The following setup for the VPN with BTGuard. (The BTGuard Setup does not align well with the headless server and Deluge setup.)

• To install openvpn sudo apt install network-manager-openvpn
• Download BTGuard certificate (CA) wget -O /etc/openvpn/btguard.ca.crt http://btguard.com/btguard.ca.crt
• Download BTGuard OpenVPN configuration wget -O /etc/openvpn/btguard.conf http://btguard.com/btguard.conf
• Modify the /etc/openvpn/btguard.conf file as follows:
  • To optionally allow additional logging add the line: status openvpn-status.log (I added in before the “verb 3” line)
  • To allow automatic login change the line: auth-user-pass to auth-user-pass /etc/openvpn/login.conf

Create the /etc/openvpn/login.conf file and add only the BTGuard User name on the first line and associated password on the second line. Consideration should be given to protecting this information by limiting access to this file, e.g. changing file to root access only. (As these files a configuration files only they are not to be made executable.)

The BTguard VPN protection can be started with the command sudo openvpn /etc/openvpn/btguard.conf, however it should have been automatically setup during installation using a systemd boot script.

BTGuard seems to change their VPN IP addresses from time to time! The iptables configuration needs to be changed to match to ensure operation. BTGuard seems to show there current IP addresses at their Knowledgebase How can I test if BTGuard VPN is working?. Sadly BTGuard do not seem to pro-actively inform their users of these changes, perhaps they do not want to keep a mailing list to protect client security.

Sample /etc/openvpn/btguard.conf:

client
dev tun
proto udp
remote vpn.btguard.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/btguard.ca.crt
status openvpn-status.log
verb 3
mute 3
auth-user-pass /etc/openvpn/login.conf
mute-replay-warnings
float
reneg-sec 0

Sample /etc/openvpn/login.conf:

Username
Password

Obviously, Username and password are end user specific.

If the nftables repository can not be found in Ubuntu 18.04 they will need to be added: sudo vim /etc/apt/sources.list and add the following repositories:

  deb http://archive.ubuntu.com/ubuntu/ bionic universe
  deb http://archive.ubuntu.com/ubuntu/ bionic-updates universe
  deb http://security.ubuntu.com/ubuntu bionic-security universe

#!/usr/sbin/nft -f

 define lan = ens3
 define tun = tun0 

 # Clean out the current ruleset
 flush ruleset

 #This machine is exclusively for the use of IPv4 so drop all IPv6 communications.
 table ip6 firewall {
   chain input {
      type filter hook input priority 0; policy drop;
   }
   
   chain output {
      type filter hook output priority 0; policy drop;
   }
      
   chain forward {
      type filter hook forward priority 0; policy drop;
   }
 }     

 #Setup ip (ipv4) rules, default policy is to drop
 table ip firewall {

   chain input {
      type filter hook input priority 0; policy drop;
      
      # accept input from loopback interface
      iif lo counter accept

      # Make sure that you can communicate within your own network if Private Network option is enabled 
      ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 counter accept
      # ip saddr 172.16.0.0/12  ip daddr 172.16.0.0/12  counter accept
      # ip saddr 10.0.0.0/8     ip daddr 10.0.0.0/8     counter accept

      # allow established/related connections
      ct state {established, related} counter accept
      
      # allow icmp
      ip protocol icmp icmp type {
         echo-request, echo-reply, time-exceeded,
         parameter-problem, destination-unreachable
      } counter accept

      # iifname $tun counter accept

      }

   chain output {
      type filter hook output priority 0; policy drop;

      # accept output from loopback interface
      oif lo counter accept

      # Make sure that you can communicate within your own network if Private Network option is enabled
      ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 counter accept
      # ip saddr 172.16.0.0/12  ip daddr 172.16.0.0/12  counter accept
      # ip saddr 10.0.0.0/8     ip daddr 10.0.0.0/8     counter accept

      oifname $tun counter accept

      # specifically allow IP addresses of VPN only for outgoing packet on lan

      #PrivatVPN Addresses (Host Addresses)
      oifname $lan ip daddr  27.50.73.55       counter accept #Host: au-mel.pvdata.host
      oifname $lan ip daddr  46.102.153.131    counter accept #Host: au-syd.pvdata.host
      oifname $lan ip daddr  91.207.173.91     counter accept #Host: sg-sin.pvdata.host

      counter drop
   }

  chain forward {
      type filter hook forward priority 0; policy drop;
   }
}

The use of the counter directive allows the usage to be checked. I commented out lines that were not being used.

#!/usr/sbin/nft -f

 # define common referenced interfaces
 define lan = ens3
 define tun = tun0
 define wan_ip4 = 112.213.222.38

 # Clean out the current ruleset
 flush ruleset

 #This machine is exclusively for the use of IPv4 so drop all IPv6 communications.
 table ip6 firewall {
   chain input {
      type filter hook input priority 0; policy drop;
   }
   
   chain output {
      type filter hook output priority 0; policy drop;
   }
      
   chain forward {
      type filter hook forward priority 0; policy drop;
   }
 }     

 #Setup ip (ipv4) rules, default policy is to drop
 table ip firewall {

   chain input {
      type filter hook input priority 0; policy drop;
      # accept input from loopback interface
      iif lo counter accept

      # Make sure that you can communicate within your own network
      # if Private Network option is enabled
      # Comment out private network ranges not used
      ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 counter accept
      # ip saddr 172.16.0.0/12 ip daddr 172.16.0.0/12 counter accept
      # ip saddr 10.0.0.0/8 ip daddr 10.0.0.0/8 counter accept

      # allow established/related connections
      ct state {established, related} counter accept

      # allow icmp
      ip protocol icmp icmp type {
         echo-request, echo-reply, time-exceeded,
         parameter-problem, destination-unreachable
      } counter accept

      # iifname $tun counter accept
   }

   chain output {
      type filter hook output priority 0; policy drop;
      # accept output from loopback interface
      oif lo counter accept
      
      oifname $lan daddr $wan_ip4 counter drop

      # Make sure that you can communicate within your own network
      # if Private Network option is enabled
      # Comment out private network ranges not used
      ip saddr 192.168.0.0/16 ip daddr 192.168.0.0/16 counter accept
      # ip saddr 172.16.0.0/12 ip daddr 172.16.0.0/12 counter accept
      # ip saddr 10.0.0.0/8 ip daddr 10.0.0.0/8 counter accept

      oifname $tun counter accept

      # specifically allow IP addresses of VPN only for outgoing
      # packet on lan
      oifname $lan daddr 63.142.161.0/24   counter accept
      oifname $lan daddr 95.211.0.0/16     counter accept
      oifname $lan daddr 85.17.28.0/24     counter accept
      oifname $lan daddr 203.174.86.88/32  counter accept
      oifname $lan daddr 209.58.183.206/32 counter accept
      oifname $lan daddr 109.201.137.0/24  counter accept
      oifname $lan daddr 104.254.90.0/24   counter accept
      oifname $lan daddr 104.254.92.0/24   counter accept
      # IP address and subnet masks from BTGuard
      # 209.58.183.206/32 seems to be the BTGuard Singapore address
      # since circa Oct 2016 & removed May 2017
      # 104.254.90.0/24 seems to be the BTGuard Singapore? address
      # since circa May 2017
      # 104.254.92.0/24 seems to be the BTGuard Singapore? address
      # since circa May 2017
   }

   chain forward {
      type filter hook forward priority 0; policy drop;
      #iifname $tun counter accept
      #iifname $lan oifname $tun counter accept
      #iifname $tun oifname $lan counter accept
   }
 }

# Flush
iptables -F
iptables -t nat -F
iptables -t mangle -F

# Flush V6
ip6tables -F
ip6tables -t nat -F
ip6tables -t mangle -F

# Local
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Local V6
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT

# Make sure you can communicate with any DHCP server
iptables -A OUTPUT -d 255.255.255.255 -j ACCEPT
iptables -A INPUT -s 255.255.255.255 -j ACCEPT

# Make sure that you can communicate within your own network if Private Network option is enabled
iptables -A INPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT
iptables -A OUTPUT -s 192.168.0.0/16 -d 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -s 10.0.0.0/8 -d 10.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -s 10.0.0.0/8 -d 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -s 172.16.0.0/12 -d 172.16.0.0/12 -j ACCEPT
iptables -A OUTPUT -s 172.16.0.0/12 -d 172.16.0.0/12 -j ACCEPT

# Allow incoming pings if Ping option is enabled
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Allow established sessions to receive traffic:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow TUN
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT

# make sure that eth and tun can communicate
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

# specifically allow IP addresses of VPN only for outgoing packet on eth0
iptables -A OUTPUT -o eth0 -d 63.142.161.0/24 -j ACCEPT
iptables -A OUTPUT -o eth0 -d 95.211.0.0/16 -j ACCEPT
iptables -A OUTPUT -o eth0 -d 85.17.28.0/24 -j ACCEPT
iptables -A OUTPUT -o eth0 -d 203.174.86.88 -j ACCEPT
#iptables -A OUTPUT -o eth0 -d 209.58.183.206 -j ACCEPT
iptables -A OUTPUT -o eth0 -d 109.201.137.0/24 -j ACCEPT
iptables -A OUTPUT -o eth0 -d 104.254.90.0/24 -j ACCEPT
iptables -A OUTPUT -o eth0 -d 104.254.92.0/24 -j ACCEPT
# IP address and subnet masks from BTGuard
# 209.58.183.206 seems to be the BTGuard Singapore address since circa Oct 2016 & removed May 2017
# 104.254.90.0/24 seems to be the BTGuard Singapore? address since circa May 2017
# 104.254.92.0/24 seems to be the BTGuard Singapore? address since circa May 2017

# Block All else, so that nothing leaks if VPN disconnects
iptables -A OUTPUT -j DROP
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP

# Block All V6
ip6tables -A OUTPUT -j DROP
ip6tables -A INPUT -j DROP
ip6tables -A FORWARD -j DROP

• Remember if creating the script from scratch to make executable use: sudo chmod a+x BTGuard_iptable.sh
• Use the route, ifconfig, ip a and ip route commands to help check configuration of your network. (As noted below, particularly check the eth0 / tun0 references match.)
• The network configuration file can be found at /etc/network/interfaces
• If iptables is not installed run sudo apt install iptables
• Ensure the network reference such as “eth0” is consistent, particularly with Ubuntu 16.04 VM which seems to rename this reference, see Changing Network Interfaces name Ubuntu 16.04 for further information on this matter.
• The outgoing packet IP addresses, including subnet masks, must match those specified by BTGuard.
• To get the external IP address use: wget http://ipinfo.io/ip -qO -
• To see the current openvpn status use: sudo systemctl status openvpn@btguard.service or journalctl -u openvpn@btguard.service -b

Reference How to save rules of the iptables? and Ubuntu Netfilter manual

• Install iptables persistent sudo apt install iptables-persistent
• To save current IPTable configuration use: sudo netfilter-persistent save or journalctl -u openvpn@btguard.service -f, where options are; -u is followed by the service and the -f give continuous output, use cont-c to breakout.

I have been using MariaDB instead of MySQL, as MariaDB is true opensource software and MySQL belongs to a large corporation. MariaDB has a few “quirks” to setup comparied to MySQL which is more commonly described.

Make sure that MySQL is NOT installed, if so uninstall it.

MariaDB can be installed by sudo apt install mariadb-server. The latest version can be downloaded from instructions from MariaDB Foundation Downloads Setting up MariaDB Repositories.

To setup secure root access:

• sudo mysql -u root
• use mysql;
• update user set plugin='' where User='root';
• flush privileges;
• \q
• mysql_secure_installation
• Add password, and then Y for all other questions

Check status of mariadb sudo systemctl status mysql

Next move MySQL Data Directory

Check current location of MySQL data directory: mysql -u root -p and then at mysql> select @@datadir;. It should be /var/lib/mysql. Exit mysql prompt with \q.

Stop MySQL : sudo systemctl stop mysql

My the mysql data directory to your preferred location: sudo mv /var/lib/mysql /mnt/shared/kodi

Next create a symlink pointing to the new location: sudo ln -s /mnt/shared/kodi/mysql /var/lib/mysql. Another option instead of using a symlink is to adjust the mysql.cnf file datadir parameter, i.e. change datadir=/var/lib/mysql to datadir=/mnt/shared/kodi/mysql. Again most the documentation on mysql.cnf is for mysql not mariadb, which has its own quirks. See the notes on adjusting bind-address below to clarify.

The current version of mariadb does not use apparmor, so no need to adjust for this!

The mysql network access needs to be configured to all full LAN access, default access is localhost only. The mysql.cnf configuration file needs to be updated. Mariadb handles this differently than MySQL. The main configuration file /etc/mysql/mariadb.cnf points to other directories with configuration files. Checking these directories shows the mariadb server parameters are located in /etc/mysql/mariadb.conf.d/50-server.cnf, to edit: sudo vim /etc/mysql/mariadb.conf.d/50-server.cnf. Find the parameter bind-address = 127.0.0.1 and change to the server IP address bind-address = 192.168.1.19.

Restart mysql: sudo systemctl restart mysql, check all is running well: sudo systemctl status mysql, and then check listening address on mysql port: sudo lsof -i -P | grep :3306

Next setup the mysql kodi database access:

• mysql -u root -p
• create user 'kodi' identified by 'kodi';
• grant all on *.* to 'kodi';
• show grants for 'kodi';
• \q

Work in Progress. I have not been able to get this working yet. I get the webui operational with the default kodi-headless settings. When I adjust the advanced kodi setting the webui is not available. I am also concern that this setup will not update the media library as there is no drive link in the design.

The following command is used to set up Docker Kodi Headless Media Center, from LinuxServer.IO docker-kodi-headless:

docker create --name=kodi-headless \
-v <path to data>:/config/.kodi \
-e PGID=<gid> -e PUID=<uid> \
-e TZ=<timezone> \
-p 8080:8080 -p 9777:9777/udp \
linuxserver/kodi-headless

--name=kodi-headless \

The container is assigned the name kodi-headless. This has the benefit over the default random assigned name to provide a consistent container name, also helping preventing multiple kodi-headless containers from being started, as running container names must be unique. Docker reference: Container identification Name (-name)

-v <path to data>:/config/.kodi \

<path to data> is the path on the local machine drive volume where the kodi configuration files are loaded. It is mapped to /config/.kodi with in the container. These files are persistent outside of the Kodi Docker container. Docker documentation link: Use volumes

-e PGID=<gid> -e PUID=<uid> \

These are environment variables to be set as specifically explained in docker-kodi-headless . Some addition information maybe garnered from Linuxserver.io - Kodi-Headless Support threads.

-e TZ=<timezone> \

An other environment variable to be set, my area is Australia/Perth

-p 8080:8080 -p 9777:9777/udp \

-p IP:host_port:container_port. The Kodi ports are described below, with source references. Unless the host machine is already using these ports there is no need to remap them. I found the IP in IP:host was necessary to enforce IPv4 mapping, without mapping sometimes was IPv6 (strange)

Kodi headless webui port is on port 8080, see Kodi documentation Web interface and Webserver

Kodi has an EventServer mapped to port 9777/udp, see Kodi documentation EventServer

My Setup:

docker create --name=kodi-headless \
-v /mnt/shared/kodi/config:/config/.kodi \
-e PGID=1001 -e PUID=1000 \
-e TZ=Australia/Perth \
-p 192.168.1.19:8080:8080 -p 192.168.1.19:9777:9777/udp \
linuxserver/kodi-headless

The docker create command creates the container, but does not start it. To create and start use the docker run command.

To check running docker containers “docker ps”, to check all docker containers, running and stopped “docker ps -a”.

To start a container “docker <name>”, or “docker kodi-headless”, to stop a container “docker stop <name>”, where the <name> is the relevant container listed in “docker ps -a”

After starting access to the web interface should be possible from the LAN, at the host IP address and host assigned port, e.g. “192.168.1.19:8080”.

Shell access whilst the container is running: “docker exec -it kodi-headless /bin/bash”, type “exit” to exit.

It would seem that starting the container populates the ”/config/.kodi“ directory. These files are stored permanently outside the emphemeral container and can be edited from the permanent stored location <path to data>, in my case ”/mnt/shared/kodi/config“