Bug: ProtonVPN unhealthy and not working after some time

[pehweihang]

Is this urgent?

Yes

Host OS

Ubuntu

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2024-03-07T12:32:25.391Z (commit 3254fc8)

What's the problem 🤔

When using ProtonVPN with Wireguard, it works for a few minutes before it becomes unhealthy and will not recover. The issue persists even after changing the ProtonVPN servers multiple times and also using OpenVPN. I've also tried using the provider Mullvad and there's no issue.

Share your logs (at least 10 lines)

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================

Running version latest built on 2024-03-07T12:32:25.391Z (commit 3254fc8)

🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
🐛 Bug? https://github.com/qdm12/gluetun/issues/new
✨ New feature? https://github.com/qdm12/gluetun/issues/new
☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2024-03-18T16:03:48Z INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.3 and family v4
2024-03-18T16:03:48Z INFO [routing] local ethernet link found: eth0
2024-03-18T16:03:48Z INFO [routing] local ipnet found: 172.20.0.0/16
2024-03-18T16:03:49Z INFO [firewall] enabling...
2024-03-18T16:03:49Z INFO [firewall] enabled successfully
2024-03-18T16:03:49Z INFO [storage] creating /gluetun/servers.json with 17820 hardcoded servers
2024-03-18T16:03:49Z INFO Alpine version: 3.18.6
2024-03-18T16:03:49Z INFO OpenVPN 2.5 version: 2.5.8
2024-03-18T16:03:49Z INFO OpenVPN 2.6 version: 2.6.8
2024-03-18T16:03:49Z INFO Unbound version: 1.19.1
2024-03-18T16:03:49Z INFO IPtables version: v1.8.9
2024-03-18T16:03:49Z INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: custom
|   |   ├── Server selection settings:
|   |   |   ├── VPN type: wireguard
|   |   |   ├── Target IP address: 146.70.29.194
|   |   |   └── Wireguard selection settings:
|   |   |       ├── Endpoint IP address: 146.70.29.194
|   |   |       ├── Endpoint port: 51820
|   |   |       └── Server public key: WFvkM9OCh1IFqlTgxy/mxcw/PRVxKS9T9JxkMxi+yiI=
|   |   └── Automatic port forwarding settings:
|   |       ├── Redirection listening port: disabled
|   |       ├── Use code for provider: protonvpn
|   |       └── Forwarded port file path: /tmp/gluetun/forwarded_port
|   └── Wireguard settings:
|       ├── Private key: WEe...VY=
|       ├── Interface addresses:
|       |   └── 10.2.0.2/32
|       ├── Allowed IPs:
|       |   ├── 0.0.0.0/0
|       |   └── ::/0
|       └── Network interface: tun0
|           └── MTU: 1400
├── DNS settings:
|   ├── Keep existing nameserver(s): no
|   ├── DNS server address to use: 127.0.0.1
|   └── DNS over TLS settings:
|       ├── Enabled: yes
|       ├── Update period: every 24h0m0s
|       ├── Unbound settings:
|       |   ├── Authoritative servers:
|       |   |   └── cloudflare
|       |   ├── Caching: yes
|       |   ├── IPv6: no
|       |   ├── Verbosity level: 1
|       |   ├── Verbosity details level: 0
|       |   ├── Validation log level: 0
|       |   ├── System user: root
|       |   └── Allowed networks:
|       |       ├── 0.0.0.0/0
|       |       └── ::/0
|       └── DNS filtering settings:
|           ├── Block malicious: yes
|           ├── Block ads: no
|           ├── Block surveillance: no
|           └── Blocked IP networks:
|               ├── 127.0.0.1/8
|               ├── 10.0.0.0/8
|               ├── 172.16.0.0/12
|               ├── 192.168.0.0/16
|               ├── 169.254.0.0/16
|               ├── ::1/128
|               ├── fc00::/7
|               ├── fe80::/10
|               ├── ::ffff:127.0.0.1/104
|               ├── ::ffff:10.0.0.0/104
|               ├── ::ffff:169.254.0.0/112
|               ├── ::ffff:172.16.0.0/108
|               └── ::ffff:192.168.0.0/112
├── Firewall settings:
|   ├── Enabled: yes
|   └── Outbound subnets:
|       └── 172.20.0.0/16
├── Log settings:
|   └── Log level: INFO
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: cloudflare.com:443
|   ├── Duration to wait after success: 5s
|   ├── Read header timeout: 100ms
|   ├── Read timeout: 500ms
|   └── VPN wait durations:
|       ├── Initial duration: 6s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   └── Logging: yes
├── OS Alpine settings:
|   ├── Process UID: 1000
|   └── Process GID: 1000
├── Public IP settings:
|   ├── Fetching: every 12h0m0s
|   ├── IP file path: /tmp/gluetun/ip
|   └── Public IP data API: ipinfo
└── Version settings:
    └── Enabled: yes
2024-03-18T16:03:49Z INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.3 and family v4
2024-03-18T16:03:49Z INFO [routing] adding route for 0.0.0.0/0
2024-03-18T16:03:49Z INFO [firewall] setting allowed subnets...
2024-03-18T16:03:49Z INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.3 and family v4
2024-03-18T16:03:49Z INFO [routing] adding route for 172.20.0.0/16
2024-03-18T16:03:49Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2024-03-18T16:03:49Z INFO [dns] using plaintext DNS at address 1.1.1.1
2024-03-18T16:03:49Z INFO [http server] http server listening on [::]:8000
2024-03-18T16:03:49Z INFO [firewall] allowing VPN connection...
2024-03-18T16:03:49Z INFO [healthcheck] listening on 127.0.0.1:9999
2024-03-18T16:03:49Z INFO [wireguard] Using available kernelspace implementation
2024-03-18T16:03:49Z INFO [wireguard] Connecting to 146.70.29.194:51820
2024-03-18T16:03:49Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2024-03-18T16:03:49Z INFO [dns] downloading DNS over TLS cryptographic files
2024-03-18T16:03:54Z INFO [healthcheck] healthy!
2024-03-18T16:03:56Z INFO [dns] downloading hostnames and IP block lists
2024-03-18T16:03:59Z INFO [dns] init module 0: validator
2024-03-18T16:03:59Z INFO [dns] init module 1: iterator
2024-03-18T16:03:59Z INFO [dns] start of service (unbound 1.19.1).
2024-03-18T16:03:59Z INFO [dns] generate keytag query _ta-4a5c-4f66. NULL IN
2024-03-18T16:03:59Z INFO [dns] generate keytag query _ta-4a5c-4f66. NULL IN
2024-03-18T16:03:59Z INFO [dns] ready
2024-03-18T16:04:00Z INFO [ip getter] Public IP address is 146.70.29.205 (Singapore, Singapore, Singapore)
2024-03-18T16:04:00Z INFO [vpn] You are running 2 commits behind the most recent latest
2024-03-18T16:04:00Z INFO [port forwarding] starting
2024-03-18T16:04:00Z INFO [port forwarding] gateway external IPv4 address is 146.70.29.205
2024-03-18T16:04:00Z INFO [port forwarding] port forwarded is 45941
2024-03-18T16:04:00Z INFO [firewall] setting allowed input port 45941 through interface tun0...
2024-03-18T16:04:00Z INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2024-03-18T16:07:38Z INFO [firewall] removing allowed port 45941...
2024-03-18T16:07:38Z INFO [port forwarding] removing port file /tmp/gluetun/forwarded_port
2024-03-18T16:07:38Z ERROR [port forwarding] adding port mapping: executing remote procedure call: connection timeout: failed attempts: read udp 10.2.0.2:60459->10.2.0.1:5351: i/o timeout (tries 1, 2, 3, 4, 5, 6, 7, 8, 9)
2024-03-18T16:07:38Z INFO [port forwarding] starting
2024-03-18T16:09:21Z INFO [healthcheck] program has been unhealthy for 6s: restarting VPN
2024-03-18T16:09:21Z INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2024-03-18T16:09:21Z INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION
2024-03-18T16:09:21Z INFO [vpn] stopping
2024-03-18T16:09:46Z INFO [vpn] starting
2024-03-18T16:09:46Z INFO [firewall] allowing VPN connection...
2024-03-18T16:09:46Z INFO [wireguard] Using available kernelspace implementation
2024-03-18T16:09:46Z INFO [wireguard] Connecting to 146.70.29.194:51820
2024-03-18T16:09:46Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2024-03-18T16:09:46Z INFO [port forwarding] starting
2024-03-18T16:09:57Z INFO [healthcheck] program has been unhealthy for 11s: restarting VPN
2024-03-18T16:09:57Z INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2024-03-18T16:09:57Z INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION
2024-03-18T16:09:57Z INFO [vpn] stopping
2024-03-18T16:10:01Z ERROR [ip getter] Get "https://ipinfo.io/": dial tcp 34.117.186.192:443: i/o timeout (Client.Timeout exceeded while awaiting headers) - retrying in 5s
2024-03-18T16:10:21Z ERROR [ip getter] Get "https://ipinfo.io/": context deadline exceeded (Client.Timeout exceeded while awaiting headers) - retrying in 10s
2024-03-18T16:10:46Z ERROR [ip getter] Get "https://ipinfo.io/": context deadline exceeded (Client.Timeout exceeded while awaiting headers) - retrying in 20s
2024-03-18T16:11:21Z ERROR [ip getter] Get "https://ipinfo.io/": context deadline exceeded (Client.Timeout exceeded while awaiting headers) - retrying in 40s
2024-03-18T16:11:54Z ERROR [vpn] port forwarding for the first time: getting external IPv4 address: executing remote procedure call: connection timeout: failed attempts: read udp 10.2.0.2:39062->10.2.0.1:5351: i/o timeout (tries 1, 2, 3, 4, 5, 6, 7, 8, 9)
2024-03-18T16:11:54Z INFO [vpn] starting
2024-03-18T16:11:54Z INFO [firewall] allowing VPN connection...
2024-03-18T16:11:54Z INFO [wireguard] Using available kernelspace implementation
2024-03-18T16:11:54Z INFO [wireguard] Connecting to 146.70.29.194:51820
2024-03-18T16:11:54Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2024-03-18T16:12:10Z INFO [healthcheck] program has been unhealthy for 16s: restarting VPN
2024-03-18T16:12:10Z INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2024-03-18T16:12:10Z INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION
2024-03-18T16:12:10Z INFO [vpn] stopping
2024-03-18T16:12:10Z INFO [vpn] starting
2024-03-18T16:12:10Z INFO [firewall] allowing VPN connection...
2024-03-18T16:12:10Z INFO [wireguard] Using available kernelspace implementation
2024-03-18T16:12:10Z INFO [wireguard] Connecting to 146.70.29.194:51820
2024-03-18T16:12:10Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2024-03-18T16:12:16Z ERROR [ip getter] Get "https://ipinfo.io/": context deadline exceeded (Client.Timeout exceeded while awaiting headers) - retrying in 1m20s
2024-03-18T16:12:33Z INFO [healthcheck] program has been unhealthy for 21s: restarting VPN
2024-03-18T16:12:33Z INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2024-03-18T16:12:33Z INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION
2024-03-18T16:12:33Z INFO [vpn] stopping
2024-03-18T16:12:33Z INFO [vpn] starting
2024-03-18T16:12:33Z INFO [firewall] allowing VPN connection...
2024-03-18T16:12:33Z INFO [wireguard] Using available kernelspace implementation
2024-03-18T16:12:33Z INFO [wireguard] Connecting to 146.70.29.194:51820
2024-03-18T16:12:33Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2024-03-18T16:13:00Z INFO [healthcheck] program has been unhealthy for 26s: restarting VPN
2024-03-18T16:13:00Z INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2024-03-18T16:13:00Z INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION
2024-03-18T16:13:00Z INFO [vpn] stopping
2024-03-18T16:13:01Z INFO [vpn] starting
2024-03-18T16:13:01Z INFO [firewall] allowing VPN connection...
2024-03-18T16:13:01Z INFO [wireguard] Using available kernelspace implementation
2024-03-18T16:13:01Z INFO [wireguard] Connecting to 146.70.29.194:51820
2024-03-18T16:13:01Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.

Share your configuration

services:
  vpn:
    container_name: vpn
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=custom
      - FIREWALL_OUTBOUND_SUBNETS=172.20.0.0/16
      - WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
      - WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
      - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
      - VPN_ENDPOINT_IP=${VPN_ENDPOINT_IP}
      - VPN_ENDPOINT_PORT=${VPN_ENDPOINT_PORT}
      - VPN_PORT_FORWARDING_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - VPN_PORT_FORWARDING=on
    networks:
      - mynetwork
    restart: "unless-stopped"

[M-archand]

I don't have any additional information to add, but I just updated to the latest release and I am now experiencing this same issue as well with ProtonVPN as my provider.

[qdm12]

@pehweihang Have you tried updating servers and checking each possible problem/solution given in the healthcheck page?

@M-archand

I just updated to the latest release

What if you use an older release such as :v3.37, does it work? If it doesn't work either, then it's a server or config issue, try updating servers or change server filters

[pehweihang]

I've tried updating the servers and using other tags (:v3.37, :v3.36).
Looking at the healthcheck page, I don't think its any of the problems listed as I've tried multiple wireguard server configs, only ProtonVPN has this issue (Mullvad works fine).

[M-archand]

@M-archand

What if you use an older release such as :v3.37, does it work? If it doesn't work either, then it's a server or config issue, try updating servers or change server filters

Older version tags did not seem to work for me. I decided to recreate my wireguard certificate through protonvpn and everything is working again now on the latest version for some reason. Strange since my wireguard connection worked before updating my container, but no complaints from me 😁

[qdm12]

@pehweihang please try re-generating a wireguard config file on protonvpn website? 🤔 @M-archand is suggesting this solved it I think.

Otherwise, try with a native Wireguard client (i.e. windows or android app) and a protonvpn config file to check it works fine for a few minutes. This looks to me like a protonvpn server problem, especially since it manages to connect and do a few exchanges successfully, before dying and not being able to reconnect.

[pflavio]

Update of the 18th march broke the latest image, pull the latest image again to get the fix from the 19th march. Marking a few of the last comments as hidden since it's off topic.

Hi so I re-installed the image with the :latest tag again, but now I'm getting the "classic" error:

2024-03-20T16:01:06+01:00 ERROR [ip getter] Get "https://ipinfo.io/": dial tcp: lookup ipinfo.io on 10.8.2.2:53: read udp 10.8.0.2:46161->10.8.2.2:53: i/o timeout - retrying in 10s
2024-03-20T16:01:13+01:00 WARN [dns] cannot update files: Get "https://www.internic.net/domain/named.root": dial tcp: lookup www.internic.net on 10.8.2.2:53: read udp 10.8.0.2:40607->10.8.2.2:53: i/o timeout

I did not make any changes to the container or any settings besides setting the tag and re-deploying it. Any pointers?

[pehweihang]

It seems that it is indeed a ProtonVPN server issue. When using I tried using another country's server config and it works fine, weird that all of my country's servers do not work though.

@qdm12 I think its ok to close this issue now. Thank you for your work on this awesome piece of software!

[smolpaw]

Using ProtonVPN here and the latest works with openvpn.

[qdm12]

When using I tried using another country's server config and it works fine, weird that all of my country's servers do not work though.

Even after a servers data update? Maybe some of them changed IP addresses, that would explain this misbehavior.

[qdm12]

Ok this looks more or less resolved from the original author, as well as other protonvpn users, so closing this.
Feel free to also refer to #2154 on possible other reasons you might have an unstable connection.

[github-actions]

Closed issues are NOT monitored, so commenting here is likely to be not seen.
If you think this is still unresolved and have more information to bring, please create another issue.

This is an automated comment setup because @qdm12 is the sole maintainer of this project
which became too popular to monitor issues closed.