qdm12 / gluetun

VPN client in a thin Docker container for multiple VPN providers, written in Go, and using OpenVPN or Wireguard, DNS over TLS, with a few proxy servers built-in.
https://hub.docker.com/r/qmcgaw/gluetun
MIT License
6.82k stars 333 forks source link

Synology wget: error getting response: Connection reset by peer #270

Closed helio58 closed 3 years ago

helio58 commented 3 years ago

TLDR: Describe your issue in a one liner here

  1. Is this urgent?

    • [ ] Yes
    • [x] No
  2. What VPN service provider are you using?

    • [x] PIA
    • [ ] Mullvad
    • [ ] Windscribe
    • [ ] Surfshark
    • [ ] Cyberghost
  3. What's the version of the program?

    See the line at the top of your logs

    Running version latest built on 2020-10-24T22:59:33Z (commit f29707f)

  4. What are you using to run the container?

    • [x] Docker run
    • [ ] Docker Compose
    • [ ] Kubernetes
    • [ ] Docker stack
    • [ ] Docker swarm
    • [ ] Podman
    • [ ] Other:
  5. Extra information

Logs:

=========================================,
================ Gluetun ================,
=========================================,
==== A mix of OpenVPN, DNS over TLS, ====,
======= Shadowsocks and Tinyproxy =======,
========= all glued up with Go ==========,
=========================================,
=========== For tunneling to ============,
======== your favorite VPN server =======,
=========================================,
=== Made with ❤️  by github.com/qdm12 ====,
=========================================,
,
Running version latest built on 2020-10-24T22:59:33Z (commit f29707f),
,
📣  Port forwarding is working for PIA v4 servers,
,
🔧  Need help? https://github.com/qdm12/gluetun/issues/new,
💻  Email? quentin.mcgaw@gmail.com,
☕  Slack? Join from the Slack button on Github,
💸  Help me? https://github.com/sponsors/qdm12,
2020-10-25T18:56:19.791Z    INFO    TinyProxy version: 1.10.0,
2020-10-25T18:56:19.793Z    INFO    OpenVPN version: 2.4.9,
2020-10-25T18:56:19.795Z    INFO    Unbound version: 1.10.1,
2020-10-25T18:56:19.796Z    INFO    IPtables version: v1.8.4,
2020-10-25T18:56:19.796Z    INFO    Settings summary below:,
OpenVPN settings:,
|--User: [redacted],
|--Password: [redacted],
|--Verbosity level: 1,
|--Run as root: no,
|--Private Internet Access settings:,
 |--Network protocol: udp,
 |--Regions: sweden,
 |--Encryption preset: strong,
 |--Port forwarding: off,
System settings:,
|--User ID: 1000,
|--Group ID: 1000,
|--Timezone: ,
|--IP Status filepath: /tmp/gluetun/ip,
DNS over TLS settings:,
 |--DNS over TLS provider:,
  |--cloudflare,
 |--Caching: enabled,
 |--Block malicious: enabled,
 |--Block surveillance: disabled,
 |--Block ads: disabled,
 |--Allowed hostnames:,
  |--,
 |--Private addresses:,
  |--127.0.0.1/8,
  |--10.0.0.0/8,
  |--172.16.0.0/12,
  |--192.168.0.0/16,
  |--169.254.0.0/16,
  |--::1/128,
  |--fc00::/7,
  |--fe80::/10,
  |--::ffff:0:0/96,
 |--Verbosity level: 1/5,
 |--Verbosity details level: 0/4,
 |--Validation log level: 0/2,
 |--IPv6 resolution: disabled,
 |--Update: every 24h0m0s,
 |--Keep nameserver (disabled blocking): no,
Firewall settings:,
 |--VPN input ports: ,
 |--Input ports: ,
TinyProxy settings: disabled,
ShadowSocks settings: disabled,
HTTP Control server:,
 |--Listening port: 8000,
 |--Logging: true,
Public IP check period: 12h0m0s,
Version information: enabled,
Updater: disabled,
,
2020-10-25T18:56:19.860Z    INFO    storage: Merging by most recent 6398 hardcoded servers and 6398 servers read from /gluetun/servers.json,
2020-10-25T18:56:19.912Z    INFO    routing: default route found: interface eth0, gateway 172.17.0.1,
2020-10-25T18:56:19.912Z    INFO    routing: local subnet found: 172.17.0.0/16,
2020-10-25T18:56:19.912Z    INFO    routing: default route found: interface eth0, gateway 172.17.0.1,
2020-10-25T18:56:19.913Z    INFO    routing: adding route for <nil>,
2020-10-25T18:56:19.913Z    INFO    openvpn configurator: checking for device /dev/net/tun,
2020-10-25T18:56:19.913Z    WARN    TUN device is not available: open /dev/net/tun: no such file or directory,
2020-10-25T18:56:19.913Z    INFO    openvpn configurator: creating /dev/net/tun,
2020-10-25T18:56:19.913Z    INFO    firewall: enabling...,
2020-10-25T18:56:19.925Z    INFO    firewall: enabled successfully,
2020-10-25T18:56:19.925Z    INFO    Launching standard output merger,
2020-10-25T18:56:19.925Z    INFO    http server: listening on 0.0.0.0:8000,
2020-10-25T18:56:19.926Z    INFO    dns over tls: falling back on plaintext DNS at address 1.1.1.1,
2020-10-25T18:56:19.926Z    INFO    dns configurator: using DNS address 1.1.1.1 internally,
2020-10-25T18:56:19.926Z    INFO    dns configurator: using DNS address 1.1.1.1 system wide,
2020-10-25T18:56:19.926Z    INFO    firewall: setting VPN connection through firewall...,
2020-10-25T18:56:19.928Z    INFO    openvpn configurator: starting openvpn,
2020-10-25T18:56:19.930Z    INFO    openvpn: OpenVPN 2.4.9 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 20 2020,
2020-10-25T18:56:19.930Z    INFO    openvpn: library versions: OpenSSL 1.1.1g  21 Apr 2020, LZO 2.10,
2020-10-25T18:56:19.934Z    INFO    openvpn: CRL: loaded 1 CRLs from file [[INLINE]],
2020-10-25T18:56:19.934Z    INFO    openvpn: TCP/UDP: Preserving recently used remote address: [AF_INET]195.246.120.140:1197,
2020-10-25T18:56:19.934Z    INFO    openvpn: UDP link local: (not bound),
2020-10-25T18:56:19.934Z    INFO    openvpn: UDP link remote: [AF_INET]195.246.120.140:1197,
2020-10-25T18:56:20.314Z    WARN    openvpn: 'link-mtu' is used inconsistently, local='link-mtu 1570', remote='link-mtu 1542',
2020-10-25T18:56:20.314Z    WARN    openvpn: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher BF-CBC',
2020-10-25T18:56:20.314Z    WARN    openvpn: 'auth' is used inconsistently, local='auth SHA256', remote='auth SHA1',
2020-10-25T18:56:20.314Z    WARN    openvpn: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128',
2020-10-25T18:56:20.315Z    INFO    openvpn: [stockholm404] Peer Connection Initiated with [AF_INET]195.246.120.140:1197,
2020-10-25T18:56:21.547Z    INFO    openvpn: TUN/TAP device tun0 opened,
2020-10-25T18:56:21.547Z    INFO    openvpn: /sbin/ip link set dev tun0 up mtu 1500,
2020-10-25T18:56:21.549Z    INFO    openvpn: /sbin/ip addr add dev tun0 10.30.110.6/24 broadcast 10.30.110.255,
2020-10-25T18:56:21.552Z    INFO    openvpn: UID set to nonrootuser,
2020-10-25T18:56:21.552Z    INFO    openvpn: Initialization Sequence Completed,
2020-10-25T18:56:21.552Z    INFO    dns configurator: downloading root hints from https://raw.githubusercontent.com/qdm12/files/master/named.root.updated,
2020-10-25T18:56:21.553Z    INFO    VPN routing IP address: 195.246.120.140,
2020-10-25T18:56:21.843Z    INFO    dns configurator: downloading root key from https://raw.githubusercontent.com/qdm12/files/master/root.key.updated,
2020-10-25T18:56:21.959Z    INFO    dns configurator: generating Unbound configuration,
2020-10-25T18:56:22.321Z    INFO    dns configurator: 60675 hostnames blocked overall,
2020-10-25T18:56:22.321Z    INFO    dns configurator: 2695 IP addresses blocked overall,
2020-10-25T18:56:22.386Z    INFO    dns configurator: starting unbound,
2020-10-25T18:56:22.386Z    INFO    dns configurator: using DNS address 127.0.0.1 internally,
2020-10-25T18:56:22.387Z    INFO    dns configurator: using DNS address 127.0.0.1 system wide,
2020-10-25T18:56:22.698Z    INFO    unbound: init module 0: validator,
2020-10-25T18:56:22.698Z    INFO    unbound: init module 1: iterator,
2020-10-25T18:56:22.710Z    INFO    unbound: start of service (unbound 1.10.1).,
2020-10-25T18:56:22.723Z    INFO    unbound: generate keytag query _ta-4a5c-4f66. NULL IN,
2020-10-25T18:56:22.781Z    INFO    dns over tls: DNS over TLS is ready,
2020-10-25T18:56:23.129Z    INFO    ip getter: Public IP address is 195.246.120.140,
2020-10-25T18:56:23.168Z    INFO    You are running on the bleeding edge of latest!,`log

Configuration file:

Host OS:Synology

wget: error getting response: Connection reset by peer:
when running the alpine:3.12 
sudo docker run --rm --network=container:gluetun alpine:3.12 wget -qO- https://ipinfo.io
Password: 
Unable to find image 'alpine:3.12' locally
3.12: Pulling from library/alpine
188c0c94c7c5: Already exists 
Digest: sha256:c0e9560cda118f9ec63ddefb4a173a2b2a0347082d7dff7dc14272e7841a5b5a
Status: Downloaded newer image for alpine:3.12
wget: error getting response: Connection reset by peer

Is there something i can do to make it running? Thanks

qdm12 commented 3 years ago

How are you launching gluetun? Are you using --name gluetun?

Maybe try again with:

sudo docker run -it --rm --network_mode=container:gluetun alpine:3.12 wget -qO- https://ipinfo.io
helio58 commented 3 years ago

Hi thanks, Im launching gluetun with:

sudo docker run -d --name gluetun -e PUID=1000 -e PGID=1000 --cap-add=NET_ADMIN -e VPNSP="private internet access" -e REGION="Sweden" -e USER=p6450000 -e PASSWORD=password -v /volume3/docker/gluetun:/gluetun qmcgaw/private-internet-access

Tried your suggestion.

sudo docker run -it --rm --network_mode=container:gluetun alpine:3.12 wget -qO- https://ipinfo.io 

Getting the error : unknown flag: --network_mode

I have try on macbook works very well. Is just is best if i get it running on synology. I m using portainer and in the state it says "starting" for a long time and then after same time "unhealthy"

qdm12 commented 3 years ago

First of all, a few side notes;

Portainer says it's starting for a while because it waits for the healthcheck to set the container status as healthy or unhealthy, which happens after a 5 minutes if I recall correctly.

Now the fact it says it's unhealthy might be that there is indeed a problem, although it seems to work within the container (it has access to github.com once the tunnel is ready).

Can you try launching it

sudo docker run -d --name gluetun -e USER=user -e PASSWORD=password -e REGION=Sweden --cap-add=NET_ADMIN qmcgaw/private-internet-access

Then shell into it with

docker exec -it gluetun /bin/sh
# Check https works
wget -qO- https://ipinfo.io
# Check DNS works
nslookup github.com
exit

And see if it works?

helio58 commented 3 years ago

Hi thanks, I have change the password. Try your commands:

/ # nslookup github.com
Server:         127.0.0.1
Address:        127.0.0.1:53

Non-authoritative answer:
Name:   github.com
Address: 140.82.121.3

Non-authoritative answer:
/ # wget -qO- https://ipinfo.io
wget: error getting response: Connection reset by peer
/ #
But if I use:
/ # wget -qO- http://ipinfo.io
{
  "ip": "195.246.120.140",
  "hostname": "195-246-120-140-static.serverhotell.net",
  "city": "Wembley",
  "region": "England",
  "country": "GB",
  "loc": "51.5524,-0.2969",
  "org": "AS42708 GleSYS AB",
  "postal": "HA0",
  "timezone": "Europe/London",
  "readme": "https://ipinfo.io/missingauth"
}/ #

http is working but not https.

frepke commented 3 years ago

Instead of docker run -it --rm --network_mode=container:gluetun alpine:3.12 wget -qO- https://ipinfo.io you can try docker run -it --rm --network=container:gluetun alpine:3.12 wget -qO- https://ipinfo.io

helio58 commented 3 years ago

Thanks Frepke, Getting the same error

:~$ sudo docker run -it --rm --network=container:gluetun alpine:3.12 wget -qO- https://ipinfo.io
Password: 
Unable to find image 'alpine:3.12' locally
3.12: Pulling from library/alpine
188c0c94c7c5: Already exists 
Digest: sha256:c0e9560cda118f9ec63ddefb4a173a2b2a0347082d7dff7dc14272e7841a5b5a
Status: Downloaded newer image for alpine:3.12
wget: error getting response: Connection reset by peer
frepke commented 3 years ago

And maybe without sudo?

or

docker run -it --rm --network=container:gluetun cirrusci/wget wget -qO- https://ipinfo.io
helio58 commented 3 years ago

Hi,

docker run -it --rm --network=container:gluetun cirrusci/wget wget -qO- https://ipinfo.io
docker: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.39/containers/create: dial unix /var/run/docker.sock: connect: permission denied.

BUT

sudo docker run -it --rm --network=container:gluetun cirrusci/wget wget -qO- https://ipinfo.io

Hurra

Unable to find image 'cirrusci/wget:latest' locally
latest: Pulling from cirrusci/wget
4fe2ade4980c: Already exists 
627e7bf66393: Pull complete 
Digest: sha256:3030b225419dc665e28fa2d9ad26f66d45c1cdcf270ffea7b8a80b36281e805a
Status: Downloaded newer image for cirrusci/wget:latest
{
  "ip": "195.246.120.140",
  "hostname": "195-246-120-140-static.serverhotell.net",
  "city": "Wembley",
  "region": "England",
  "country": "GB",
  "loc": "51.5524,-0.2969",
  "org": "AS42708 GleSYS AB",
  "postal": "HA0",
  "timezone": "Europe/London",
  "readme": "https://ipinfo.io/missingauth"

So must be working

helio58 commented 3 years ago

Strange I used REGION="Sweden" but wget "region": "England" any way to change that?

Tested speedtest

sudo docker run --rm --network=container:gluetun tianon/speedtest speedtest --accept-gdpr  --accept-license

==============================================================================

You may only use this Speedtest software and information generated
from it for personal, non-commercial use, through a command line
interface on a personal computer. Your use of this software is subject
to the End User License Agreement, Terms of Use and Privacy Policy at
these URLs:

    https://www.speedtest.net/about/eula
    https://www.speedtest.net/about/terms
    https://www.speedtest.net/about/privacy

==============================================================================

License acceptance recorded. Continuing.

==============================================================================

Ookla collects certain data through Speedtest that may be considered
personally identifiable, such as your IP address, unique device
identifiers or location. Ookla believes it has a legitimate interest
to share this data with internet providers, hardware manufacturers and
industry regulators to help them understand and create a better and
faster internet. For further information including how the data may be
shared, where the data may be transferred and Ookla's contact details,
please see our Privacy Policy at:

       http://www.speedtest.net/privacy

==============================================================================

License acceptance recorded. Continuing.

   Speedtest by Ookla

     Server: A3 Allmänna IT - och Telekomaktiebolaget - Stockholm (id = 20783)
        ISP: GleSYS Internet Services AB
    Latency:     1.69 ms   (0.04 ms jitter)
   Download:   120.14 Mbps (data used: 143.9 MB)                               
     Upload:   158.19 Mbps (data used: 177.6 MB)                               
Packet Loss:     0.5%
 Result URL: https://www.speedtest.net/result/c/6e605cf6-232c-4c1e-b4c4-55ba1dd4745b
frepke commented 3 years ago

You have to contact ipinfo for that, did it a dozen of times. In the end I switched to https://api.ipdata.co\?api-key\=test

sudo docker run -it --rm --network=container:gluetun cirrusci/wget wget -qO- https://api.ipdata.co\?api-key\=test

frepke commented 3 years ago

Oops, closed issue accidentally :(

helio58 commented 3 years ago

You have to contact ipinfo for that, did it a dozen of times. In the end I switched to https://api.ipdata.co?api-key=test

sudo docker run -it --rm --network=container:gluetun cirrusci/wget wget -qO- https://api.ipdata.co\?api-key\=test

Thanks that did it.

Is it possible to route one computer in lan 192.168.20.xxxx through the gluetun container? if so how? Thanks

frepke commented 3 years ago

I use the shadowsocks option myselve on my Macbook. You can find the info in the readme file https://github.com/qdm12/gluetun#connect-to-it in the section: Connect LAN devices through the built-in *Shadowsocks* proxy (per app, system wide, etc.)

qdm12 commented 3 years ago

So strange that https didn't work but http worked. Amyway, maybe an issue with Alpine's built-in wget who knows. Probably ipinfo.io misbehaving.

Even weirder that ipinfo.io returns a different country, but if it returns the right data with ipdata, fair enough. I'll update the documentation.

To tunnel lan devices you can use the http proxy with tinyproxy (careful your proxy credentials from client to gluetun go in plaintext, which is fine in your lan though) or use shadowsocks where the traffic & credentials are encrypted with a pre-shared password (plus it tunnels udp on top of tcp).

If you want to try tinyproxy, you might want to try the docker image with tag :http-proxy which replaces tinyproxy, I've been coding this the weekend 😉

Finally, thanks Frepke for your help!

helio58 commented 3 years ago

I use the shadowsocks option myselve on my Macbook. You can find the info in the readme file https://github.com/qdm12/gluetun#connect-to-it in the section: Connect LAN devices through the built-in Shadowsocks proxy (per app, system wide, etc.)

helio58 commented 3 years ago

Does this looks the right way to enable Shadowsocks?

sudo docker run -d --name gluetun -e USER=xxxxx -e PASSWORD=xxxxx -e SHADOWSOCKS=on -e SHADOWSOCKS_PASSWORD=xxxxx -e SHADOWSOCKS_METHOD=aes-128-gcm -p 8388:8388/tcp -p 8388:8388/udp -e REGION=Sweden --cap-add=NET_ADMIN qmcgaw/private-internet-access

Thanks

frepke commented 3 years ago

Looks okay to me

helio58 commented 3 years ago

Thanks

qdm12 commented 3 years ago

Also note that the container will complain if anything's wrong, it's quite foolproof. It also logs all the settings at start where you can check what you've set is correct. Enjoy!

helio58 commented 3 years ago

Also note that the container will complain if anything's wrong, it's quite foolproof. It also logs all the settings at start where you can check what you've set is correct. Enjoy!

Thanks. For me works 100% on a mac. In Synology i think i can connect to Shadowsocks but can't connect to the internet. The idea was having Gluetun running on a synology. Will run on a mac. I know this do not have much to do with this issue. But say I have Gluetun running on mac. Have a docker container running on synology how do i connect the synology container to Gluetun on mac ? (both mac and synology same lan)

qdm12 commented 3 years ago

Why not run it on your Synology NAS though? Do you encounter any error?

helio58 commented 3 years ago

Why not run it on your Synology NAS though? Do you encounter any error?

YES found the error. Really can't believe. Have the wrong port. Thanks for your patience and thanks for this great container.

qdm12 commented 3 years ago

Alright great! Feel free to open another issue if you have a problem or some feedback. Happy tunneling!