Bug: TLS Handshake Failed when running on Google Kubernetes Engine #704

bperlman · 2021-11-01T18:41:32Z

bperlman
Nov 1, 2021

Is this urgent?

No

Host OS

Container Optimized OS by Google

CPU arch

x86_64

VPN service provider

Private Internet Access

What are you using to run the container

Kubernetes

What is the version of Gluetun

Running version latest built on 2021-10-29T01:42:30.959Z (commit f398af1)

What's the problem 🤔

I am getting a TLS Handshake Timeout - I am guessing this has something to do with running this on Google Kubernetes Engine, but I am not really sure how to get to the bottom of the issue. IT seems to not depend on what PIA server I am trying to use and happens regardless. Any help or suggestions are greatly appreciated! :)

Share your logs

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================

Running version latest built on 2021-10-29T01:42:30.959Z (commit f398af1)

🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
🐛 Bug? https://github.com/qdm12/gluetun/issues/new
✨ New feature? https://github.com/qdm12/gluetun/issues/new
☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
💻 Email? [email protected]
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2021/11/01 14:37:36 INFO storage: creating /gluetun/servers.json with 11225 hardcoded servers
2021/11/01 14:37:36 INFO Alpine version: 3.14.2
2021/11/01 14:37:36 INFO OpenVPN 2.4 version: 2.4.11
2021/11/01 14:37:36 INFO OpenVPN 2.5 version: 2.5.2
2021/11/01 14:37:36 INFO Unbound version: 1.13.2
2021/11/01 14:37:36 INFO IPtables version: v1.8.7
2021/11/01 14:37:36 INFO Settings summary below:
|--VPN:
   |--Type: openvpn
   |--OpenVPN:
      |--Version: 2.5
      |--Verbosity level: 1
      |--Network interface: tun0
      |--Encryption preset: strong
   |--Private Internet Access settings:
      |--Regions: ca toronto
      |--OpenVPN selection:
         |--Protocol: udp
         |--PIA encryption preset: strong
|--DNS:
   |--Plaintext address: 1.1.1.1
|--Firewall:
|--Log:
   |--Level: INFO
|--System:
   |--Process user ID: 1000
   |--Process group ID: 1000
   |--Timezone: america/new_york
|--HTTP proxy:
   |--Port: 8888
|--Health:
   |--Server address: 127.0.0.1:9999
   |--Address to ping: github.com
   |--VPN:
      |--Initial duration: 6s
      |--Addition duration: 5s
|--HTTP control server:
   |--Listening port: 8000
   |--Logging: enabled
|--Public IP getter:
   |--Fetch period: 12h0m0s
   |--IP file: /tmp/gluetun/ip
|--Github version information: enabled
2021/11/01 14:37:36 INFO routing: default route found: interface eth0, gateway 10.50.25.1
2021/11/01 14:37:36 INFO routing: local ethernet link found: eth0
2021/11/01 14:37:36 INFO routing: local ipnet found: 10.50.25.0/24
2021/11/01 14:37:36 INFO routing: default route found: interface eth0, gateway 10.50.25.1
2021/11/01 14:37:36 INFO routing: adding route for 0.0.0.0/0
2021/11/01 14:37:36 INFO firewall: firewall disabled, only updating allowed subnets internal list
2021/11/01 14:37:36 INFO routing: default route found: interface eth0, gateway 10.50.25.1
2021/11/01 14:37:36 INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2021/11/01 14:37:36 INFO firewall: enabling...
2021/11/01 14:37:36 INFO firewall: enabled successfully
2021/11/01 14:37:36 INFO dns over tls: using plaintext DNS at address 1.1.1.1
2021/11/01 14:37:36 INFO healthcheck: listening on 127.0.0.1:9999
2021/11/01 14:37:36 INFO firewall: setting VPN connection through firewall...
2021/11/01 14:37:36 INFO http proxy: listening on :8888
2021/11/01 14:37:36 INFO http server: listening on :8000
2021/11/01 14:37:36 INFO openvpn: OpenVPN 2.5.2 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on May  4 2021
2021/11/01 14:37:36 INFO openvpn: library versions: OpenSSL 1.1.1l  24 Aug 2021, LZO 2.10
2021/11/01 14:37:36 INFO openvpn: CRL: loaded 1 CRLs from file -----BEGIN X509 CRL-----
2021/11/01 14:37:36 INFO openvpn: MIIDWDCCAUAwDQYJKoZIhvcNAQENBQAwgegxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTETMBEGA1UEBxMKTG9zQW5nZWxlczEgMB4GA1UEChMXUHJpdmF0ZSBJbnRlcm5ldCBBY2Nlc3MxIDAeBgNVBAsTF1ByaXZhdGUgSW50ZXJuZXQgQWNjZXNzMSAwHgYDVQQDExdQcml2YXRlIEludGVybmV0IEFjY2VzczEgMB4GA1UEKRMXUHJpdmF0ZSBJbnRlcm5ldCBBY2Nlc3MxLzAtBgkqhkiG9w0BCQEWIHNlY3VyZUBwcml2YXRlaW50ZXJuZXRhY2Nlc3MuY29tFw0xNjA3MDgxOTAwNDZaFw0zNjA3MDMxOTAwNDZaMCYwEQIBARcMMTYwNzA4MTkwMDQ2MBECAQYXDDE2MDcwODE5MDA0NjANBgkqhkiG9w0BAQ0FAAOCAgEAppFfEpGsasjB1QgJcosGpzbf2kfRhM84o2TlqY1ua+Gi5TMdKydA3LJcNTjlI9a0TYAJfeRX5IkpoglSUuHuJgXhP3nEvX10mjXDpcu/YvM8TdE5JV2+EGqZ80kFtBeOq94WcpiVKFTR4fO+VkOK9zwspFfb1cNs9rHvgJ1QMkRUF8PpLN6AkntHY0+6DnigtSaKqldqjKTDTv2OeH3nPoh80SGrt0oCOmYKfWTJGpggMGKvIdvU3vH9+EuILZKKIskt+1dwdfA5Bkz1GLmiQG7+9ZZBQUjBG9Dos4hfX/rwJ3eU8oUIm4WoTz9rb71SOEuUUjP5NPy9HNx2vx+cVvLsTF4ZDZaUztW9o9JmIURDtbeyqxuHN3prlPWB6aj73IIm2dsDQvs3XXwRIxs8NwLbJ6CyEuvEOVCskdM8rdADWx1J0lRNlOJ0Z8ieLLEmYAA834VN1SboB6wJIAPxQU3rcBhXqO9y8aa2oRMg8NxZ5gr+PnKVMqag1x0IxbIgLxtkXQvxXxQHEMSODzvcOfK/nBRBsqTj30P+R87sU8titOoxNeRnBDRNhdEy/QGAqGh62ShPpQUCJdnKRiRTjnil9hMQHevoSuFKeEMO30FQL7BZyo37GFU+q1WPCplVZgCP9hC8Rn5K2+f6KLFo5bhtowSmu+GY1yZtg+RTtsA=
2021/11/01 14:37:36 INFO openvpn: -----END X509 CRL-----
2021/11/01 14:37:36 INFO openvpn: TCP/UDP: Preserving recently used remote address: [AF_INET]154.3.40.60:1197
2021/11/01 14:37:36 INFO openvpn: UDP link local: (not bound)
2021/11/01 14:37:36 INFO openvpn: UDP link remote: [AF_INET]154.3.40.60:1197
2021/11/01 14:37:37 WARN openvpn: 'link-mtu' is used inconsistently, local='link-mtu 1569', remote='link-mtu 1554'
2021/11/01 14:37:37 WARN openvpn: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
2021/11/01 14:37:37 WARN openvpn: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2021/11/01 14:37:37 INFO openvpn: [toronto415] Peer Connection Initiated with [AF_INET]154.3.40.60:1197
2021/11/01 14:37:37 INFO openvpn: TUN/TAP device tun0 opened
2021/11/01 14:37:37 INFO openvpn: /sbin/ip link set dev tun0 up mtu 1500
2021/11/01 14:37:37 INFO openvpn: /sbin/ip link set dev tun0 up
2021/11/01 14:37:37 INFO openvpn: /sbin/ip addr add dev tun0 10.27.110.30/24
2021/11/01 14:37:37 INFO openvpn: UID set to nonrootuser
2021/11/01 14:37:37 INFO openvpn: Initialization Sequence Completed
2021/11/01 14:37:43 INFO healthcheck: healthy!
2021/11/01 14:37:47 ERROR ip getter: Get "https://ipinfo.io/ip": net/http: TLS handshake timeout
2021/11/01 14:37:47 INFO ip getter: retrying in 5s
2021/11/01 14:37:47 ERROR vpn: cannot get version information: Get "https://api.github.com/repos/qdm12/gluetun/commits": net/http: TLS handshake timeout
2021/11/01 14:38:03 WARN ip getter: Get "https://ipinfo.io/154.3.40.60": net/http: TLS handshake timeout
2021/11/01 14:38:03 INFO ip getter: Public IP address is 154.3.40.60

Another example using the China server:

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================

Running version latest built on 2021-10-29T01:42:30.959Z (commit f398af1)

🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
🐛 Bug? https://github.com/qdm12/gluetun/issues/new
✨ New feature? https://github.com/qdm12/gluetun/issues/new
☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
💻 Email? [email protected]
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2021/11/01 15:01:33 INFO storage: creating /gluetun/servers.json with 11225 hardcoded servers
2021/11/01 15:01:34 INFO Alpine version: 3.14.2
2021/11/01 15:01:35 INFO OpenVPN 2.4 version: 2.4.11
2021/11/01 15:01:35 INFO OpenVPN 2.5 version: 2.5.2
2021/11/01 15:01:35 INFO Unbound version: 1.13.2
2021/11/01 15:01:35 INFO IPtables version: v1.8.7
2021/11/01 15:01:35 INFO Settings summary below:
|--VPN:
   |--Type: openvpn
   |--OpenVPN:
      |--Version: 2.5
      |--Verbosity level: 1
      |--Network interface: tun0
      |--Encryption preset: strong
   |--Private Internet Access settings:
      |--Regions: china
      |--OpenVPN selection:
         |--Protocol: udp
         |--PIA encryption preset: strong
|--DNS:
   |--Plaintext address: 1.1.1.1
   |--DNS over TLS:
      |--Unbound:
          |--DNS over TLS providers:
              |--Cloudflare
          |--Listening port: 53
          |--Access control:
              |--Allowed:
                  |--0.0.0.0/0
                  |--::/0
          |--Caching: enabled
          |--IPv4 resolution: enabled
          |--IPv6 resolution: disabled
          |--Verbosity level: 1/5
          |--Verbosity details level: 0/4
          |--Validation log level: 0/2
          |--Username:
      |--Blacklist:
         |--Blocked categories: malicious
         |--Additional IP networks blocked: 13
      |--Update: every 24h0m0s
|--Firewall:
|--Log:
   |--Level: INFO
|--System:
   |--Process user ID: 1000
   |--Process group ID: 1000
   |--Timezone: america/new_york
|--HTTP proxy:
   |--Port: 8888
   |--Log: enabled
|--Health:
   |--Server address: 127.0.0.1:9999
   |--Address to ping: github.com
   |--VPN:
      |--Initial duration: 6s
      |--Addition duration: 5s
|--HTTP control server:
   |--Listening port: 8000
   |--Logging: enabled
|--Public IP getter:
   |--Fetch period: 12h0m0s
   |--IP file: /tmp/gluetun/ip
|--Github version information: enabled
2021/11/01 15:01:35 INFO routing: default route found: interface eth0, gateway 10.48.144.1
2021/11/01 15:01:35 INFO routing: local ethernet link found: eth0
2021/11/01 15:01:35 INFO routing: local ipnet found: 10.48.144.1/32
2021/11/01 15:01:35 INFO routing: default route found: interface eth0, gateway 10.48.144.1
2021/11/01 15:01:35 INFO routing: adding route for 0.0.0.0/0
2021/11/01 15:01:35 INFO firewall: firewall disabled, only updating allowed subnets internal list
2021/11/01 15:01:35 INFO routing: default route found: interface eth0, gateway 10.48.144.1
2021/11/01 15:01:35 INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2021/11/01 15:01:35 INFO firewall: enabling...
2021/11/01 15:01:35 INFO firewall: enabled successfully
2021/11/01 15:01:35 INFO healthcheck: listening on 127.0.0.1:9999
2021/11/01 15:01:35 INFO dns over tls: using plaintext DNS at address 1.1.1.1
2021/11/01 15:01:35 INFO firewall: setting VPN connection through firewall...
2021/11/01 15:01:35 INFO http proxy: listening on :8888
2021/11/01 15:01:35 INFO http server: listening on :8000
2021/11/01 15:01:35 INFO openvpn: OpenVPN 2.5.2 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on May  4 2021
2021/11/01 15:01:35 INFO openvpn: library versions: OpenSSL 1.1.1l  24 Aug 2021, LZO 2.10
2021/11/01 15:01:35 INFO openvpn: CRL: loaded 1 CRLs from file -----BEGIN X509 CRL-----
2021/11/01 15:01:35 INFO openvpn: MIIDWDCCAUAwDQYJKoZIhvcNAQENBQAwgegxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTETMBEGA1UEBxMKTG9zQW5nZWxlczEgMB4GA1UEChMXUHJpdmF0ZSBJbnRlcm5ldCBBY2Nlc3MxIDAeBgNVBAsTF1ByaXZhdGUgSW50ZXJuZXQgQWNjZXNzMSAwHgYDVQQDExdQcml2YXRlIEludGVybmV0IEFjY2VzczEgMB4GA1UEKRMXUHJpdmF0ZSBJbnRlcm5ldCBBY2Nlc3MxLzAtBgkqhkiG9w0BCQEWIHNlY3VyZUBwcml2YXRlaW50ZXJuZXRhY2Nlc3MuY29tFw0xNjA3MDgxOTAwNDZaFw0zNjA3MDMxOTAwNDZaMCYwEQIBARcMMTYwNzA4MTkwMDQ2MBECAQYXDDE2MDcwODE5MDA0NjANBgkqhkiG9w0BAQ0FAAOCAgEAppFfEpGsasjB1QgJcosGpzbf2kfRhM84o2TlqY1ua+Gi5TMdKydA3LJcNTjlI9a0TYAJfeRX5IkpoglSUuHuJgXhP3nEvX10mjXDpcu/YvM8TdE5JV2+EGqZ80kFtBeOq94WcpiVKFTR4fO+VkOK9zwspFfb1cNs9rHvgJ1QMkRUF8PpLN6AkntHY0+6DnigtSaKqldqjKTDTv2OeH3nPoh80SGrt0oCOmYKfWTJGpggMGKvIdvU3vH9+EuILZKKIskt+1dwdfA5Bkz1GLmiQG7+9ZZBQUjBG9Dos4hfX/rwJ3eU8oUIm4WoTz9rb71SOEuUUjP5NPy9HNx2vx+cVvLsTF4ZDZaUztW9o9JmIURDtbeyqxuHN3prlPWB6aj73IIm2dsDQvs3XXwRIxs8NwLbJ6CyEuvEOVCskdM8rdADWx1J0lRNlOJ0Z8ieLLEmYAA834VN1SboB6wJIAPxQU3rcBhXqO9y8aa2oRMg8NxZ5gr+PnKVMqag1x0IxbIgLxtkXQvxXxQHEMSODzvcOfK/nBRBsqTj30P+R87sU8titOoxNeRnBDRNhdEy/QGAqGh62ShPpQUCJdnKRiRTjnil9hMQHevoSuFKeEMO30FQL7BZyo37GFU+q1WPCplVZgCP9hC8Rn5K2+f6KLFo5bhtowSmu+GY1yZtg+RTtsA=
2021/11/01 15:01:35 INFO openvpn: -----END X509 CRL-----
2021/11/01 15:01:35 INFO openvpn: TCP/UDP: Preserving recently used remote address: [AF_INET]188.241.80.26:1197
2021/11/01 15:01:35 INFO openvpn: UDP link local: (not bound)
2021/11/01 15:01:35 INFO openvpn: UDP link remote: [AF_INET]188.241.80.26:1197
2021/11/01 15:01:36 WARN openvpn: 'link-mtu' is used inconsistently, local='link-mtu 1569', remote='link-mtu 1554'
2021/11/01 15:01:36 WARN openvpn: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
2021/11/01 15:01:36 WARN openvpn: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2021/11/01 15:01:36 INFO openvpn: [china405] Peer Connection Initiated with [AF_INET]188.241.80.26:1197
2021/11/01 15:01:36 INFO openvpn: TUN/TAP device tun0 opened
2021/11/01 15:01:36 INFO openvpn: /sbin/ip link set dev tun0 up mtu 1500
2021/11/01 15:01:36 INFO openvpn: /sbin/ip link set dev tun0 up
2021/11/01 15:01:36 INFO openvpn: /sbin/ip addr add dev tun0 10.11.110.10/24
2021/11/01 15:01:36 INFO openvpn: UID set to nonrootuser
2021/11/01 15:01:36 INFO openvpn: Initialization Sequence Completed
2021/11/01 15:01:36 INFO dns over tls: downloading DNS over TLS cryptographic files
2021/11/01 15:01:49 WARN dns over tls: cannot update files
2021/11/01 15:01:49 INFO dns over tls: attempting restart in 10s
2021/11/01 15:01:59 INFO dns over tls: downloading DNS over TLS cryptographic files
2021/11/01 15:02:00 ERROR vpn: cannot get version information: Get "https://api.github.com/repos/qdm12/gluetun/commits": net/http: TLS handshake timeout
2021/11/01 15:02:08 WARN ip getter: Get "https://ipinfo.io/188.241.80.26": net/http: TLS handshake timeout
2021/11/01 15:02:08 INFO ip getter: Public IP address is 188.241.80.26
2021/11/01 15:02:12 WARN dns over tls: cannot update files
2021/11/01 15:02:12 INFO dns over tls: attempting restart in 20s
2021/11/01 15:02:32 INFO dns over tls: downloading DNS over TLS cryptographic files
2021/11/01 15:02:47 WARN dns over tls: cannot update files
2021/11/01 15:02:47 INFO dns over tls: attempting restart in 40s

Share your configuration

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gluetun-pia
  labels:
    app: gluetun-pia
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gluetun-pia
  template:
    metadata:
      labels:
        app: gluetun-pia
    spec:
      containers:
      - name: gluetun-pia
        image: qmcgaw/gluetun:latest
        imagePullPolicy: Always
        env:
          - name: OPENVPN_USER
            value: "--removed--"
          - name: OPENVPN_PASSWORD
            value: "--removed--"
          - name: REGION
            value: "CA Toronto"
          - name: VPNSP
            value: "private internet access"
          - name: HTTPPROXY
            value: "on"
          - name: TZ
            value: "America/New_York"
        ports:
          - containerPort: 8888
        securityContext:
          capabilities:
            add:
              - NET_ADMIN

qdm12 · 2021-11-01T22:34:16Z

qdm12
Nov 1, 2021
Maintainer

healthcheck: healthy! means ping ICMP requests can go through. HTTPs gets dropped it looks like.
net/http: TLS handshake timeout that might be some firewall dropping your requests for some reason, although Public IP address is 154.3.40.60 indicates that some domains are allowed (github.com, ipinfo.io seem blocked).
China server - they tend to block everything so that's likely why.

I'm not too sure yet. Not a bug with gluetun I think so I converted this to a discussion.

Where is your container instance geographically located?

0 replies

bperlman · 2021-11-02T13:16:52Z

bperlman
Nov 2, 2021
Author

Thanks! Apologies if I put this in the wrong spot.

Strangely, when I use the PIA app with VPN via either of the ones I attempted in the above examples, github and ipinfo are both available, including on the China one, so perhaps you're right it's pointing to some kind of firewall issue. Also strangely though I can access those via another pod in the cluster. Networking isn't my strength so I'm a bit out of my element but I'll keep on it...

The container instance is in GCP us-east1-b (South Carolina)

5 replies

qdm12 Nov 2, 2021
Maintainer

Maybe they block/drop packets on UDP 1194 (what the VPN goes through with on PIA).

bperlman Nov 2, 2021
Author

That seems to be it actually! Thank you!

qdm12 Nov 2, 2021
Maintainer

Oh is it? Do they block it by default? It's also funny some of the packets managed to go through but not all...

bperlman Nov 2, 2021
Author

Yeah it's odd that some got through - it appears that it's not open by default - when I created a firewall rule to expressly open it and make that rule available to the cluster, things started working and much more quickly. I also set the FIREWALL param to off (found that in a Kubernetes issue mentioned in the repo - though not certain that made a difference)

qdm12 Nov 2, 2021
Maintainer

Careful with turning off the firewall, requests might go around the VPN especially if this one fails

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bug: TLS Handshake Failed when running on Google Kubernetes Engine #704

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 5 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Bug: TLS Handshake Failed when running on Google Kubernetes Engine #704

bperlman Nov 1, 2021

Is this urgent?

Host OS

CPU arch

VPN service provider

What are you using to run the container

What is the version of Gluetun

What's the problem 🤔

Share your logs

Share your configuration

Replies: 2 comments · 5 replies

qdm12 Nov 1, 2021 Maintainer

bperlman Nov 2, 2021 Author

qdm12 Nov 2, 2021 Maintainer

bperlman Nov 2, 2021 Author

qdm12 Nov 2, 2021 Maintainer

bperlman Nov 2, 2021 Author

qdm12 Nov 2, 2021 Maintainer

bperlman
Nov 1, 2021

Replies: 2 comments 5 replies

qdm12
Nov 1, 2021
Maintainer

bperlman
Nov 2, 2021
Author

qdm12 Nov 2, 2021
Maintainer

bperlman Nov 2, 2021
Author

qdm12 Nov 2, 2021
Maintainer

bperlman Nov 2, 2021
Author

qdm12 Nov 2, 2021
Maintainer