Nordvpn: running vpn container on a system already behind a VPN #2382

gauravojha · 2024-07-30T16:52:10Z

gauravojha
Jul 30, 2024

Hi team, I am coming here from qdm12/gluetun-wiki#73. So till now I was using the https://github.com/DyonR/docker-qbittorrentvpn image, where I would bring my nordvpn container up, and route my other traffic from it.

This is how my system would look in this scenario:

my system -> running nordvpn connected to US
nordvpn container -> connected to Netherlands

When I used to check my connectivity, it would correctly say that my system was connected to a VPN SP in the US, while the container traffic is from Netherlands.

I thought of giving gluetun a try as well. However, gluetun doesn't work this way. I have to switch off my system's nordvpn for it to work. If I dont do that, it keeps timing out, same error as I see in the above issue I linked. I am very curious about this. How come gluetun doesn't work this way, but the other image from https://github.com/DyonR/docker-qbittorrentvpn does?

Is this pattern not supported?

Here is the docker command I use

docker run -it --rm --cap-add=NET_ADMIN --device /dev/net/tun -e VPN_SERVICE_PROVIDER=nordvpn \
-e VPN_TYPE=wireguard \
-e WIREGUARD_PRIVATE_KEY=<my_key> \
-e SERVER_COUNTRIES=Netherlands qmcgaw/gluetun

As soon as I shut down my system's VPN, this same thing works. Is it not possible to have both, like how I have it setup on other image providers? I have played around with settings like KEEP_DNS_NAMESERVER

Answered by gauravojha

Jul 30, 2024

Seems MTU was the reason! The default value is 1400, I decreased it to 1300, and that got it working! This thread suggested to do so

Here is the compose I used

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=nordvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=<redacted>
      - SERVER_COUNTRIES=Netherlands
      - WIREGUARD_MTU=1300
    devices:
      - /dev/net/tun:/dev/net/tun
    restart: unless-stopped

View full answer

gauravojha · 2024-07-30T16:55:53Z

gauravojha
Jul 30, 2024
Author

Here is the full output as well

gluetun-1  | ========================================
gluetun-1  | ========================================
gluetun-1  | =============== gluetun ================
gluetun-1  | ========================================
gluetun-1  | =========== Made with ❤️ by ============
gluetun-1  | ======= https://github.com/qdm12 =======
gluetun-1  | ========================================
gluetun-1  | ========================================
gluetun-1  | 
gluetun-1  | Running version latest built on 2024-07-29T13:58:28.328Z (commit 8c730a6)
gluetun-1  | 
gluetun-1  | 🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
gluetun-1  | 🐛 Bug? https://github.com/qdm12/gluetun/issues/new
gluetun-1  | ✨ New feature? https://github.com/qdm12/gluetun/issues/new
gluetun-1  | ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
gluetun-1  | 💻 Email? quentin.mcgaw@gmail.com
gluetun-1  | 💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
gluetun-1  | 2024-07-30T16:47:57Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1, assigned IP 172.17.0.2 and family v4
gluetun-1  | 2024-07-30T16:47:57Z INFO [routing] local ethernet link found: eth0
gluetun-1  | 2024-07-30T16:47:57Z INFO [routing] local ipnet found: 172.17.0.0/16
gluetun-1  | 2024-07-30T16:47:57Z INFO [firewall] enabling...
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --policy INPUT DROP
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --policy OUTPUT DROP
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --policy FORWARD DROP
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] ip6tables-legacy --policy INPUT DROP
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] ip6tables-legacy --policy OUTPUT DROP
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] ip6tables-legacy --policy FORWARD DROP
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --append INPUT -i lo -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] ip6tables-legacy --append INPUT -i lo -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --append OUTPUT -o lo -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] ip6tables-legacy --append OUTPUT -o lo -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] ip6tables-legacy --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] ip6tables-legacy --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --append OUTPUT -o eth0 -s 172.17.0.2 -d 172.17.0.0/16 -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] ip6tables-legacy --append OUTPUT -o eth0 -d ff02::1:ff/104 -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --append INPUT -i eth0 -d 172.17.0.0/16 -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z INFO [firewall] enabled successfully
gluetun-1  | 2024-07-30T16:47:57Z INFO [storage] creating /gluetun/servers.json with 19671 hardcoded servers
gluetun-1  | 2024-07-30T16:47:57Z INFO Alpine version: 3.20.2
gluetun-1  | 2024-07-30T16:47:57Z INFO OpenVPN 2.5 version: 2.5.10
gluetun-1  | 2024-07-30T16:47:57Z INFO OpenVPN 2.6 version: 2.6.11
gluetun-1  | 2024-07-30T16:47:57Z INFO Unbound version: 1.20.0
gluetun-1  | 2024-07-30T16:47:57Z INFO IPtables version: v1.8.10
gluetun-1  | 2024-07-30T16:47:57Z INFO Settings summary:
gluetun-1  | ├── VPN settings:
gluetun-1  | |   ├── VPN provider settings:
gluetun-1  | |   |   ├── Name: nordvpn
gluetun-1  | |   |   └── Server selection settings:
gluetun-1  | |   |       ├── VPN type: wireguard
gluetun-1  | |   |       └── Wireguard selection settings:
gluetun-1  | |   └── Wireguard settings:
gluetun-1  | |       ├── Private key: [redacted]
gluetun-1  | |       ├── Interface addresses:
gluetun-1  | |       |   └── 10.5.0.2/32
gluetun-1  | |       ├── Allowed IPs:
gluetun-1  | |       |   ├── 0.0.0.0/0
gluetun-1  | |       |   └── ::/0
gluetun-1  | |       └── Network interface: tun0
gluetun-1  | |           └── MTU: 1400
gluetun-1  | ├── DNS settings:
gluetun-1  | |   ├── Keep existing nameserver(s): no
gluetun-1  | |   ├── DNS server address to use: 127.0.0.1
gluetun-1  | |   └── DNS over TLS settings:
gluetun-1  | |       ├── Enabled: yes
gluetun-1  | |       ├── Update period: every 24h0m0s
gluetun-1  | |       ├── Unbound settings:
gluetun-1  | |       |   ├── Authoritative servers:
gluetun-1  | |       |   |   └── cloudflare
gluetun-1  | |       |   ├── Caching: yes
gluetun-1  | |       |   ├── IPv6: no
gluetun-1  | |       |   ├── Verbosity level: 1
gluetun-1  | |       |   ├── Verbosity details level: 0
gluetun-1  | |       |   ├── Validation log level: 0
gluetun-1  | |       |   ├── System user: root
gluetun-1  | |       |   └── Allowed networks:
gluetun-1  | |       |       ├── 0.0.0.0/0
gluetun-1  | |       |       └── ::/0
gluetun-1  | |       └── DNS filtering settings:
gluetun-1  | |           ├── Block malicious: yes
gluetun-1  | |           ├── Block ads: no
gluetun-1  | |           ├── Block surveillance: no
gluetun-1  | |           └── Blocked IP networks:
gluetun-1  | |               ├── 127.0.0.1/8
gluetun-1  | |               ├── 10.0.0.0/8
gluetun-1  | |               ├── 172.16.0.0/12
gluetun-1  | |               ├── 192.168.0.0/16
gluetun-1  | |               ├── 169.254.0.0/16
gluetun-1  | |               ├── ::1/128
gluetun-1  | |               ├── fc00::/7
gluetun-1  | |               ├── fe80::/10
gluetun-1  | |               ├── ::ffff:127.0.0.1/104
gluetun-1  | |               ├── ::ffff:10.0.0.0/104
gluetun-1  | |               ├── ::ffff:169.254.0.0/112
gluetun-1  | |               ├── ::ffff:172.16.0.0/108
gluetun-1  | |               └── ::ffff:192.168.0.0/112
gluetun-1  | ├── Firewall settings:
gluetun-1  | |   ├── Enabled: yes
gluetun-1  | |   └── Debug mode: on
gluetun-1  | ├── Log settings:
gluetun-1  | |   └── Log level: info
gluetun-1  | ├── Health settings:
gluetun-1  | |   ├── Server listening address: 127.0.0.1:9999
gluetun-1  | |   ├── Target address: cloudflare.com:443
gluetun-1  | |   ├── Duration to wait after success: 5s
gluetun-1  | |   ├── Read header timeout: 100ms
gluetun-1  | |   ├── Read timeout: 500ms
gluetun-1  | |   └── VPN wait durations:
gluetun-1  | |       ├── Initial duration: 6s
gluetun-1  | |       └── Additional duration: 5s
gluetun-1  | ├── Shadowsocks server settings:
gluetun-1  | |   └── Enabled: no
gluetun-1  | ├── HTTP proxy settings:
gluetun-1  | |   └── Enabled: no
gluetun-1  | ├── Control server settings:
gluetun-1  | |   ├── Listening address: :8000
gluetun-1  | |   └── Logging: yes
gluetun-1  | ├── OS Alpine settings:
gluetun-1  | |   ├── Process UID: 1000
gluetun-1  | |   └── Process GID: 1000
gluetun-1  | ├── Public IP settings:
gluetun-1  | |   ├── Fetching: every 12h0m0s
gluetun-1  | |   ├── IP file path: /tmp/gluetun/ip
gluetun-1  | |   └── Public IP data API: ipinfo
gluetun-1  | └── Version settings:
gluetun-1  |     └── Enabled: yes
gluetun-1  | 2024-07-30T16:47:57Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1, assigned IP 172.17.0.2 and family v4
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [routing] ip rule add from 172.17.0.2/32 lookup 200 pref 100
gluetun-1  | 2024-07-30T16:47:57Z INFO [routing] adding route for 0.0.0.0/0
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [routing] ip route replace 0.0.0.0/0 via 172.17.0.1 dev eth0 table 200
gluetun-1  | 2024-07-30T16:47:57Z INFO [firewall] setting allowed subnets...
gluetun-1  | 2024-07-30T16:47:57Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1, assigned IP 172.17.0.2 and family v4
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [routing] ip rule add to 172.17.0.0/16 lookup 254 pref 98
gluetun-1  | 2024-07-30T16:47:57Z INFO [dns] using plaintext DNS at address 1.1.1.1
gluetun-1  | 2024-07-30T16:47:57Z INFO [http server] http server listening on [::]:8000
gluetun-1  | 2024-07-30T16:47:57Z INFO [healthcheck] listening on 127.0.0.1:9999
gluetun-1  | 2024-07-30T16:47:57Z INFO [firewall] allowing VPN connection...
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --append OUTPUT -d 156.146.35.96 -o eth0 -p udp -m udp --dport 51820 -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] iptables --append OUTPUT -o tun0 -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z DEBUG [firewall] ip6tables-legacy --append OUTPUT -o tun0 -j ACCEPT
gluetun-1  | 2024-07-30T16:47:57Z INFO [wireguard] Using available kernelspace implementation
gluetun-1  | 2024-07-30T16:47:57Z INFO [wireguard] Connecting to 156.146.35.96:51820
gluetun-1  | 2024-07-30T16:47:57Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
gluetun-1  | 2024-07-30T16:47:57Z INFO [dns] downloading DNS over TLS cryptographic files
gluetun-1  | 2024-07-30T16:47:58Z INFO [healthcheck] healthy!
gluetun-1  | 2024-07-30T16:48:08Z WARN [dns] cannot update files: Get "https://www.internic.net/domain/named.root": net/http: TLS handshake timeout
gluetun-1  | 2024-07-30T16:48:08Z INFO [dns] attempting restart in 10s
gluetun-1  | 2024-07-30T16:48:18Z INFO [dns] downloading DNS over TLS cryptographic files
gluetun-1  | 2024-07-30T16:48:18Z ERROR [vpn] getting public IP address information: fetching information: Get "https://ipinfo.io/": net/http: TLS handshake timeout
gluetun-1  | 2024-07-30T16:48:29Z WARN [dns] cannot update files: Get "https://www.internic.net/domain/named.root": net/http: TLS handshake timeout
gluetun-1  | 2024-07-30T16:48:29Z INFO [dns] attempting restart in 20s
gluetun-1  | 2024-07-30T16:48:29Z ERROR [vpn] cannot get version information: Get "https://api.github.com/repos/qdm12/gluetun/commits": net/http: TLS handshake timeout
gluetun-1  | 2024-07-30T16:48:49Z INFO [dns] downloading DNS over TLS cryptographic files
^CGracefully stopping... (press Ctrl+C again to force)

0 replies

gauravojha · 2024-07-30T17:12:27Z

gauravojha
Jul 30, 2024
Author

Seems to be same as what #2141 is having..

0 replies

gauravojha · 2024-07-30T23:16:55Z

gauravojha
Jul 30, 2024
Author

Seems MTU was the reason! The default value is 1400, I decreased it to 1300, and that got it working! This thread suggested to do so

Here is the compose I used

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=nordvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=<redacted>
      - SERVER_COUNTRIES=Netherlands
      - WIREGUARD_MTU=1300
    devices:
      - /dev/net/tun:/dev/net/tun
    restart: unless-stopped

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Nordvpn: running vpn container on a system already behind a VPN #2382

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Nordvpn: running vpn container on a system already behind a VPN #2382

gauravojha Jul 30, 2024

Replies: 3 comments

gauravojha Jul 30, 2024 Author

gauravojha Jul 30, 2024 Author

gauravojha Jul 30, 2024 Author

gauravojha
Jul 30, 2024

gauravojha
Jul 30, 2024
Author

gauravojha
Jul 30, 2024
Author

gauravojha
Jul 30, 2024
Author