Gluetun+Nordvpn - Connections problems and Gluetun crashes right away after deploying

[Rakth]

Hi

I run a fully updated OMV5 and newest Portainer 2.11
I am deploying GLuetun from Portainer as a docker compose stack from the creators github and using Nordvpn as the provider.
After deploying Gluetun stack crashes and this happen every time.

The log shows these errors (edited because of it´s length):

|--Github version information: enabled
2021/12/14 20:53:24 INFO routing: default route found: interface eth2, gateway 172.21.0.1
2021/12/14 20:53:24 INFO routing: local ethernet link found: eth1
2021/12/14 20:53:24 INFO routing: local ethernet link found: eth2
2021/12/14 20:53:24 INFO routing: local ethernet link found: eth0
2021/12/14 20:53:24 INFO routing: local ipnet found: 10.0.0.0/24
2021/12/14 20:53:24 INFO routing: local ipnet found: 10.0.10.0/24
2021/12/14 20:53:24 INFO routing: local ipnet found: 172.21.0.0/16
2021/12/14 20:53:24 INFO routing: default route found: interface eth2, gateway 172.21.0.1
2021/12/14 20:53:24 INFO routing: default route found: interface eth2, gateway 172.21.0.1
2021/12/14 20:53:24 INFO routing: deleting route for 0.0.0.0/0
2021/12/14 20:53:24 ERROR routing: cannot reverse routing changes: cannot remove routes for inbound traffic from default IP: cannot delete route: operation not permitted: for subnet 0.0.0.0/0 at interface eth2
2021/12/14 20:53:24 WARN 💡 Tip: Are you passing NET_ADMIN capability to gluetun?
2021/12/14 20:53:24 ERROR cannot setup routing: cannot add routes for inbound traffic from default IP: cannot add rule: cannot add rule: operation not permitted: for rule: ip rule 100: from 172.21.0.28/32 to all table 200
2021/12/14 20:53:24 INFO Shutdown successful

[qdm12]

As the tip says Are you passing NET_ADMIN capability to gluetun? ensure you have the --cap-add=NET_ADMIN flag set in Portainer (I'm not sure how since I don't use it), but it's certainly possible.

[Rakth]

Hi there! Thanks for your reply. Yes netadmin flag is set. I have used a guide from DBtech and then added some flags from your wiki to better suit my needs. I have changed the ports thinking that could have been the problem but I have also tried the default ports suggested in the wiki. There was also an old thread that I found describing a locked down OS missing iptables command but that is not the case here. I ran through the solutions you suggested for that user but that does not apply to my OMV installation. version: "3" services: gluetun: image: qmcgaw/gluetun cap_add: - NET_ADMIN ports: - 8890:8888/tcp # HTTP proxy - 8387:8388/tcp # Shadowsocks - 8389:8388/udp # Shadowsocks volumes: - /srv/dev-disk-by-label-Misc/appdata/gluetun:/gluetun environment: # See https://github.com/qdm12/gluetun/wiki - VPNSP=nordvpn - VPN_TYPE=openvpn # OpenVPN: - OPENVPN_USER=xxxxxxxxxxx - OPENVPN_PASSWORD=xxxxxxx - REGION=Sweden - OPENVPN_PROTOCOL=tcp # Wireguard: # - WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= # - WIREGUARD_ADDRESS=10.64.222.21/32 # Timezone for accurate log times - TZ=Europe/Oslo

…

On Wed, Dec 15, 2021 at 11:35 PM Quentin McGaw ***@***.***> wrote: As the tip says Are you passing NET_ADMIN capability to gluetun? ensure you have the --cap-add=NET_ADMIN flag set in Portainer (I'm not sure how since I don't use it), but it's certainly possible. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#746 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGSYNGVOO6FYTQP3WPV6QMDUREJ3JANCNFSM5KETV6UQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[qdm12]

Yes it's not a kernel problem, you have iptables it's just you have no permission to use it.

Try in the terminal the docker run command equivalent (copy paste from the Nordvpn wiki page) see if it works?

[Rakth]

You mean deploy it from cli instead of portainer? I will try. Thanks a lot for the answer.

…

On Thu, Dec 16, 2021, 08:44 Quentin McGaw ***@***.***> wrote: Yes it's not a kernel problem, you have iptables it's just you have no permission to use it. Try in the terminal the docker run command equivalent (copy paste from the Nordvpn wiki page) see if it works? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#746 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGSYNGTFTZ3ZRQGMB25C2KDURGKETANCNFSM5KETV6UQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[Rakth]

Hi again I've managed to deply via CLI using the following: ``` docker run -d --name gluetun --cap-add=NET_ADMIN -e VPNSP=nordvpn \ -e OPENVPN_USER=xxxxxxx -e OPENVPN_PASSWORD=xxxxxxx \ -e OPENVPN_PROTOCOL=tcp -e REGION=Sweden \ -v /srv/dev-disk-by-label-Misc/appdata/gluetun:/gluetun \ qmcgaw/gluetun ``` It works but I can't seem to route any other application through it. I've tried to use a docker firefox instance as an example using * network_mode: "container:gluetun"* in the stack for firefox and enter the ports used for firefox as parameters in the gluetun container. settings. The same firefox stack is working 100% when not routing through Gluetun. For some reason it doesn't work. I am not blaming your exellent project in any way. Maybe you can write in the Wiki that if users encounter problems using a stack that they should use the CLI to deploy instead of a docker compose yml?

…

On Thu, Dec 16, 2021 at 9:02 AM Mattias Mattisson ***@***.***> wrote: You mean deploy it from cli instead of portainer? I will try. Thanks a lot for the answer. On Thu, Dec 16, 2021, 08:44 Quentin McGaw ***@***.***> wrote: > Yes it's not a kernel problem, you have iptables it's just you have no > permission to use it. > > Try in the terminal the docker run command equivalent (copy paste from > the Nordvpn wiki page) see if it works? > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <#746 (reply in thread)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AGSYNGTFTZ3ZRQGMB25C2KDURGKETANCNFSM5KETV6UQ> > . > Triage notifications on the go with GitHub Mobile for iOS > <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> > or Android > <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. > >

[qdm12]

Hey there, sorry I lost track of this discussion.

So running it from the shell command line works but not without Portainer? That's weird...

Now regarding firefox, maybe that's related the ip routing/rules not being applied properly. You can try to fiddle with https://github.com/qdm12/port-checker if you want to check port can be accessed or not.