Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: New DNS not resolving #2442

Closed
epd5 opened this issue Aug 26, 2024 · 14 comments
Closed

Bug: New DNS not resolving #2442

epd5 opened this issue Aug 26, 2024 · 14 comments

Comments

@epd5
Copy link

epd5 commented Aug 26, 2024

Is this urgent?

Yes

Host OS

Debian 12

CPU arch

x86_64

VPN service provider

AirVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2024-08-25T07:04:32.409Z (commit 01fa993)

What's the problem 🤔

The new DNS system doesn't seem to be resolving.
Bizarrely my P2P client could make some connections. My shadowsocks client that uses Gluetuns DNS however couldn't resolve any addresses. Reverting to v3.39 resolves issue (Unbound).
Running

Share your logs (at least 10 lines)

2024-08-26T19:54:28+01:00 INFO [dns] using plaintext DNS at address 9.9.9.9
2024-08-26T19:54:28+01:00 INFO [http server] http server listening on [::]:8000
2024-08-26T19:54:28+01:00 INFO [healthcheck] listening on 127.0.0.1:9999
2024-08-26T19:54:28+01:00 INFO [firewall] allowing VPN connection...
2024-08-26T19:54:28+01:00 INFO [wireguard] Using available kernelspace implementation
2024-08-26T19:54:28+01:00 INFO [wireguard] Connecting to 185.156.175.34:1637
2024-08-26T19:54:28+01:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2024-08-26T19:54:28+01:00 INFO [firewall] setting allowed input port 7262 through interface tun0...
2024-08-26T19:54:28+01:00 INFO [firewall] setting allowed input port 5055 through interface tun0...
2024-08-26T19:54:28+01:00 INFO [dns] downloading hostnames and IP block lists
2024-08-26T19:54:28+01:00 INFO [dns] DNS server listening on [::]:53
2024-08-26T19:54:28+01:00 INFO [healthcheck] healthy!
2024-08-26T19:54:30+01:00 WARN [dns] exchanging over DoT connection: read tcp 10.167.133.39:48128->9.9.9.9:853: i/o timeout
2024-08-26T19:54:30+01:00 WARN [dns] exchanging over DoT connection: read tcp 10.167.133.39:48142->9.9.9.9:853: i/o timeout
2024-08-26T19:54:32+01:00 WARN [dns] exchanging over DoT connection: read tcp 10.167.133.39:36718->149.112.112.9:853: i/o timeout
2024-08-26T19:54:34+01:00 WARN [dns] exchanging over DoT connection: read tcp 10.167.133.39:36730->149.112.112.9:853: i/o timeout
2024-08-26T19:54:36+01:00 WARN [dns] exchanging over DoT connection: read tcp 10.167.133.39:48176->9.9.9.9:853: i/o timeout
2024-08-26T19:54:37+01:00 WARN [dns] exchanging over DoT connection: read tcp 10.167.133.39:36782->149.112.112.9:853: i/o timeout
2024-08-26T19:54:37+01:00 WARN [dns] exchanging over DoT connection: read tcp 10.167.133.39:48222->9.9.9.9:853: i/o timeout
2024-08-26T19:54:37+01:00 WARN [dns] exchanging over DoT connection: read tcp 10.167.133.39:48232->9.9.9.9:853: i/o timeout
2024-08-26T19:54:38+01:00 WARN [dns] exchanging over DoT connection: read tcp 10.167.133.39:36816->149.112.112.9:853: i/o timeout

Share your configuration

gluetun:
          image: qmcgaw/gluetun:latest
          container_name: redacted
          hostname: redacted
          cap_add:
               - NET_ADMIN
          networks:
               redacted:
                    ipv4_address: redacted
               redacted:
          devices:
               - /dev/net/tun:/dev/net/tun
          volumes:
               - ./gluetun:/gluetun
          environment:
               - PUID=redacted
               - PGID=redacted
               - TZ=redacted
               - VPN_SERVICE_PROVIDER=airvpn
               - VPN_TYPE=wireguard
               - WIREGUARD_PRIVATE_KEY=redacted
               - WIREGUARD_PRESHARED_KEY=redacted
               - WIREGUARD_ADDRESSES=redacted
               - WIREGUARD_MTU=1424
               - WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=30s
               - SERVER_COUNTRIES=redacted
               - HTTP_CONTROL_SERVER_LOG=off
               - DOT=on
               - DOT_PROVIDERS=quad9
               - DOT_CACHING=off
               - DNS_UPDATE_PERIOD=24h
               - BLOCK_MALICIOUS=false
               - BLOCK_SURVEILLANCE=false
               - BLOCK_ADS=false
               - SHADOWSOCKS=off
               - FIREWALL_VPN_INPUT_PORTS=redacted
               - FIREWALL_OUTBOUND_SUBNETS=redacted
               - HEALTH_TARGET_ADDRESS=quad9.net:443 
               - HEALTH_VPN_DURATION_INITIAL=120s
               - UPDATER_PERIOD=24h
          restart: unless-stopped
Copy link
Contributor

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

@qdm12
Copy link
Owner

qdm12 commented Aug 28, 2024

If you comment out DOT_PROVIDERS does it work then? 🤔

@epd5
Copy link
Author

epd5 commented Aug 28, 2024

Can confirm removing DOT_PROVIDERS solved the issue.
Spun up a container with a very basic config, once I added in DOT_PROVIDERS it stopped being able to resolve.
Thanks for all your hard work!

Update: So this worked, but removing DOT_PROVIDERS from my original gluetun container has no effect on the issue. Will continue troubleshooting.

Update 2: Still receiving timeout / no route DOT errors when I set up a basic gluetun + linuxserver/firefox container setup. Guess that means it's a VPN / Debian 12 error/conflict. If I have time I'll troubleshoot those variables. Enabling/disabling UFW in Debian had no effect.

@poland153
Copy link

poland153 commented Aug 31, 2024

funny, i switched my wireguard custom config from torguard to protonvpn today, and also noticed the same DoT messages. I do have port forwarding on to let it figure itself out with protonvpn NAT, lets qbittorrent connect with UPnP/NAT I assume since torrents resolve hostnames (when they didnt before) and i get a solid connected green with good upload/download activity.

2024-08-31T00:29:34-05:00 INFO [ip getter] Public IP address is <redacted> (<redacted>, <redacted>, <redacted>)
2024-08-31T00:29:37-05:00 INFO [vpn] You are running 1 commit behind the most recent latest
2024-08-31T00:29:37-05:00 INFO [port forwarding] starting
2024-08-31T00:29:37-05:00 INFO [port forwarding] gateway external IPv4 address is <redacted>
2024-08-31T00:29:38-05:00 INFO [port forwarding] port forwarded is 56160
2024-08-31T00:29:38-05:00 INFO [firewall] setting allowed input port 56160 through interface tun0...
2024-08-31T00:29:38-05:00 INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2024-08-31T00:30:02-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:59162->1.1.1.1:853: i/o timeout
2024-08-31T00:31:20-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:43932->1.0.0.1:853: i/o timeout
2024-08-31T00:31:20-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:34522->1.1.1.1:853: i/o timeout
2024-08-31T00:31:46-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:44042->1.0.0.1:853: i/o timeout
2024-08-31T00:32:13-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:38656->1.1.1.1:853: i/o timeout
2024-08-31T01:48:21-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:53602->1.0.0.1:853: i/o timeout
2024-08-31T01:48:22-05:00 INFO [healthcheck] healthy!
2024-08-31T02:08:35-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:37972->1.1.1.1:853: i/o timeout
2024-08-31T02:08:37-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:54474->1.0.0.1:853: i/o timeout
2024-08-31T02:10:12-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:55938->1.1.1.1:853: i/o timeout
2024-08-31T02:10:12-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:55940->1.1.1.1:853: i/o timeout
2024-08-31T02:10:14-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:55252->1.1.1.1:853: i/o timeout
2024-08-31T02:10:14-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:37082->1.0.0.1:853: i/o timeout
2024-08-31T02:12:44-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:42176->1.1.1.1:853: i/o timeout
2024-08-31T02:12:44-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:42174->1.1.1.1:853: i/o timeout
2024-08-31T02:12:46-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:42192->1.1.1.1:853: i/o timeout
2024-08-31T02:15:48-05:00 WARN [dns] exchanging over DoT connection: read tcp 10.2.0.2:56342->1.1.1.1:853: i/o timeout

@qdm12
Copy link
Owner

qdm12 commented Sep 1, 2024

To be fair, it's fine if it happens from time to time. Unbound would simply not log these out. If your resolution would mostly not work that would be problematic, but it seems fine. Anyway, resolvers (OS, browser etc.) usually retry on a dns error.

I was thinking about logging these errors at the debug level, but in the end I didn't notice it happening much on my end within 24h so left it to warnings. Maybe it's worth having them at the debug level 🤔

@github-staff github-staff deleted a comment from masooddahmedd Sep 10, 2024
@github-staff github-staff deleted a comment from masooddahmedd Sep 10, 2024
@epd5
Copy link
Author

epd5 commented Sep 11, 2024

So I had to disable Pi-Holes DNSSEC validation, that was the error I made. After a few minutes DNS started resolving, even with the timeout / no route to host errors appearing in the Gluetun log
Another finding I had though was using Gluetuns shadowsocks feature it was getting connection refused on ::53,, I assume thats just a missing iptables entry easily fixed.

@MicahBird
Copy link

MicahBird commented Sep 24, 2024

I'm likewise having this issue and would appreciate any guidance. Although my case is a bit different, as I'm running Gluetun as a sidecar container in K8s. What is especially odd is that I'm able to curl and nslookup from the connected container's shells, but any DNS query made by the container's themselves fails. Any thoughts?
Env variables:

  DOT: "on"
  DOT_PROVIDERS: "quad9"

Edit: I've been able to workaround it by rolling back to the v3.39 image.

@eiqnepm
Copy link
Contributor

eiqnepm commented Oct 17, 2024

I'm likewise having this issue and would appreciate any guidance. Although my case is a bit different, as I'm running Gluetun as a sidecar container in K8s. What is especially odd is that I'm able to curl and nslookup from the connected container's shells, but any DNS query made by the container's themselves fails. Any thoughts? Env variables:

  DOT: "on"
  DOT_PROVIDERS: "quad9"

Edit: I've been able to workaround it by rolling back to the v3.39 image.

I am also having this issue and the rollback also works for me.
I am running the latest version of Docker on a Debian 12 host.

compose.yaml

services:
  gluetun:
    cap_add:
      - NET_ADMIN
    container_name: gluetun
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - SERVER_COUNTRIES=👀
      - VPN_SERVICE_PROVIDER=surfshark
      - VPN_TYPE=wireguard
      - WIREGUARD_ADDRESSES=👀
      - WIREGUARD_PRIVATE_KEY=👀
      - HEALTH_TARGET_ADDRESS=127.0.0.1:9999
    image: ghcr.io/qdm12/gluetun:v3.39
    labels:
      - traefik.enable=true

      - traefik.http.routers.qbittorrent.entryPoints=webSecure
      - traefik.http.routers.qbittorrent.rule=Host(`qbittorrent.👀`)
      - traefik.http.services.qbittorrent.loadBalancer.server.port=8080
      - traefik.http.routers.qbittorrent.service=qbittorrent
    networks:
      - gluetun
    restart: unless-stopped
    volumes:
      - ./gluetun:/gluetun

@joshoohaah
Copy link

encountered this issue as well this week. Was trying various different VPNS (proton, PIA, Surfshark). Then messing with DOT turning on and off. having DOT OFF seemed to alleviate pieces.

However, reverting back to 3.39.1 version of gluetun container solved all issues.

@Mr-Hubiverse
Copy link

Is this fixed yet? been a sec and this makes the program worthless.

@eiqnepm
Copy link
Contributor

eiqnepm commented Dec 5, 2024

Is this fixed yet? been a sec and this makes the program worthless.

I know it doesn't solve the issue, but you can set the DOT environment variable to off in the meantime until this is fixed. You can also set DNS_ADDRESS to something like 9.9.9.9.

@Haych13
Copy link

Haych13 commented Dec 9, 2024

So I had to disable Pi-Holes DNSSEC validation

I just disabled AdGuard Home DNSSEC, restarted Gluetun and it's working perfectly now (so far)

@epd5
Copy link
Author

epd5 commented Dec 26, 2024

Revisited today due to the latest v3.4. Disabled specifying DOT_PROVIDERS= quad9, quadrant & no longer getting timeout errors.

@epd5 epd5 closed this as completed Dec 26, 2024
Copy link
Contributor

Closed issues are NOT monitored, so commenting here is likely to be not seen.
If you think this is still unresolved and have more information to bring, please create another issue.

This is an automated comment setup because @qdm12 is the sole maintainer of this project
which became too popular to monitor issues closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

13 participants