Issues connecting to Proton with both OpenVPN and Wireguard

[jgeorgeson]

I have gluetun v3 running via compose on a Synology DSM 7.2 NAS. It routinely will just get into a state with no connectivity and I have to destroy and recreate the gluetun container. I typically will run a manual server update before recreating. A few days ago my internet service went down, and I haven't been able to get gluetun to connect again since then. I am able to connect Proton VPN clients using same account and server settings, so I at least know that in general I am able to make the VPN connection from this network.

Compose file:

services:
  gluetun:
    image: qmcgaw/gluetun:v3
    container_name: vpn-gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
    volumes:
      - /volume1/docker/gluetun:/gluetun
    environment:
      - DOT=on
      - DOT_PROVIDERS=cloudflare,google
      - FIREWALL_OUTBOUND_SUBNETS=172.16.0.0/12,192.168.68.0/24
      - HTTPPROXY=off #change to on if you wish to enable
      - OPENVPN_ENDPOINT_PORT=443
      - OPENVPN_USER=[redacted]+pmp
      - OPENVPN_PASSWORD=[redacted]
      - PORT_FORWARD_ONLY=on
      - PGID=65538 #CHANGE_TO_YOUR_GID
      - PUID=1034 #CHANGE_TO_YOUR_UID
      - SERVER_CITIES=New York,Denver,Los Angeles,Chicago
      - SERVER_COUNTRIES=United States
      - SHADOWSOCKS=off #change to on if you wish to enable
      - TZ=America/Chicago
      - UPDATER_PERIOD=24h
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_PROVIDER=protonvpn
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=openvpn
    network_mode: gluetunbridge
    labels:
      - com.centurylinklabs.watchtower.enable=false
    security_opt:
      - no-new-privileges:true
    restart: always

Here is the command I use to run the manual server update (which appears to working fine at the moment, despite the issue I'm having, so I know that the bridge network for the gluetun container isn't the issue)

docker run --rm -v /volume1/docker/gluetun:/gluetun --network gluetunbridge qmcgaw/gluetun:v3 update --enduser --providers protonvpn

Typical errors

vpn-gluetun  | 2024-10-31T11:14:45-05:00 INFO [vpn] starting
vpn-gluetun  | 2024-10-31T11:14:45-05:00 INFO [firewall] allowing VPN connection...
vpn-gluetun  | 2024-10-31T11:14:45-05:00 INFO [openvpn] OpenVPN 2.6.11 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
vpn-gluetun  | 2024-10-31T11:14:45-05:00 INFO [openvpn] library versions: OpenSSL 3.3.2 3 Sep 2024, LZO 2.10
vpn-gluetun  | 2024-10-31T11:14:45-05:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]149.22.80.55:443
vpn-gluetun  | 2024-10-31T11:14:45-05:00 INFO [openvpn] UDPv4 link local: (not bound)
vpn-gluetun  | 2024-10-31T11:14:45-05:00 INFO [openvpn] UDPv4 link remote: [AF_INET]149.22.80.55:443
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [healthcheck] program has been unhealthy for 56s: restarting VPN
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [vpn] stopping
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [vpn] starting
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [firewall] allowing VPN connection...
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [openvpn] OpenVPN 2.6.11 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [openvpn] library versions: OpenSSL 3.3.2 3 Sep 2024, LZO 2.10
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]146.70.174.194:443
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [openvpn] UDPv4 link local: (not bound)
vpn-gluetun  | 2024-10-31T11:15:42-05:00 INFO [openvpn] UDPv4 link remote: [AF_INET]146.70.174.194:443
vpn-gluetun  | 2024-10-31T11:16:42-05:00 WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
vpn-gluetun  | 🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
vpn-gluetun  | That error usually happens because either:
vpn-gluetun  | 
vpn-gluetun  | 1. The VPN server IP address you are trying to connect to is no longer valid 🔌
vpn-gluetun  |    Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
vpn-gluetun  | 
vpn-gluetun  | 2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
vpn-gluetun  | 
vpn-gluetun  | 3. Your Internet connection is not working 🤯, ensure it works
vpn-gluetun  | 
vpn-gluetun  | 4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
vpn-gluetun  | 
vpn-gluetun  | 2024-10-31T11:16:42-05:00 INFO [openvpn] TLS Error: TLS handshake failed
vpn-gluetun  | 2024-10-31T11:16:42-05:00 INFO [openvpn] SIGTERM received, sending exit notification to peer
vpn-gluetun  | 2024-10-31T11:16:42-05:00 INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
vpn-gluetun  | 2024-10-31T11:16:42-05:00 INFO [vpn] retrying in 15s
vpn-gluetun  | 2024-10-31T11:16:43-05:00 INFO [healthcheck] program has been unhealthy for 1m1s: restarting VPN
vpn-gluetun  | 2024-10-31T11:16:43-05:00 INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
vpn-gluetun  | 2024-10-31T11:16:43-05:00 INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION
vpn-gluetun  | 2024-10-31T11:16:57-05:00 INFO [firewall] allowing VPN connection...
vpn-gluetun  | 2024-10-31T11:16:57-05:00 INFO [openvpn] OpenVPN 2.6.11 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
vpn-gluetun  | 2024-10-31T11:16:57-05:00 INFO [openvpn] library versions: OpenSSL 3.3.2 3 Sep 2024, LZO 2.10
vpn-gluetun  | 2024-10-31T11:16:57-05:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]146.70.202.162:443
vpn-gluetun  | 2024-10-31T11:16:57-05:00 INFO [openvpn] UDPv4 link local: (not bound)
vpn-gluetun  | 2024-10-31T11:16:57-05:00 INFO [openvpn] UDPv4 link remote: [AF_INET]146.70.202.162:443
vpn-gluetun  | 2024-10-31T11:17:57-05:00 INFO [vpn] retrying in 15s

And here is the full gluetun.log

I have tried changing the SERVER_CITIES value, even completely commenting it out to test with any US server, no help. I've tried commenting out the OPENVPN_ENDPOINT_PORT variable to toggle between TCP and UDP. I've tried using Wireguard instead of OpenVPN but that was failing on the external IP lookup/verification with DNS timeout issues (sorry, didn't save the logs). Since I'm on Synology, though, I want to keep it with OpenVPN as there's no kernel support for Wireguard without a third-party build of the module(s).

[huskaramok]

I am having the same issues with windscribe wireguard. the container is healthy but the other containers routed through gluetun cannot access internet. The logs say tls handshake failed

|           └── MTU: 1400
├── DNS settings:
|   ├── Keep existing nameserver(s): no
|   ├── DNS server address to use: 127.0.0.1
|   └── DNS over TLS settings:
|       ├── Enabled: yes
|       ├── Update period: every 24h0m0s
|       ├── Upstream resolvers:
|       |   └── cloudflare
|       ├── Caching: yes
|       ├── IPv6: no
|       └── DNS filtering settings:
|           ├── Block malicious: yes
|           ├── Block ads: no
|           ├── Block surveillance: no
|           └── Blocked IP networks:
|               ├── 127.0.0.1/8
|               ├── 10.0.0.0/8
|               ├── 172.16.0.0/12
|               ├── 192.168.0.0/16
|               ├── 169.254.0.0/16
|               ├── ::1/128
|               ├── fc00::/7
|               ├── fe80::/10
|               ├── ::ffff:127.0.0.1/104
|               ├── ::ffff:10.0.0.0/104
|               ├── ::ffff:169.254.0.0/112
|               ├── ::ffff:172.16.0.0/108
|               └── ::ffff:192.168.0.0/112
├── Firewall settings:
|   ├── Enabled: yes
|   └── Outbound subnets:
|       └── 192.168.1.0/24
├── Log settings:
|   └── Log level: info
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: cloudflare.com:443
|   ├── Duration to wait after success: 5s
|   ├── Read header timeout: 100ms
|   ├── Read timeout: 500ms
|   └── VPN wait durations:
|       ├── Initial duration: 6s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 1000
|   └── Process GID: 1000
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
└── Version settings:
    └── Enabled: yes
2024-11-01T10:07:58Z INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2024-11-01T10:07:58Z INFO [routing] adding route for 0.0.0.0/0
2024-11-01T10:07:58Z INFO [firewall] setting allowed subnets...
2024-11-01T10:07:58Z INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2024-11-01T10:07:58Z INFO [routing] adding route for 192.168.1.0/24
2024-11-01T10:07:58Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2024-11-01T10:07:58Z INFO [dns] using plaintext DNS at address 1.1.1.1
2024-11-01T10:07:58Z INFO [http server] http server listening on [::]:8000
2024-11-01T10:07:58Z INFO [healthcheck] listening on 127.0.0.1:9999
2024-11-01T10:07:58Z INFO [firewall] allowing VPN connection...
2024-11-01T10:07:58Z INFO [wireguard] Using available kernelspace implementation
2024-11-01T10:07:58Z INFO [wireguard] Connecting to 195.181.172.147:1194
2024-11-01T10:07:58Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2024-11-01T10:07:58Z INFO [dns] downloading hostnames and IP block lists
2024-11-01T10:07:58Z INFO [healthcheck] healthy!
2024-11-01T10:08:08Z WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": net/http: TLS handshake timeout, Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": net/http: TLS handshake timeout
2024-11-01T10:08:08Z INFO [dns] attempting restart in 10s
2024-11-01T10:08:18Z INFO [dns] downloading hostnames and IP block lists
2024-11-01T10:08:19Z ERROR [vpn] getting public IP address information: fetching information: Get "https://ipinfo.io/": net/http: TLS handshake timeout
2024-11-01T10:08:29Z WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": net/http: TLS handshake timeout, Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": net/http: TLS handshake timeout
2024-11-01T10:08:29Z INFO [dns] attempting restart in 20s
2024-11-01T10:08:29Z ERROR [vpn] cannot get version information: Get "https://api.github.com/repos/qdm12/gluetun/commits": net/http: TLS handshake timeout
2024-11-01T10:08:49Z INFO [dns] downloading hostnames and IP block lists
2024-11-01T10:08:59Z WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": net/http: TLS handshake timeout, Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": net/http: TLS handshake timeout
2024-11-01T10:08:59Z INFO [dns] attempting restart in 40s
2024-11-01T10:09:39Z INFO [dns] downloading hostnames and IP block lists
2024-11-01T10:09:50Z WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": net/http: TLS handshake timeout, Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": net/http: TLS handshake timeout
2024-11-01T10:09:50Z INFO [dns] attempting restart in 1m20s
2024-11-01T10:11:10Z INFO [dns] downloading hostnames and IP block lists
2024-11-01T10:11:20Z WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": net/http: TLS handshake timeout, Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": net/http: TLS handshake timeout
2024-11-01T10:11:20Z INFO [dns] attempting restart in 2m40s
2024-11-01T10:14:00Z INFO [dns] downloading hostnames and IP block lists
2024-11-01T10:14:10Z WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": net/http: TLS handshake timeout, Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": net/http: TLS handshake timeout
2024-11-01T10:14:10Z INFO [dns] attempting restart in 5m20s

[epic0421]

It is likely related to this issue. Try adding the WIREGUARD_MTU or OPENVPN_MSSFIX environment variable with a value of 1320 (ref) and see if that fixes it.

[qdm12]

This. You can also pull the latest image which lowers the default wireguard MTU from 1400 to 1320, which should solve this.

[jgeorgeson]

I'm getting a different error now with latest image

vpn-gluetun  | 2024-11-05T10:03:12-06:00 INFO [port forwarding] starting
vpn-gluetun  | 2024-11-05T10:03:12-06:00 ERROR [vpn] port forwarding for the first time: getting external IPv4 address: executing remote procedure call: reading from udp connection: read udp 10.21.0.2:59612->10.21.0.1:5351: recvfrom: connection refused - make sure you have +pmp at the end of your OpenVPN username

From my original config, I do indeed have +pmp added (and I've since also added +nr). I tried disabling my synology firewall, and this error went away (though I am still saying qbittorrent saying that it's firewalled, indicating a problem with the port mapping). I'd rather not have my NAS firewall disabled, but I'm not sure what I need to allow in (I don't see anything in the Synology firewall UI that suggests it supports outbound rules, so it has to be some ingress that is blocked).

Also, this log message has a URL that doesn't load for me

vpn-gluetun  | 2024-11-05T10:55:00-06:00 WARN [http server] route GET /v1/openvpn/portforwarded is unprotected by default, please set up authentication following the documentation at https://github.com/qdm12/gluetun-wiki/setup/advanced/control-server.md#authentication since this will become no longer publicly accessible after release v3.40.

This URL works though

https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/control-server.md