Connection Issues on first boot #805

ghost · 2022-01-21T15:37:15Z

ghost
Jan 21, 2022

Hello,

Gluetun is appears to be a highly useful product that I am excited to get working.

I threw it into my docker compose and got the following errors:

gluetun:
  image: qmcgaw/gluetun:latest # I tried with v3.24.0 and v3.25.0 and received the same error.
  cap_add:
    - NET_ADMIN
  environment:
    VPNSP: mullvad
    VPN_TYPE: wireguard
    WIREGUARD_ADDRESS: 10.64.222.21/32
    #SERVER_HOSTNAME: $WIREGUARD_CITY
    CITY: Madrid
    WIREGUARD_PRIVATE_KEY: <correct Mullvad wireguard key>
    #DOT: off  # I tried with DOT explicitly enabled and without
    #DOT_PROVIDERS: quad9
    #DOT_CACHING: enabled
    #DNS_PLAINTEXT_ADDRESS: 1.1.1.1 # Tried with and without this
    TZ: $TZ
  networks: # I tried with both of these commented out and then each without the other.
    - t2_proxy
    - default
  volumes: 
    - $DOCKERDIR/appdata/gluetun:/gluetun

And here is the log file I received:

2022/01/20 22:27:39 INFO storage: merging by most recent 11100 hardcoded servers and 11100 servers read from /gluetun/servers.json
2022/01/20 22:27:39 INFO Alpine version: 3.15.0
2022/01/20 22:27:39 INFO OpenVPN 2.4 version: 2.4.11
2022/01/20 22:27:39 INFO OpenVPN 2.5 version: 2.5.4
2022/01/20 22:27:39 INFO Unbound version: 1.13.2
2022/01/20 22:27:39 INFO IPtables version: v1.8.7
2022/01/20 22:27:39 INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: mullvad
|   |   └── Server selection settings:
|   |       ├── VPN type: wireguard
|   |       ├── Cities: madrid
|   |       └── Wireguard selection settings:
|   └── Wireguard settings:
|       ├── Private key: HH...Ao=
|       ├── Interface addresses:
|       |   └── 10.64.222.21/32
|       └── Network interface: wg0
├── DNS settings:
|   ├── DNS server address to use: 127.0.0.1
|   ├── Keep existing nameserver(s): no
|   └── DNS over TLS settings:
|       ├── Enabled: yes
|       ├── Update period: every 24h0m0s
|       ├── Unbound settings:
|       |   ├── Authoritative servers:
|       |   |   └── cloudflare
|       |   ├── Caching: yes
|       |   ├── IPv6: no
|       |   ├── Verbosity level: 1
|       |   ├── Verbosity details level: 0
|       |   ├── Validation log level: 0
|       |   ├── System user: root
|       |   └── Allowed networks:
|       |       ├── 0.0.0.0/0
|       |       └── ::/0
|       └── DNS filtering settings:
|           ├── Block malicious: yes
|           ├── Block ads: no
|           ├── Block surveillance: no
|           └── Blocked IP networks:
|               ├── 127.0.0.1/8
|               ├── 10.0.0.0/8
|               ├── 172.16.0.0/12
|               ├── 192.168.0.0/16
|               ├── 169.254.0.0/16
|               ├── ::1/128
|               ├── fc00::/7
|               ├── fe80::/10
|               ├── ::ffff:7f00:1/104
|               ├── ::ffff:a00:0/104
|               ├── ::ffff:a9fe:0/112
|               ├── ::ffff:ac10:0/108
|               └── ::ffff:c0a8:0/112
├── Firewall settings:
|   └── Enabled: yes
├── Log settings:
|   └── Log level: INFO
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Address to ping: github.com
|   └── VPN wait durations:
|       ├── Initial duration: 5s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening port: 8000
|   └── Logging: yes
├── OS Alpine settings:
|   ├── Process UID: 1000
|   ├── Process GID: 1000
|   └── Timezone: America/New_York
├── Public IP settings:
|   ├── Fetching: every 12h0m0s
|   └── IP file path: /tmp/gluetun/ip
└── Version settings:
    └── Enabled: yes
2022/01/20 22:27:40 INFO routing: default route found: interface eth0, gateway 172.18.0.1
2022/01/20 22:27:40 INFO routing: local ethernet link found: eth1
2022/01/20 22:27:40 INFO routing: local ethernet link found: eth0
2022/01/20 22:27:40 INFO routing: local ipnet found: 172.18.0.0/16
2022/01/20 22:27:40 INFO routing: local ipnet found: 192.168.90.0/24
2022/01/20 22:27:40 INFO routing: default route found: interface eth0, gateway 172.18.0.1
2022/01/20 22:27:40 INFO routing: adding route for 0.0.0.0/0
2022/01/20 22:27:40 INFO firewall: firewall disabled, only updating allowed subnets internal list
2022/01/20 22:27:40 INFO routing: default route found: interface eth0, gateway 172.18.0.1
2022/01/20 22:27:40 INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2022/01/20 22:27:40 INFO firewall: enabling...
2022/01/20 22:27:40 INFO firewall: enabled successfully
2022/01/20 22:27:40 INFO healthcheck: listening on 127.0.0.1:9999
2022/01/20 22:27:40 INFO http server: listening on :8000
2022/01/20 22:27:40 INFO dns over tls: using plaintext DNS at address 1.1.1.1
2022/01/20 22:27:40 INFO firewall: setting VPN connection through firewall...
2022/01/20 22:27:40 INFO wireguard: Using available kernelspace implementation
2022/01/20 22:27:40 INFO wireguard: Connecting to 194.99.104.10:51820
2022/01/20 22:27:40 INFO wireguard: Wireguard is up
2022/01/20 22:27:40 INFO dns over tls: downloading DNS over TLS cryptographic files
2022/01/20 22:27:50 WARN dns over tls: cannot update files: Get "https://www.internic.net/domain/named.root": dial tcp: lookup www.internic.net on 127.0.0.11:53: read udp 10.64.222.21:35215->1.1.1.1:53: i/o timeout
2022/01/20 22:27:50 INFO dns over tls: attempting restart in 10s

Any help would be greatly appreciated! Thank you!

qdm12 · 2022-01-22T22:42:29Z

qdm12
Jan 22, 2022
Maintainer

You probably put in the wrong wireguard private key I would think, or you have a host firewall blocking it.
Have you tried with OpenVPN? If it doesn't work as well, then it's likely a firewall on your host blocking traffic.

Wireguard is designed to be silent when you have the wrong key, so there is no way to know if the Wireguard server doesn't accept you or if it's something else like a firewall on your host. The message Wireguard is up shows the initialization on the client side is done, but you should see a healthy! message when the connection is working (it does a ping to github.com under the hood).

0 replies

hugalafutro · 2022-01-22T23:46:40Z

hugalafutro
Jan 22, 2022

I was struggling with getting mullvad to work too with the same error. To get the correct WIREGUARD_ADDRESS and WIREGUARD_PRIVATE_KEY I went to mullvad account webpage, created new wireguard connection for the country / city I wanted and dl'd the json files, inside them I found correct values for both.

6 replies

hugalafutro Jan 23, 2022

To elaborate a bit, I literally spent about hour messing with it yesterday until I figured it out. I don't know if this is the right way, perhaps there is simpler, but I was really confused with all the private public and pre-shared keys, I wasn't sure what I'm supposed to get from gluetun or wireguard or mullvad or what values am I supposed to make up, but in the end this process made my gluetun stack connect via mullvad:

On mullvad account page click generate wireguard keys, then do this:

this will give you a zip with a .json file for server in country you picked. Nevermind how many .json files are there the relevant information you need is the same for all. The .json file looks like this:

[Interface]
PrivateKey = <private  key>
Address = 10.64.21.211/32,fc00:bbbb:bbbb:bb01::1:15d2/128
DNS = <some ip>

[Peer]
PublicKey = <public key>
AllowedIPs = 0.0.0.0/0,::0/0
Endpoint = <some ip>:<some port>

Then your WIREGUARD_ADDRESS is 10.64.21.211/32 and your WIREGUARD_PRIVATE_KEY is <private key> and your CITY is w/e city you picked on the picture.

The keys displayed in the mullvad account are not the keys you need as it says there:

We never get access to your private key, only the public key is sent to us. The private key is stored locally in your browser so that you can create multiple files from the same key and as soon as you leave this page, it is deleted.

so I think you gotta get them from the .json

Hope that helps someone in the future.

qdm12 Jan 23, 2022
Maintainer

Awesome! I'll link your answer in the wiki!

ghost Jan 25, 2022

@hugalafutro This fixed it for me, thanks!

hugalafutro Jan 26, 2022

For future reference I found out a method to obtain the ip from shell here

curl https://api.mullvad.net/wg/ -d account=YOURMULLVADACCOUNTNUMBER --data-urlencode pubkey=YOURPUBLICKEY

The IP address to use with Mullvad will be returned.

qdm12 Feb 21, 2022
Maintainer

Oh to get your interface address? That could be integrated within gluetun perhaps 🤔

doobersn · 2022-12-10T23:23:33Z

doobersn
Dec 10, 2022

This isn't giving me a zip with a .json file. It's giving me a zip with a bunch of .conf files. Thoughts?

Edit: was able to open the .conf file with textedit in macOS and it looks the same as what was posted above. Thanks!

0 replies

sev-b · 2023-01-16T20:27:50Z

sev-b
Jan 16, 2023

I encountered an issue when setting the CITY to Helsinki - have not investigated if that's something to do with gluetun or mullvad (connecting to Helsinki works on other devices) but if anyone has problems getting a connection try a different city or not specifying one at all

the output I got when trying to connect to a Helsinki wireguard server:

2023-01-16T20:17:21Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.3
2023-01-16T20:17:21Z INFO [routing] local ethernet link found: eth0
2023-01-16T20:17:21Z INFO [routing] local ipnet found: 172.17.0.0/16
2023-01-16T20:17:21Z INFO [firewall] enabling...
2023-01-16T20:17:21Z INFO [firewall] enabled successfully
2023-01-16T20:17:21Z INFO [storage] creating /gluetun/servers.json with 13224 hardcoded servers
2023-01-16T20:17:21Z INFO Alpine version: 3.16.3
2023-01-16T20:17:21Z INFO OpenVPN 2.4 version: 2.4.12
2023-01-16T20:17:21Z INFO OpenVPN 2.5 version: 2.5.6
2023-01-16T20:17:21Z INFO Unbound version: 1.15.0
2023-01-16T20:17:21Z INFO IPtables version: v1.8.8
2023-01-16T20:17:21Z INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: mullvad
|   |   └── Server selection settings:
|   |       ├── VPN type: wireguard
|   |       ├── Cities: helsinki
|   |       └── Wireguard selection settings:
|   └── Wireguard settings:
|       ├── Private key: *******
|       ├── Interface addresses:
|       |   └── ******
|       └── Network interface: tun0
├── DNS settings:
|   ├── DNS server address to use: 127.0.0.1
|   ├── Keep existing nameserver(s): no
|   └── DNS over TLS settings:
|       ├── Enabled: yes
|       ├── Update period: every 24h0m0s
|       ├── Unbound settings:
|       |   ├── Authoritative servers:
|       |   |   └── cloudflare
|       |   ├── Caching: yes
|       |   ├── IPv6: no
|       |   ├── Verbosity level: 1
|       |   ├── Verbosity details level: 0
|       |   ├── Validation log level: 0
|       |   ├── System user: root
|       |   └── Allowed networks:
|       |       ├── 0.0.0.0/0
|       |       └── ::/0
|       └── DNS filtering settings:
|           ├── Block malicious: yes
|           ├── Block ads: no
|           ├── Block surveillance: no
|           └── Blocked IP networks:
|               ├── 127.0.0.1/8
|               ├── 10.0.0.0/8
|               ├── 172.16.0.0/12
|               ├── 192.168.0.0/16
|               ├── 169.254.0.0/16
|               ├── ::1/128
|               ├── fc00::/7
|               ├── fe80::/10
|               ├── ::ffff:7f00:1/104
|               ├── ::ffff:a00:0/104
|               ├── ::ffff:a9fe:0/112
|               ├── ::ffff:ac10:0/108
|               └── ::ffff:c0a8:0/112
├── Firewall settings:
|   └── Enabled: yes
├── Log settings:
|   └── Log level: INFO
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: cloudflare.com:443
|   ├── Read header timeout: 100ms
|   ├── Read timeout: 500ms
|   └── VPN wait durations:
|       ├── Initial duration: 6s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   └── Logging: yes
├── OS Alpine settings:
|   ├── Process UID: 1000
|   └── Process GID: 1000
├── Public IP settings:
|   ├── Fetching: every 12h0m0s
|   └── IP file path: /tmp/gluetun/ip
└── Version settings:
    └── Enabled: yes
2023-01-16T20:17:21Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.3
2023-01-16T20:17:21Z INFO [routing] adding route for 0.0.0.0/0
2023-01-16T20:17:21Z INFO [firewall] setting allowed subnets...
2023-01-16T20:17:21Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.3
2023-01-16T20:17:21Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2023-01-16T20:17:21Z INFO [dns over tls] using plaintext DNS at address 1.1.1.1
2023-01-16T20:17:21Z INFO [http server] http server listening on [::]:8000
2023-01-16T20:17:21Z INFO [healthcheck] listening on 127.0.0.1:9999
2023-01-16T20:17:21Z INFO [firewall] allowing VPN connection...
2023-01-16T20:17:21Z INFO [wireguard] Using available kernelspace implementation
2023-01-16T20:17:21Z INFO [wireguard] Connecting to 185.204.1.203:51820
2023-01-16T20:17:21Z INFO [wireguard] Wireguard is up
2023-01-16T20:17:22Z INFO [dns over tls] downloading DNS over TLS cryptographic files
2023-01-16T20:17:29Z INFO [healthcheck] program has been unhealthy for 6s: restarting VPN
2023-01-16T20:17:29Z INFO [vpn] stopping
2023-01-16T20:17:29Z ERROR [vpn] cannot get version information: Get "https://api.github.com/repos/qdm12/gluetun/commits": context canceled
2023-01-16T20:17:30Z INFO [vpn] starting
2023-01-16T20:17:30Z INFO [firewall] allowing VPN connection...
2023-01-16T20:17:30Z INFO [wireguard] Using available kernelspace implementation
2023-01-16T20:17:30Z INFO [wireguard] Connecting to 185.204.1.203:51820
2023-01-16T20:17:30Z INFO [wireguard] Wireguard is up
2023-01-16T20:17:32Z WARN [dns over tls] cannot update files: Get "https://www.internic.net/domain/named.root": dial tcp: lookup www.internic.net on 1.1.1.1:53: read udp 10.67.123.84:59923->1.1.1.1:53: i/o timeout
2023-01-16T20:17:32Z INFO [dns over tls] attempting restart in 10s

4 replies

AverageHoarder Mar 15, 2023

The same applies to the servers in Frankfurt, Germany. Dusseldorf on the other hand works fine so I'm certain that I copied the correct values from the config files.

WARN [dns over tls] cannot update files: Get "https://www.internic.net/domain/named.root": dial tcp: lookup www.internic.net on 1.1.1.1:53: read udp 10.67.123.84:59923->1.1.1.1:53: i/o timeout

Over and over.

eplusg Mar 19, 2023

I continue to encounter the same error; however, disabling my router's firewall and permitting all traffic, rather than exclusively port 51820, temporarily resolves the issue, but this is not a viable long-term solution.

42Craft Jun 10, 2023

I continue to encounter the same error; however, disabling my router's firewall and permitting all traffic, rather than exclusively port 51820, temporarily resolves the issue, but this is not a viable long-term solution.

I am encountering the same problem. Without firewall it works. Did you figure it out in the end?

aleprovencio Sep 27, 2024

The same applies to the servers in Frankfurt, Germany. Dusseldorf on the other hand works fine so I'm certain that I copied the correct values from the config files.

WARN [dns over tls] cannot update files: Get "https://www.internic.net/domain/named.root": dial tcp: lookup www.internic.net on 1.1.1.1:53: read udp 10.67.123.84:59923->1.1.1.1:53: i/o timeout

Over and over.

Thanks for pointing that Dusseldorf works !
Do you know other cities that work as well ?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Connection Issues on first boot #805

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 4 comments 10 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Connection Issues on first boot #805

Replies: 4 comments · 10 replies

qdm12 Jan 22, 2022 Maintainer

qdm12 Jan 23, 2022 Maintainer

qdm12 Feb 21, 2022 Maintainer

Replies: 4 comments 10 replies

qdm12
Jan 22, 2022
Maintainer

qdm12 Jan 23, 2022
Maintainer

qdm12 Feb 21, 2022
Maintainer