Closed Lokilicious closed 1 month ago
I have the exact same problem, virtually identical config.
I tried to set up port forwarding manually inside the container by following the instructions from https://protonvpn.com/support/port-forwarding-manual-setup/#how-to-use-port-forwarding
/ # apk add libnatpmp --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
/ # natpmpc
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned 0 (OK)
Public IP address : 149.88.27.206
epoch = 1124894
closenatpmp() returned 0 (SUCCESS)
/ # natpmpc -g 10.2.0.1 -a 1 0 udp 60
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned 0 (OK)
Public IP address : 149.88.27.206
epoch = 1124909
sendnewportmappingrequest returned 12 (SUCCESS)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -7 (FAILED)
readnatpmpresponseorretry() failed : the gateway does not support nat-pmp
The instructions work fine when I'm connected to the VPN using ProtonVPN's official Linux app (although the app only supports OpenVPN, so it's possible that this issue is wireguard-specific).
Manual port forwarding works with WireGuard, using config downloaded from ProtonVPN site:
[Interface]
# Key for wg-ch
# Bouncing = 0
# NetShield = 1
# Moderate NAT = off
# NAT-PMP (Port Forwarding) = on
# VPN Accelerator = on
PrivateKey = [...]
Address = 10.2.0.2/32
DNS = 10.2.0.1
[Peer]
# CH#61
PublicKey = CgC9o9MUl4n/r4pueamp9JFw2cneCqSnHJD088Zm+Bg=
AllowedIPs = 0.0.0.0/0
Endpoint = 79.135.104.11:51820
$ sudo wg-quick up wg-ch
$ natpmpc -g 10.2.0.1
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned 0 (OK)
Public IP address : 79.135.104.13
epoch = 3984812
closenatpmp() returned 0 (SUCCESS)
$ natpmpc -a 1 0 udp 60 -g 10.2.0.1
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned 0 (OK)
Public IP address : 79.135.104.13
epoch = 3984823
sendnewportmappingrequest returned 12 (SUCCESS)
readnatpmpresponseorretry returned 0 (OK)
Mapped public port 38534 protocol UDP to local port 0 lifetime 60
epoch = 3984823
closenatpmp() returned 0 (SUCCESS)
$ natpmpc -a 1 0 tcp 60 -g 10.2.0.1
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned 0 (OK)
Public IP address : 79.135.104.13
epoch = 3984852
sendnewportmappingrequest returned 12 (SUCCESS)
readnatpmpresponseorretry returned 0 (OK)
Mapped public port 38534 protocol TCP to local port 0 lifetime 60
epoch = 3984852
closenatpmp() returned 0 (SUCCESS)
Strange, although no change was made to the code, and their documentation looks the same ๐ค
I changed the code such that the error contain the details of each failed attempt (9 max retries) when doing a network call in commit d8b9b2a85b297208b7fe699e842167dbce752160 can you try pulling the latest image and report back with the logs you get? Because right now executing remote procedure call: connection timeout: after 2m7.75s
doesn't really highlight what happened in those 9 tries, except that they all failed.
EDIT: changed bad commit to commit d8b9b2a85b297208b7fe699e842167dbce752160
Port forwarding seems to work fine for me now... I guess it was a temporary problem on the provider's side ยฏ\_(ใ)_/ยฏ
We might want to wait with closing this issue until @Lokilicious confirms this.
Thank you for this awesome piece of software!
For me it also resolved itself ๐ค maybe some issue with the ProtonVPN server. Anyhow having more accurate log output is always a good thing. Thanks @qdm12
Issue just resurfaced:
26/01/2024 07:28:42 2024-01-26T06:28:42Z ERROR [vpn] port forwarding for the first time: adding UDP port mapping: executing remote procedure call: connection timeout: failed attempts: read udp 10.2.0.2:47511->10.2.0.1:5351: i/o timeout (tries 1, 2, 3, 4, 5, 6, 7, 8, 9)
After changing the ProtonVPN Server it started working again. ๐ค Not sure if its an issue from gluetun or the server behaves strangely.
It has to be an issue on ProtonVPN's side: the issue also resurfaced for me yesterday. I connected manually (not using gluetun) to the same server with which I was having issues using gluetun: same keys and ip. Using ProtonVPN's own instructions from https://protonvpn.com/support/port-forwarding-manual-setup/#how-to-use-port-forwarding I wasn't able to set up port forwarding:
$ natpmpc -g 10.2.0.1
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned 0 (OK)
Public IP address : 149.88.27.206
epoch = 1872293
closenatpmp() returned 0 (SUCCESS)
$ natpmpc -a 1 0 udp 60 -g 10.2.0.1
initnatpmp() returned 0 (SUCCESS)
using gateway : 10.2.0.1
sendpublicaddressrequest returned 2 (SUCCESS)
readnatpmpresponseorretry returned 0 (OK)
Public IP address : 149.88.27.206
epoch = 1872303
sendnewportmappingrequest returned 12 (SUCCESS)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -100 (TRY AGAIN)
readnatpmpresponseorretry returned -7 (FAILED)
readnatpmpresponseorretry() failed : the gateway does not support nat-pmp
Thanks @j-piecuch for confirming, let's close this then. Might be worth sending Protonvpn a message next time this happens. Thanks everyone!
Closed issues are NOT monitored, so commenting here is likely to be not seen. If you think this is still unresolved and have more information to bring, please create another issue.
This is an automated comment setup because @qdm12 is the sole maintainer of this project which became too popular to monitor issues closed.
Is this urgent?
No
Host OS
Debian Buster
CPU arch
x86_64
VPN service provider
ProtonVPN
What are you using to run the container
docker-compose
What is the version of Gluetun
Running version latest built on 2024-01-01T18:24:19.221Z (commit c826707)
What's the problem ๐ค
Port forwarding fails with
2024-01-17T12:39:27Z ERROR [vpn] port forwarding for the first time: adding UDP port mapping: executing remote procedure call: connection timeout: after 2m7.75s
Share your logs (at least 10 lines)
Share your configuration