List which kernel config options are required in the README #1964
Comments
|
We've not thought about this because we never considered supporting Gentoo officially. But in general, the daemon expects to have nftables to work and for split tunneling we need cgroups V1. And currently we need the ability to create tunnel devices, in the future, we'll optionally support the WireGuard kernel module. We can have a look at formalizing this list in the future, this is just everything I can come up with off the top of my head for now. |
|
@GarbageHamburger If you happen to find any kernel config that is not enabled by default and that our app needs, please help us populate this list by writing it here. |
|
Completely disabling CONFIG_IPV6 unfortunately results in a completely unusable mullvad-daemon, with the log reporting simply "Failed to set firewall rules" coming out of the rust talpid core ( mullvadvpn-app/talpid-core/src/firewall/linux.rs ). This file does all its work for ipv4 and ipv6 all at once, so not having anything in the kernel for ipv6 to work just ruins everything. Additionally, it requires a bunch of the NETFILTER options. CONFIG_NF_TABLES_IPV6 along with at least CONFIG_NFT_CHAIN_NAT_IPV6 , and I'm guessing CONFIG_IP6_NF_MANGLE - (similarly, the IPV4 versions.) This is my preliminary assessment. |
|
Thanks for reporting this. Even though no major distro comes with IPv6 completely disabled in the kernel, it makes sense to support it. We'll look into it and see if it's easily fixable. |
|
Anything new ? |
Yes |
So far, a Must, yes. When mullvad-daemon launches, it is able to request the kernel load the ipv6 module, which it does load (along with all the other netfilter modules) "IPv6: Loaded, but administratively disabled, reboot required to enable" After that point, Mullvad still works in this state. (despite being officially unsupported) Having the ipv6 codepath be required at all is not ideal, but it seems possible that the codepath can be deactivated and made dormant with this method. I believe this is effective in achieving my own goals, and I am posting it here to expand on the subject for information only. gl :) |
|
I see, well I started using Mullvad vpn few days ago, and it's working fine with OpenVPN. If I understand correctly, the Mullvad app relies on Wireguard, so I followed Gentoo Wiki to set it up, basically it's just a matter of enabling one option in the kernel and emerging wireguard-tools, which I did, app was giving the same error message, but interestingly enough, I couldn't manually bring up Wireguard interface. @genbtc , do you maybe happen to know exactly which options are needed in the kernel for the mullvad app? (to save me some time) |
|
You don't need to interact with the wireguard-tools, in fact you won't even need them. preliminary list: CONFIG_WIREGUARD possibly: iptable_filter 16384 1 nf_nat 40960 3 nft_masq,nft_chain_nat,iptable_nat |
|
Much appreciated! |
|
btw I used wireguard-tools because app is not working, so I first went with Wireguard config from the Mullvad, that didn't work either so I finally went with OpenVPN, which worked fine on the first try and which I still use (only way for me to use mullvad vpn currently) Anyway, I tried enabling those options from your preliminary list, some I already did have enabled, some were enabled by enabling the other one from the list, here's what I've enabled (was missing from that list) : I still get the same error both from mullvad dameon and wireguard. |
|
Got it to work, what worked is what I should have done in the first place, to follow the error messages.
It actually said what to look for (net_cls) That's that I guess, it all depends which modules someone already has enabled or not, but if you follow the error messages you will get there in the end. |
Would you mind sharing you kernel config file? I can get the mullvad-daemon to run at boot, but I have no internet access. Mullvad works just fine with gentoo-kernel-bin though. |
|
Actually I quickly dropped that config and went back to the old one, realized I don't need the app at all. Yes, it works with gentoo-kernel-bin, that's what I first tried, just to make sure it's something in the config that I'm missing, then I was curious to find the missing items in my config, it was a pain at first but like I said, if you follow the error messages it's kinda easy, search for it in the kernel, like for example (tunnel) and enable what seems logical etc. |
|
By emerging wireguard-tools I was able to see what config options needed to be enabled by reading the warnings from portage. The Mullvad daemon is working now. |
|
Just adding this here to hopefully help the next person: This error message [same as in the screenshot above, but now searchable ;)], was caused in my case by having cgroup v1 disabled ("cgroup_no_v1=all" in kernel params). Which is a required dependency as indicated by @pinkisemils. |
|
On openSuse Tumbleweed I just installed the 6.13 kernel, and mullvad-vpn stopped working with it due to the exact same mullvad-daemon error message: mullvad-daemon[77639]: [mullvad_daemon][ERROR] Error: Unable to initialize daemon
mullvad-daemon[77639]: Caused by: Unable to initialize split tunneling
mullvad-daemon[77639]: Caused by: Unable to initialize net_cls cgroup instance
mullvad-daemon[77639]: Caused by: EINVAL: Invalid argumentThere seem to have been some changes regarding This change maybe?
Going back to 6.12.10 fixes it temporarily for me, though. |
|
@simonsan thanks for the heads up, we'll have a look. |
Issue report
Operating system: Gentoo Linux 17.1
App version: 2020.4
Issue description
Mullvad expects some unknown set of kernel config options to be enabled. I can't see any documentation on which ones should be (if there is, please close this issue & point me at it). Please list the kernel configuration options which must be enabled in the README.
The text was updated successfully, but these errors were encountered: