Bug: dns over tls timing out on latest image (TLS handshake)

qdm12 / gluetun

VPN client in a thin Docker container for multiple VPN providers, written in Go, and using OpenVPN or Wireguard, DNS over TLS, with a few proxy servers built-in.

MIT License

8.13k stars 373 forks source link

Is this urgent?

Host OS

Ubuntu 64-bit

CPU arch

x86_64

VPN service provider

Surfshark

What are you using to run the container

docker-compose

What is the version of Gluetun

v3.39.1

What's the problem 🤔

When using the latest image i get no internet connection. I don't know what the exact problem is but when i use for example v3.39.0 everything works fine.

Share your logs (at least 10 lines)

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================

Running version latest built on 2024-09-29T18:12:41.313Z (commit 7ebbaf4)

📣 All control server routes will become private by default after the v3.41.0 release

🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2024-10-20T23:58:07+02:00 INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.2 and family v4
2024-10-20T23:58:07+02:00 INFO [routing] local ethernet link found: eth0
2024-10-20T23:58:07+02:00 INFO [routing] local ipnet found: 172.20.0.0/16
2024-10-20T23:58:07+02:00 INFO [firewall] enabling...
2024-10-20T23:58:07+02:00 INFO [firewall] enabled successfully
2024-10-20T23:58:07+02:00 INFO [storage] merging by most recent 20553 hardcoded servers and 18299 servers read from /gluetun/servers.json
2024-10-20T23:58:07+02:00 INFO Alpine version: 3.20.3
2024-10-20T23:58:07+02:00 INFO OpenVPN 2.5 version: 2.5.10
2024-10-20T23:58:07+02:00 INFO OpenVPN 2.6 version: 2.6.11
2024-10-20T23:58:07+02:00 INFO IPtables version: v1.8.10
2024-10-20T23:58:07+02:00 INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: surfshark
|   |   └── Server selection settings:
|   |       ├── VPN type: openvpn
|   |       ├── Countries: Switzerland, Spain, Slovakia, Slovenia
|   |       └── OpenVPN server selection settings:
|   |           └── Protocol: UDP
|   └── OpenVPN settings:
|       ├── OpenVPN version: 2.6
|       ├── User: [set]
|       ├── Password: [set]
|       ├── Network interface: tun0
|       ├── Run OpenVPN as: root
|       └── Verbosity level: 1
├── DNS settings:
|   ├── Keep existing nameserver(s): no
|   ├── DNS server address to use: 127.0.0.1
|   └── DNS over TLS settings:
|       ├── Enabled: yes
|       ├── Update period: every 24h0m0s
|       ├── Upstream resolvers:
|       |   └── cloudflare
|       ├── Caching: yes
|       ├── IPv6: no
|       └── DNS filtering settings:
|           ├── Block malicious: yes
|           ├── Block ads: no
|           ├── Block surveillance: no
|           └── Blocked IP networks:
|               ├── 127.0.0.1/8
|               ├── 10.0.0.0/8
|               ├── 172.16.0.0/12
|               ├── 192.168.0.0/16
|               ├── 169.254.0.0/16
|               ├── ::1/128
|               ├── fc00::/7
|               ├── fe80::/10
|               ├── ::ffff:127.0.0.1/104
|               ├── ::ffff:10.0.0.0/104
|               ├── ::ffff:169.254.0.0/112
|               ├── ::ffff:172.16.0.0/108
|               └── ::ffff:192.168.0.0/112
├── Firewall settings:
|   └── Enabled: yes
├── Log settings:
|   └── Log level: info
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: cloudflare.com:443
|   ├── Duration to wait after success: 5s
|   ├── Read header timeout: 100ms
|   ├── Read timeout: 500ms
|   └── VPN wait durations:
|       ├── Initial duration: 6s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 1000
|   ├── Process GID: 1000
|   └── Timezone: redacted
├── Public IP settings:
|   ├── Fetching: every 12h0m0s
|   ├── IP file path: /tmp/gluetun/ip
|   └── Public IP data API: ipinfo
├── Server data updater settings:
|   ├── Update period: 24h0m0s
|   ├── DNS address: 1.1.1.1:53
|   ├── Minimum ratio: 0.8
|   └── Providers to update: surfshark
└── Version settings:
    └── Enabled: yes
2024-10-20T23:58:07+02:00 INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.2 and family v4
2024-10-20T23:58:07+02:00 INFO [routing] adding route for 0.0.0.0/0
2024-10-20T23:58:07+02:00 INFO [firewall] setting allowed subnets...
2024-10-20T23:58:07+02:00 INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.2 and family v4
2024-10-20T23:58:07+02:00 INFO [dns] using plaintext DNS at address 1.1.1.1
2024-10-20T23:58:07+02:00 INFO [http server] http server listening on [::]:8000
2024-10-20T23:58:07+02:00 INFO [healthcheck] listening on 127.0.0.1:9999
2024-10-20T23:58:07+02:00 INFO [firewall] allowing VPN connection...
2024-10-20T23:58:07+02:00 INFO [openvpn] OpenVPN 2.6.11 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2024-10-20T23:58:07+02:00 INFO [openvpn] library versions: OpenSSL 3.3.2 3 Sep 2024, LZO 2.10
2024-10-20T23:58:07+02:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]89.37.95.212:1194
2024-10-20T23:58:07+02:00 INFO [openvpn] UDPv4 link local: (not bound)
2024-10-20T23:58:07+02:00 INFO [openvpn] UDPv4 link remote: [AF_INET]89.37.95.212:1194
2024-10-20T23:58:08+02:00 INFO [openvpn] [es-mad-v055.prod.surfshark.com] Peer Connection Initiated with [AF_INET]89.37.95.212:1194
2024-10-20T23:58:09+02:00 ERROR [openvpn] Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:7: block-outside-dns (2.6.11)
2024-10-20T23:58:09+02:00 INFO [openvpn] TUN/TAP device tun0 opened
2024-10-20T23:58:09+02:00 INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2024-10-20T23:58:09+02:00 INFO [openvpn] /sbin/ip link set dev tun0 up
2024-10-20T23:58:09+02:00 INFO [openvpn] /sbin/ip addr add dev tun0 10.8.8.6/24
2024-10-20T23:58:09+02:00 INFO [openvpn] UID set to nonrootuser
2024-10-20T23:58:09+02:00 INFO [openvpn] Initialization Sequence Completed
2024-10-20T23:58:09+02:00 INFO [dns] downloading hostnames and IP block lists
2024-10-20T23:58:09+02:00 INFO [healthcheck] healthy!
2024-10-20T23:58:24+02:00 WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": context deadline exceeded (Client.Timeout exceeded while awaiting headers), context deadline exceeded (Client.Timeout or context cancellation while reading body)
2024-10-20T23:58:24+02:00 INFO [dns] attempting restart in 10s
2024-10-20T23:58:25+02:00 INFO [ip getter] Public IP address is 89.37.95.213 (Spain, Madrid, Madrid)
2024-10-20T23:58:34+02:00 INFO [dns] downloading hostnames and IP block lists
2024-10-20T23:58:40+02:00 ERROR [vpn] cannot get version information: context deadline exceeded (Client.Timeout or context cancellation while reading body)
2024-10-20T23:58:49+02:00 WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": context deadline exceeded (Client.Timeout exceeded while awaiting headers), Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
2024-10-20T23:58:49+02:00 INFO [dns] attempting restart in 20s
2024-10-20T23:59:09+02:00 INFO [dns] downloading hostnames and IP block lists
2024-10-20T23:59:24+02:00 WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": context deadline exceeded (Client.Timeout exceeded while awaiting headers), Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
2024-10-20T23:59:24+02:00 INFO [dns] attempting restart in 40s
2024-10-21T00:00:04+02:00 INFO [dns] downloading hostnames and IP block lists
2024-10-21T00:00:19+02:00 WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": context deadline exceeded (Client.Timeout exceeded while awaiting headers), Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
2024-10-21T00:00:19+02:00 INFO [dns] attempting restart in 1m20s
2024-10-21T00:01:39+02:00 INFO [dns] downloading hostnames and IP block lists
2024-10-21T00:01:49+02:00 WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": net/http: TLS handshake timeout, Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": net/http: TLS handshake timeout
2024-10-21T00:01:49+02:00 INFO [dns] attempting restart in 2m40s
2024-10-21T00:04:29+02:00 INFO [dns] downloading hostnames and IP block lists
2024-10-21T00:04:39+02:00 WARN [dns] cannot update filter block lists: Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-hostnames.updated": net/http: TLS handshake timeout, Get "https://raw.githubusercontent.com/qdm12/files/master/malicious-ips.updated": net/http: TLS handshake timeout
...

Share your configuration

gluetun:
    env_file:
      - ../.env-global
    image: qmcgaw/gluetun
    container_name: gluetun

    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8085:8085
      - 5800:5800
      - 8989:8989
      - 7878:7878
      - 9696:9696
      - 6767:6767

    volumes:
      - ./gluetun/:/gluetun
    environment:
      - VPN_SERVICE_PROVIDER=surfshark
      - VPN_TYPE=openvpn
      - OPENVPN_USER=${OPENVPN_USER}
      - OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
      - SERVER_COUNTRIES=Switzerland,Spain,Slovakia,Slovenia
      - UPDATER_PERIOD=24h
    restart: unless-stopped

======================================== ======================================== =============== gluetun ================ ======================================== =========== Made with ❤️ by ============ ======= https://github.com/qdm12 ======= ======================================== ======================================== Running version latest built on 2024-11-18T09:49:16.711Z (commit 68ddbfc) ... 2024-11-20T19:04:31Z INFO [wireguard] Connecting to #####:51820 2024-11-20T19:04:31Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working. 2024-11-20T19:04:31Z INFO [dns] downloading hostnames and IP block lists 2024-11-20T19:04:31Z INFO [healthcheck] healthy! 2024-11-20T19:04:35Z INFO [dns] DNS server listening on [::]:53 2024-11-20T19:04:35Z INFO [dns] ready 2024-11-20T19:04:36Z INFO [ip getter] Public IP address is ##### (##### - source: ipinfo) 2024-11-20T19:04:36Z INFO [vpn] You are running on the bleeding edge of latest! 2024-11-20T19:14:37Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:57930->1.1.1.1:853: i/o timeout 2024-11-20T19:15:32Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:39940->1.0.0.1:853: i/o timeout 2024-11-20T19:16:10Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:56266->1.1.1.1:853: i/o timeout 2024-11-20T19:16:12Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:34022->1.0.0.1:853: i/o timeout 2024-11-20T19:16:12Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:34036->1.0.0.1:853: i/o timeout 2024-11-20T19:16:14Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:34040->1.0.0.1:853: i/o timeout 2024-11-20T19:16:14Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:34044->1.0.0.1:853: i/o timeout 2024-11-20T19:16:15Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:51970->1.1.1.1:853: i/o timeout 2024-11-20T19:16:17Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:34054->1.0.0.1:853: i/o timeout 2024-11-20T19:16:18Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:51980->1.1.1.1:853: i/o timeout 2024-11-20T19:26:15Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:34416->1.1.1.1:853: i/o timeout 2024-11-20T19:44:30Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:38986->1.1.1.1:853: i/o timeout 2024-11-20T19:49:26Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:34176->1.1.1.1:853: i/o timeout 2024-11-20T19:49:29Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:34190->1.1.1.1:853: i/o timeout 2024-11-20T19:49:29Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:49004->1.0.0.1:853: i/o timeout 2024-11-20T19:49:31Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:44968->1.0.0.1:853: i/o timeout 2024-11-20T19:49:31Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:44976->1.0.0.1:853: i/o timeout 2024-11-20T19:49:32Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:51668->1.1.1.1:853: i/o timeout 2024-11-20T19:49:34Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:51682->1.1.1.1:853: i/o timeout 2024-11-20T21:48:35Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:40646->1.1.1.1:853: i/o timeout 2024-11-20T21:57:42Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:60050->1.1.1.1:853: i/o timeout 2024-11-20T22:25:09Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:35200->1.1.1.1:853: i/o timeout 2024-11-20T22:25:12Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:49590->1.1.1.1:853: i/o timeout 2024-11-20T22:25:12Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:49594->1.1.1.1:853: i/o timeout 2024-11-20T22:25:12Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:49606->1.1.1.1:853: i/o timeout 2024-11-20T22:25:14Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:48276->1.0.0.1:853: i/o timeout 2024-11-20T22:25:14Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:49614->1.1.1.1:853: i/o timeout 2024-11-20T22:25:14Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:49630->1.1.1.1:853: i/o timeout 2024-11-20T22:25:15Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:48286->1.0.0.1:853: i/o timeout 2024-11-20T22:25:15Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:49642->1.1.1.1:853: i/o timeout 2024-11-20T22:25:16Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:48292->1.0.0.1:853: i/o timeout 2024-11-20T22:25:17Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:48308->1.0.0.1:853: i/o timeout 2024-11-20T22:25:17Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:49650->1.1.1.1:853: i/o timeout 2024-11-20T22:25:18Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:48326->1.0.0.1:853: i/o timeout 2024-11-20T22:25:19Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:48342->1.0.0.1:853: i/o timeout 2024-11-20T22:25:21Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:56226->1.1.1.1:853: i/o timeout 2024-11-20T22:39:49Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:34724->1.0.0.1:853: i/o timeout 2024-11-20T23:08:21Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:57352->1.0.0.1:853: i/o timeout 2024-11-20T23:32:48Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:49660->1.0.0.1:853: i/o timeout 2024-11-20T23:33:32Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:41662->1.1.1.1:853: i/o timeout 2024-11-20T23:35:00Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:37228->1.0.0.1:853: i/o timeout 2024-11-20T23:35:02Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:37238->1.0.0.1:853: i/o timeout 2024-11-20T23:35:13Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:45028->1.0.0.1:853: i/o timeout 2024-11-20T23:35:17Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:45134->1.0.0.1:853: i/o timeout 2024-11-20T23:35:40Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:52262->1.1.1.1:853: i/o timeout 2024-11-20T23:35:40Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:39504->1.0.0.1:853: i/o timeout 2024-11-20T23:35:42Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:39508->1.0.0.1:853: i/o timeout 2024-11-20T23:35:42Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:36384->1.1.1.1:853: i/o timeout 2024-11-20T23:41:23Z WARN [dns] exchanging over tls connection for request IN AAAA #####.#####.#####.: read tcp 10.5.0.2:32950->1.1.1.1:853: i/o timeout

services: gluetun: image: qmcgaw/gluetun cap_add: - NET_ADMIN devices: - /dev/net/tun:/dev/net/tun environment: - VPN_SERVICE_PROVIDER=nordvpn - VPN_TYPE=wireguard - WIREGUARD_PRIVATE_KEY=##### - SERVER_COUNTRIES=#####

qdm12 / gluetun