Docker-openvpn: Setting key "net.ipv6.conf.default.forwarding": Read-only file system

[a0s]

After running this

docker run --volumes-from $OVPN_DATA -d -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn

i got this error in docker logs

iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
Enabling IPv6 Forwarding
sysctl: setting key "net.ipv6.conf.default.forwarding": Read-only file system

I using DigitalOcean's Ubuntu 14.04 LTS

ufw default allow

Enable this settings in /etc/ufw/sysctl.conf does nothing change

net/ipv4/ip_forward=1
net/ipv6/conf/default/forwarding=1
net/ipv6/conf/all/forwarding=1

[kylemanna]

Sorry about that, broke it when I merged IPv6 support. Try doing a docker pull on the image and try it again.

[kylemanna]

Out of curiosity did you get it working?

[a0s]

Yep! After second try, all working perfect! Thank you very much!

[kylemanna]

Yeah, that was my fault. Sounds like you hit an edge case with IPv6 enabled that I didn't test for. Oops. Glad it's working. :smile:

[phlegx]

I'm getting pretty much the same error with the latest docker-openvpn on Ubuntu 16.04 LTS

 docker-compose up
Recreating openvpn_openvpn_1
Attaching to openvpn_openvpn_1
openvpn_1  | Enabling IPv6 Forwarding
openvpn_1  | Failed to enable IPv6 Forwarding default
openvpn_1  | Failed to enable IPv6 Forwarding
openvpn_1  | iptables: No chain/target/match by that name.
openvpn_1  | iptables: No chain/target/match by that name.
openvpn_1  | sysctl: error setting key 'net.ipv6.conf.default.forwarding': Read-only file system
openvpn_1  | sysctl: error setting key 'net.ipv6.conf.all.forwarding': Read-only file system
openvpn_1  | Fri May 20 13:01:35 2016 RESOLVE: Cannot parse IP address: server
openvpn_1  | Options error: error parsing --server parameters
openvpn_1  | Use --help for more information.
openvpn_openvpn_1 exited with code 1

Maybe something has changed with the new Ubuntu version? Or is it maybe my fault that this happens?

[phlegx]

A privileged: true solved at least the "Read only" problem. The server issue was a problem with my init script that sets the VPN server up and makes some changes within the openvpn.conf file.

I think the failing IPv6 Forwarding does not break anything at all and can be ignored, if IPv6 is not used.

[ragaar]

@kylemanna is there a clean way to disable IPv6 Forwarding, to remove the warnings?

The /docs/ipv6.md goes into a lot of detail about how to enable IPv6 support, but nothing on disabling it.

As for the necrotic post:
I'm opening the conversation on this issue because it is the first hit on Google.

[ragaar]

Resolved the issue: Found the IPv6 conditional-statement in ovpn_run.
Solution: Disable IPv6 on the host.

REF: http://www.techrepublic.com/article/how-to-disable-ipv6-on-linux/

[amateusz]

As of Aug 2018 :latest still seems to have this issue.
Tried with Debian on Digital Ocean..
for me really the tip mentioned at the end of /usr/local/bin/ovpn_run did the trick:

    echo "Enabling IPv6 Forwarding"
    # If this fails, ensure the docker container is run with --privileged […]

before:

Enabling IPv6 Forwarding
sysctl: error setting key 'net.ipv6.conf.all.disable_ipv6': Read-only file system
Failed to enable IPv6 support
sysctl: error setting key 'net.ipv6.conf.default.forwarding': Read-only file system
Failed to enable IPv6 Forwarding default
sysctl: error setting key 'net.ipv6.conf.all.forwarding': Read-only file system
Failed to enable IPv6 Forwarding

after:

Enabling IPv6 Forwarding
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.all.forwarding = 1

Possibly can be narrowed down to a specific device (Docker docs mention this).

[r3lik]

how can I run ipv6 without privileged mode having to be enabled? Running 2.4+.

[utdrmac]

still an issue, april 2019. how do you fix the read-only errors?

# docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
fb5ce10241c2efa3bef874abb2717d0c68c00420f4b0f1256f23ee7914157c3e
root@blacklion:/etc/openvpn#
root@blacklion:/etc/openvpn# docker logs fb5
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
Enabling IPv6 Forwarding
sysctl: error setting key 'net.ipv6.conf.all.disable_ipv6': Read-only file system
Failed to enable IPv6 support
sysctl: error setting key 'net.ipv6.conf.default.forwarding': Read-only file system
Failed to enable IPv6 Forwarding default
sysctl: error setting key 'net.ipv6.conf.all.forwarding': Read-only file system
Failed to enable IPv6 Forwarding
Running 'openvpn --config /etc/openvpn/openvpn.conf --client-config-dir /etc/openvpn/ccd --crl-verify /etc/openvpn/crl.pem '

[mathieu-aubin]

@utdrmac read this https://github.com/kylemanna/docker-openvpn/issues/56#issuecomment-418587287

# If this fails, ensure the docker container is run with --privileged […]