savethemanual

After trying everything I could think of, I changed the VPN endpoint to another one and it worked. What a faff. The original endpoint still works on other devices, but just not within this container for some reason. Problem solved bypassed. Thanks for your help anyway @binhex

Thanks for coming back to me so quickly. I've changed the DNS servers to 1.1.1.1 as you suggested. No dice. I changed the unRAID DNS server to be 1.1.1.1. Still no dice. In the console of the container I can ping google.com, and even when I change iptables to allow everything in/out, it still doesn't work. Can't think of anything on the network that would be blocking this...🤷‍♂️ Looking at iptables after container creation, the DNS server isn't in there: [root@2711b8f0133c /]# iptables -L Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- <vpn endpoint> anywhere ACCEPT all -- <vpn endpoint> anywhere ACCEPT all -- <vpn endpoint> anywhere ACCEPT all -- 172.17.0.0/16 172.17.0.0/16 ACCEPT all -- <vpn endpoint> anywhere ACCEPT all -- <vpn endpoint> anywhere ACCEPT all -- <vpn endpoint> anywhere ACCEPT tcp -- anywhere anywhere tcp dpt:8112 ACCEPT udp -- anywhere anywhere udp dpt:8112 ACCEPT tcp -- 192.168.1.0/24 172.17.0.0/16 tcp dpt:58846 ACCEPT icmp -- anywhere anywhere icmp echo-reply ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere <vpn endpoint> ACCEPT all -- anywhere <vpn endpoint> ACCEPT all -- anywhere <vpn endpoint> ACCEPT all -- 172.17.0.0/16 172.17.0.0/16 ACCEPT all -- anywhere <vpn endpoint> ACCEPT all -- anywhere <vpn endpoint> ACCEPT all -- anywhere <vpn endpoint> ACCEPT tcp -- anywhere anywhere tcp spt:8112 ACCEPT udp -- anywhere anywhere udp spt:8112 ACCEPT tcp -- 172.17.0.0/16 192.168.1.0/24 tcp spt:58846 ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere

Thanks for responding @binhex. I'm still stumped though. Most of these check fine, although I'm not sure about the outbound connections through unRaid but I don't have any firewall/network restrictions enabled, and everything else works fine without issue. Any other suggestions would be greatly appreciated. Cause: Out of date ovpn config file containing reference to retired VPN remote server(s). Solution: Download the latest ovpn config file from your VPN provider, place in /config/openvpn/ and restart container. Check: Servers are active and are used on my other systems Cause: Your subscription has run out Solution: Double check this on the vpn providers website. Check: Still actively used Cause: VPN provider has a major outage. Solution: Contact VPN provider to confirm outage and wait for the outage to be resolved. Check: NA Cause: Hardware firewall/router is blocking outbound connections to the vpn providers servers. Solution: Allow outbound connections for the port defined in the VPN providers ovpn file on your firewall/router. Check: No outbound firewall, working across my other devices Cause: Host machine firewall blocking the docker container from connecting to the vpn providers servers. Solution: Allow outbound connections for the port defined in the VPN providers ovpn file on the hosts firewall. Check: Not sure how to definitively check this from the container. I don't have any host firewall enabled, and other services are running fine from my unRaid server Cause: VLAN blocking the connection for the host to the VPN providers servers. Solution: Allow outbound connections for the port defined in the VPN providers ovpn file on your switch. Check: NA Cause: ISP is hijacking DNS lookup and redirecting you to their (spammy) landing page. Solution: Contact ISP and disable DNS redirection, Virgin UK and SKY ISP's have a website where you can disable it. Check: Confirmed I'm using my specified DNS servers Cause: ISP is blocking outbound connections to the VPN providers servers. Solution: Use an IP based ovpn config file instead, this wil circumvent the requirement to do a name lookup. Check: VPN works on other devices on the same network

I've been sick of my sluggish QNAP for some time so I've just moved over to unRAID and I'm loving it. I used to run the delugevpn container on my QNAP and it worked flawlessly, however I've spent hours trying to get it to work in docker on unRAID. It seems that DNS resolution fails once the vpn is connecting, and it fails to connect. (Although it resolves the VPN endpoint as I can see in the logs). VPN config below, with endpoints removed. I had to change the cipher as it was complaining about AES-128-CBC not being available as per your FAQ. name servers were changed to my VPN providers in the config page in unRAID. remote-random remote <vpn1> 12200 remote <vpn1> 26000 remote <vpn1> 88 ;comment the 3 options above and leave only port 53 for better firewall by-passing support ;remote <vpn1> 53 proto udp dev tun tls-client persist-key nobind pull redirect-gateway def1 ;route-delay 3 verb 3 remote-cert-tls server auth SHA256 auth-user-pass credentials.conf cipher AES-128-GCM mute-replay-warnings key-direction 1 explicit-exit-notify 2 persist-remote-ip Console logs showing the stalled state, which then just repeats. 2024-10-17 12:45:39,195 DEBG 'start-script' stdout output: [debug] OpenVPN command line:- /usr/bin/openvpn --reneg-sec 0 --mute-replay-warnings --auth-nocache --setenv VPN_PROV 'custom' --setenv VPN_CLIENT 'openvpn' --setenv DEBUG 'true' --setenv VPN_DEVICE_TYPE 'tun0' --setenv VPN_ENABLED 'yes' --setenv VPN_REMOTE_SERVER 'vpnendpoint.123' --setenv APPLICATION 'deluge' --script-security 2 --writepid /root/openvpn.pid --remap-usr1 SIGHUP --log-append /dev/stdout --pull-filter ignore 'up' --pull-filter ignore 'down' --pull-filter ignore 'route-ipv6' --pull-filter ignore 'ifconfig-ipv6' --pull-filter ignore 'tun-ipv6' --pull-filter ignore 'dhcp-option DNS6' --pull-filter ignore 'persist-tun' --pull-filter ignore 'reneg-sec' --up /root/openvpnup.sh --up-delay --up-restart --keepalive 10 60 --auth-user-pass credentials.conf --cd /config/openvpn --config '/config/openvpn/vpnendpoint-aes128-udp.ovpn' --remote <vpn endpoint> 12200 udp --remote <vpn endpoint> 12200 udp --remote <vpn endpoint> 12200 udp --remote-random [info] Starting OpenVPN (non daemonised)... 2024-10-17 12:45:39,544 DEBG 'start-script' stdout output: 2024-10-17 12:45:39 Note: Kernel support for ovpn-dco missing, disabling data channel offload. 2024-10-17 12:45:39,546 DEBG 'start-script' stdout output: 2024-10-17 12:45:39 WARNING: file 'credentials.conf' is group or others accessible 2024-10-17 12:45:39 OpenVPN 2.6.11 [git:makepkg/ddf6bf6d2a135835+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO] built on Jun 20 2024 2024-10-17 12:45:39,547 DEBG 'start-script' stdout output: 2024-10-17 12:45:39 library versions: OpenSSL 3.3.1 4 Jun 2024, LZO 2.10 2024-10-17 12:45:39 DCO version: N/A 2024-10-17 12:45:39,550 DEBG 'start-script' stdout output: 2024-10-17 12:45:39 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2024-10-17 12:45:39,553 DEBG 'start-script' stdout output: 2024-10-17 12:45:39 TCP/UDP: Preserving recently used remote address: [AF_INET]<vpn endpoint>:12200 2024-10-17 12:45:39 Socket Buffers: R=[212992->212992] S=[212992->212992] 2024-10-17 12:45:39 UDPv4 link local: (not bound) 2024-10-17 12:45:39,554 DEBG 'start-script' stdout output: 2024-10-17 12:45:39 UDPv4 link remote: [AF_INET]<vpn endpoint>:12200 2024-10-17 12:46:39,665 DEBG 'start-script' stdout output: 2024-10-17 12:46:39 [UNDEF] Inactivity timeout (--ping-restart), restarting 2024-10-17 12:46:39,667 DEBG 'start-script' stdout output: 2024-10-17 12:46:39 SIGHUP[soft,ping-restart] received, process restarting 2024-10-17 12:46:39,677 DEBG 'start-script' stdout output: 2024-10-17 12:46:39 Note: Kernel support for ovpn-dco missing, disabling data channel offload. 2024-10-17 12:46:39,678 DEBG 'start-script' stdout output: 2024-10-17 12:46:39 WARNING: file 'credentials.conf' is group or others accessible Looking at resolv.conf I can see all my vpn providers nameservers in there. I'm beginning to think it's an iptables issue which isn't allowing outbound DNS to them as it only shows the VPN endpoint really, no nameservers listed. Perhaps I'm barking up the wrong tree. I do use pihole for DNS, but it doesn't look like the container should use it. I also don't have any outbound firewall filtering going on. DNS works when I disabled the VPN in the container too. Any help would be great appreciated. Cheers