the environment setting for
- TRANSMISSION_RPC_WHITELIST_ENABLED=false

But that appears to not be having any effect on the issue.

Expected Behavior

Expected to be able to connect via web ui and sonarr/radarr/etc..

How have you tried to solve the problem?

1. attempted to edit settings.json file (rpc-whitelist:false) reverts back to true on each restart or recreation of the container
2. Tried transmission-openvpn-proxy, resulted in the same issue.
3. attempted to remove static network from docker-compose configuration, had no effect
4. Checked folder permissions, not positive if everything is configured correctly, data directory is on a mounted network drive

Log output

Starting container with revision: 8cc1870cc039201e0e2f8b7684a9f4e96ae03ab9
Creating TUN device /dev/net/tun
Using OpenVPN provider: PIA
Running with VPN_CONFIG_SOURCE auto
Provider PIA has a bundled setup script. Defaulting to internal config
Executing setup script for PIA
Downloading OpenVPN config bundle openvpn into temporary file /tmp/tmp.eLBnuT7V9R
Extract OpenVPN config bundle into PIA directory /etc/openvpn/pia
Starting OpenVPN using config sweden.ovpn
Modifying /etc/openvpn/pia/sweden.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Setting OpenVPN credentials...
adding route to local network 192.168.1.0/24 via 172.20.5.0 dev eth0
Wed Apr  6 04:13:23 2022 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 19 2021
Wed Apr  6 04:13:23 2022 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
Wed Apr  6 04:13:23 2022 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Apr  6 04:13:23 2022 TCP/UDP: Preserving recently used remote address: [AF_INET]46.246.3.215:1198
Wed Apr  6 04:13:23 2022 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Apr  6 04:13:23 2022 UDP link local: (not bound)
Wed Apr  6 04:13:23 2022 UDP link remote: [AF_INET]46.246.3.215:1198
Wed Apr  6 04:13:23 2022 TLS: Initial packet from [AF_INET]46.246.3.215:1198, sid=fc84a237 8749d889
Wed Apr  6 04:13:23 2022 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Apr  6 04:13:23 2022 VERIFY OK: depth=1, C=US, ST=CA, L=LosAngeles, O=Private Internet Access, OU=Private Internet Access, CN=Private Internet Access, name=Private Internet Access, [email protected]
Wed Apr  6 04:13:23 2022 VERIFY KU OK
Wed Apr  6 04:13:23 2022 Validating certificate extended key usage
Wed Apr  6 04:13:23 2022 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Apr  6 04:13:23 2022 VERIFY EKU OK
Wed Apr  6 04:13:23 2022 VERIFY OK: depth=0, C=US, ST=CA, L=LosAngeles, O=Private Internet Access, OU=Private Internet Access, CN=stockholm405, name=stockholm405
Wed Apr  6 04:13:23 2022 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Wed Apr  6 04:13:23 2022 [stockholm405] Peer Connection Initiated with [AF_INET]46.246.3.215:1198
Wed Apr  6 04:13:24 2022 SENT CONTROL [stockholm405]: 'PUSH_REQUEST' (status=1)
Wed Apr  6 04:13:25 2022 PUSH: Received control message: 'PUSH_REPLY,comp-lzo no,redirect-gateway def1,route-ipv6 2000::/3,dhcp-option DNS 10.0.0.243,route-gateway 10.35.112.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.35.112.159 255.255.255.0,peer-id 16,cipher AES-128-GCM'
Wed Apr  6 04:13:25 2022 OPTIONS IMPORT: timers and/or timeouts modified
Wed Apr  6 04:13:25 2022 OPTIONS IMPORT: compression parms modified
Wed Apr  6 04:13:25 2022 OPTIONS IMPORT: --ifconfig/up options modified
Wed Apr  6 04:13:25 2022 OPTIONS IMPORT: route options modified
Wed Apr  6 04:13:25 2022 OPTIONS IMPORT: route-related options modified
Wed Apr  6 04:13:25 2022 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Apr  6 04:13:25 2022 OPTIONS IMPORT: peer-id set
Wed Apr  6 04:13:25 2022 OPTIONS IMPORT: adjusting link_mtu to 1625
Wed Apr  6 04:13:25 2022 OPTIONS IMPORT: data channel crypto options modified
Wed Apr  6 04:13:25 2022 Data Channel: using negotiated cipher 'AES-128-GCM'
Wed Apr  6 04:13:25 2022 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Wed Apr  6 04:13:25 2022 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Wed Apr  6 04:13:25 2022 ROUTE_GATEWAY 172.20.5.0/255.255.0.0 IFACE=eth0 HWADDR=02:42:ac:14:80:06
Wed Apr  6 04:13:25 2022 GDG6: remote_host_ipv6=n/a
Wed Apr  6 04:13:25 2022 ROUTE6: default_gateway=UNDEF
Wed Apr  6 04:13:25 2022 OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
Wed Apr  6 04:13:25 2022 OpenVPN ROUTE: failed to parse/resolve route for host/network: 2000::/3
Wed Apr  6 04:13:25 2022 TUN/TAP device tun0 opened
Wed Apr  6 04:13:25 2022 TUN/TAP TX queue length set to 100
Wed Apr  6 04:13:25 2022 /sbin/ip link set dev tun0 up mtu 1500
Wed Apr  6 04:13:25 2022 /sbin/ip addr add dev tun0 10.35.112.159/24 broadcast 10.35.112.255
Wed Apr  6 04:13:25 2022 /etc/openvpn/tunnelUp.sh tun0 1500 1553 10.35.112.159 255.255.255.0 init
Up script executed with tun0 1500 1553 10.35.112.159 255.255.255.0 init
Updating TRANSMISSION_BIND_ADDRESS_IPV4 to the ip of tun0 : 10.35.112.159
Updating Transmission settings.json with values from env variables
Using existing settings.json for Transmission /data/transmission-home/settings.json
Overriding bind-address-ipv4 because TRANSMISSION_BIND_ADDRESS_IPV4 is set to 10.35.112.159
Overriding download-dir because TRANSMISSION_DOWNLOAD_DIR is set to /data/completed
Overriding incomplete-dir because TRANSMISSION_INCOMPLETE_DIR is set to /data/incomplete
Overriding rpc-port because TRANSMISSION_RPC_PORT is set to 9091
sed'ing True to true
sed: cannot remove /data/transmission-home/sedCGiLwH: Permission denied

-------------------------------------
Transmission will run as
-------------------------------------
User name:   root
User uid:    0
User gid:    0
-------------------------------------


STARTING TRANSMISSION
Provider PIA has a script for automatic port forwarding. Will run it now.
If you want to disable this, set environment variable DISABLE_PORT_UPDATER=true
Transmission startup script complete.
Wed Apr  6 04:13:25 2022 /sbin/ip route add 46.246.3.215/32 via 172.20.5.0
Wed Apr  6 04:13:25 2022 /sbin/ip route add 0.0.0.0/1 via 10.35.112.1
Wed Apr  6 04:13:25 2022 /sbin/ip route add 128.0.0.0/1 via 10.35.112.1
Wed Apr  6 04:13:25 2022 WARNING: OpenVPN was configured to add an IPv6 route over tun0. However, no IPv6 has been configured for this interface, therefore the route installation may fail or may not work as expected.
Wed Apr  6 04:13:25 2022 Initialization Sequence Completed
Running functions for token based port fowarding
Reserved Port: 27513  Wed Apr  6 04:13:32 UTC 2022
transmission auth not required
waiting for transmission to become responsive
transmission became responsive

setting transmission port to 27513
localhost:9091/transmission/rpc/ responded: "success"
Checking port...
Port is open: Yes
#######################
        SUCCESS        
#######################
Port: 27513
Expiration Tue Jun  7 16:06:59 UTC 2022
#######################
Entering infinite while loop
Every 15 minutes, check port status

HW/SW Environment

- OS: Ubuntu 20.04.1
- Docker: Docker version 20.10.7, build 20.10.7

Anything else?

No response

[pkishino]

if you are trying to change settings.json you must first stop the container, then edit the file and then start.. you cannot edit while the container is running.
you can also just delete the file and start the container again with a fresh setting file

[zachsteffens]

So, I believe this issue is caused by the location of the /data volume.

When I point it at my original location (which is a mounted network share /mnt/servernas/transmission/) I get the 403.
I created a new folder on that same network drive and pointed the data volume at it, same 403.
I created a new folder on the docker host and pointed that data volume at it, It works NO 403 error.

I'm assuming it's a permissions error causing the problems, I dont have the greatest grasp on permissions, but the /mnt/servernas/transmission folders are owned by root, and as far as I can tell, transmission is running as root. But I'm assuming I'm missing something in this equation.

[pkishino]

first I suggest using :dev image, then check docker permissions for the network share etc. or you could copy your settings.json from when it works to your servernas folder..but I suspect it will have problems creating other files such as resume/log etc etc

[kflanagan]

Not so much an answer, but addition.

Podman

Don't forget :Z at the end of any volume mapping, it's related to SELINUX and things behave poorly if you don't, as in access denied.

/home/transmission:/config:Z

Otherwise I've been successful with moving from Docker to Podman for containers to provide home services.