dsn, link-mtu, comp-lzo Error #666

MajorLOL · 2021-10-08T09:59:11Z

MajorLOL
Oct 8, 2021

Greetings,

Receiving the following messages errors:

2021/10/08 11:14:57 WARN openvpn: 'link-mtu' is used inconsistently, local='link-mtu 1633', remote='link-mtu 1634'
2021/10/08 09:14:56 WARN openvpn: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2021/10/08 09:02:01 INFO dns over tls: falling back on plaintext DNS at address 1.1.1.1
2021/10/08 09:02:01 WARN dns over tls: DNS is not working: after 10 tries: lookup github.com on 192.168.0.39:53: read udp 127.0.0.1:44472->127.0.0.1:53: i/o timeout
2021/10/08 09:02:01 INFO dns over tls: attempting restart in 5h41m20s

Anyone that know how to fix this?
I am on Synology 7.0 running docker 20.10.3-1233

Running version built 2021-10-05T17:48:06Z (commit e0e3ca3)

qdm12 · 2021-10-09T00:10:53Z

qdm12
Oct 9, 2021
Maintainer

What provider are you using? I probably removed the compression (which is a security risk) from the client config, but maybe they don't support without it on their servers. I'll revert it once I know which provider it is.

You can try also by setting OPENVPN_FLAGS=--comp-lzo perhaps see if it fixes it.

7 replies

MajorLOL Oct 9, 2021
Author

Thank for the quick fix, Here are the results:

2021/10/09 15:41:57 INFO routing: default route found: interface eth0, gateway 172.17.0.1
2021/10/09 15:41:57 INFO routing: local ethernet link found: eth0
2021/10/09 15:41:57 INFO routing: local ipnet found: 172.17.0.0/16
2021/10/09 15:41:57 INFO routing: default route found: interface eth0, gateway 172.17.0.1
2021/10/09 15:41:57 INFO routing: adding route for 0.0.0.0/0
2021/10/09 15:41:57 INFO firewall: firewall disabled, only updating allowed subnets internal list
2021/10/09 15:41:57 INFO routing: default route found: interface eth0, gateway 172.17.0.1
2021/10/09 15:41:57 INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2021/10/09 15:41:57 INFO firewall: enabling...
2021/10/09 15:42:00 INFO firewall: enabled successfully
2021/10/09 15:42:00 INFO healthcheck: listening on 127.0.0.1:9999
2021/10/09 15:42:00 INFO dns over tls: using plaintext DNS at address 1.1.1.1
2021/10/09 15:42:00 INFO http server: listening on :8000
2021/10/09 15:42:00 INFO firewall: setting VPN connection through firewall...
2021/10/09 15:42:00 INFO openvpn: 2021-10-09 15:42:00 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2021/10/09 15:42:00 INFO openvpn: OpenVPN 2.5.2 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on May  4 2021
2021/10/09 15:42:00 INFO openvpn: library versions: OpenSSL 1.1.1l  24 Aug 2021, LZO 2.10
2021/10/09 15:42:00 INFO openvpn: TCP/UDP: Preserving recently used remote address: [AF_INET]83.136.182.104:1194
2021/10/09 15:42:00 INFO openvpn: UDP link local: (not bound)
2021/10/09 15:42:00 INFO openvpn: UDP link remote: [AF_INET]83.136.182.104:1194
2021/10/09 15:42:02 INFO openvpn: [us9185.nordvpn.com] Peer Connection Initiated with [AF_INET]83.136.182.104:1194
2021/10/09 15:42:03 INFO openvpn: TUN/TAP device tun0 opened
2021/10/09 15:42:03 INFO openvpn: /sbin/ip link set dev tun0 up mtu 1500
2021/10/09 15:42:03 INFO openvpn: /sbin/ip link set dev tun0 up
2021/10/09 15:42:03 INFO openvpn: /sbin/ip addr add dev tun0 10.8.2.7/24
2021/10/09 15:42:03 INFO openvpn: UID set to nonrootuser
2021/10/09 15:42:03 INFO openvpn: Initialization Sequence Completed
2021/10/09 15:42:03 INFO dns over tls: downloading DNS over TLS cryptographic files
2021/10/09 15:42:04 INFO healthcheck: healthy!
2021/10/09 15:42:05 INFO dns over tls: downloading hostnames and IP block lists
2021/10/09 15:42:29 INFO dns over tls: falling back on plaintext DNS at address 1.1.1.1
2021/10/09 15:42:29 WARN dns over tls: DNS is not working: after 10 tries: lookup github.com on 192.168.0.39:53: read udp 127.0.0.1:49966->127.0.0.1:53: read: connection refused
2021/10/09 15:42:29 INFO dns over tls: attempting restart in 10s
2021/10/09 15:42:30 INFO ip getter: Public IP address is 83.136.182.25 (United States, Colorado, Denver)
2021/10/09 15:42:30 INFO vpn: There is a new release v3.25.0 (v3.25.0) created 11 days ago
2021/10/09 15:42:39 INFO dns over tls: downloading DNS over TLS cryptographic files
2021/10/09 15:42:41 INFO dns over tls: downloading hostnames and IP block lists
2021/10/09 15:43:00 INFO dns over tls: falling back on plaintext DNS at address 1.1.1.1
2021/10/09 15:43:00 WARN dns over tls: DNS is not working: after 10 tries: lookup github.com on 192.168.0.39:53: read udp 127.0.0.1:56439->127.0.0.1:53: read: connection refused
2021/10/09 15:43:00 INFO dns over tls: attempting restart in 20s

Seems there are still issues in:

2021/10/09 15:42:00 INFO openvpn: 2021-10-09 15:42:00 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

and

2021/10/09 15:43:00 WARN dns over tls: DNS is not working: after 10 tries: lookup github.com on 192.168.0.39:53: read udp 127.0.0.1:56439->127.0.0.1:53: read: connection refused

qdm12 Oct 9, 2021
Maintainer

2021/10/09 15:42:00 INFO openvpn: 2021-10-09 15:42:00 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

That's expected since they don't seem to work without compression. Although, maybe share one of your (full) logs with the qmcgaw/gluetun:latest image and with OPENVPN_VERBOSITY=3, maybe the disabled compression wasn't at fault. The one you initially shared doesn't show if Openvpn managed to reach the Initialization sequence completed step for example.

over tls: DNS is not working: after 10 tries: lookup github.com on 192.168.0.39:53: read udp 127.0.0.1:56439->127.0.0.1:53: read: connection refused

This is strange. The connection is up since files get downloaded from github and all, but the connection is refused. Maybe the DNS over TLS port 853 is blocked by NordVPN 🤔 If you get a connection refused error, it's a firewall issue, I doubt it's a gluetun firewall problem so that's most likely on the Nordvpn server side.

qdm12 Oct 9, 2021
Maintainer

You can also disable dns over tls with DOT=off so this should work for now. Although then everyone between the vpn server and the DNS nameserver will know about your DNS unencrypted traffic, so there is that.

MajorLOL Oct 9, 2021
Author

_gluetun_logs (3).txt
Here is the results with the 666 version.

Results of the latest version:
_gluetun1_logs.txt

DOT=off and OPENVPN_VERBOSITY=3 on both of them
BTW do i need to open a port on my own firewall in order for the dns to work?

qdm12 Oct 13, 2021
Maintainer

_gluetun_logs (3).txt
Here is the results with the 666 version.

That one works, ok. Are you sure DOT=on doesn't work across all of their servers? Maybe try with another country?

Results of the latest version:
_gluetun1_logs.txt

That one seems to work, where it shouldn't due to the missing compression (comp-lzo). My guess is some of their servers only work with compression and some others do work with or without it.

BTW do i need to open a port on my own firewall in order for the dns to work?

Nope 😉 If DoT fails, it's due to the NordVPN server firewall and the only way you can change that is by contacting their support. If it is actually their firewall, this is a bit sketchy from them if they don't a good explanation. Would it mean they try to force you to use plaintext DNS to snoop on your traffic 🤔 (Maybe i'm too paranoid!)

chdzma · 2022-03-04T16:14:59Z

chdzma
Mar 4, 2022

Any fix? I have the same issue with winscribe and wireguard.

Logs:

127.0.0.1:53: read udp 127.0.0.1:40059->127.0.0.1:53: read: connection refused
2022/03/04 17:07:45 INFO dns over tls: attempting restart in 1m20s
2022/03/04 17:09:05 INFO dns over tls: downloading DNS over TLS cryptographic files
2022/03/04 17:09:07 INFO dns over tls: downloading hostnames and IP block lists
2022/03/04 17:09:30 INFO dns over tls: falling back on plaintext DNS at address 1.1.1.1
2022/03/04 17:09:30 WARN dns over tls: DNS is not working: after 10 tries: lookup github.com on 127.0.0.1:53: read udp 127.0.0.1:56468->127.0.0.1:53: read: connection refused
2022/03/04 17:09:30 INFO dns over tls: attempting restart in 2m40s
2022/03/04 17:12:10 INFO dns over tls: downloading DNS over TLS cryptographic files
2022/03/04 17:12:12 INFO dns over tls: downloading hostnames and IP block lists
2022/03/04 17:12:35 INFO dns over tls: falling back on plaintext DNS at address 1.1.1.1
2022/03/04 17:12:35 WARN dns over tls: DNS is not working: after 10 tries: lookup github.com on 127.0.0.1:53: read udp 127.0.0.1:42105->127.0.0.1:53: read: connection refused
2022/03/04 17:12:35 INFO dns over tls: attempting restart in 5m20s

1 reply

qdm12 May 8, 2022
Maintainer

That's probably just your keys being invalid for Wireguard.
Please create another issue or discussion since this current discussion is about OpenVPN only.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dsn, link-mtu, comp-lzo Error #666

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 8 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

dsn, link-mtu, comp-lzo Error #666

MajorLOL Oct 8, 2021

Replies: 2 comments · 8 replies

qdm12 Oct 9, 2021 Maintainer

MajorLOL Oct 9, 2021 Author

qdm12 Oct 9, 2021 Maintainer

qdm12 Oct 9, 2021 Maintainer

MajorLOL Oct 9, 2021 Author

qdm12 Oct 13, 2021 Maintainer

chdzma Mar 4, 2022

qdm12 May 8, 2022 Maintainer

MajorLOL
Oct 8, 2021

Replies: 2 comments 8 replies

qdm12
Oct 9, 2021
Maintainer

MajorLOL Oct 9, 2021
Author

qdm12 Oct 9, 2021
Maintainer

qdm12 Oct 9, 2021
Maintainer

MajorLOL Oct 9, 2021
Author

qdm12 Oct 13, 2021
Maintainer

chdzma
Mar 4, 2022

qdm12 May 8, 2022
Maintainer