PIA: Port forwarding request doesn't run? #533

ghost · 2021-07-25T16:26:49Z

ghost
Jul 25, 2021

Hi there! I have just updated from private-internet-access docker image to gluetun, and I've noticed that even though in my config, I request the port forwarding, the script doesn't run and there's nothing in the log about obtaining the port.

log

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================
Running version latest built on 2021-07-25T00:53:20Z (commit 8105437)

🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
🐛 Bug? https://github.com/qdm12/gluetun/issues/new
✨ New feature? https://github.com/qdm12/gluetun/issues/new
☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
💻 Email? [email protected]
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2021/07/25 17:06:49 INFO Alpine version: 3.14.0
2021/07/25 17:06:49 INFO OpenVPN 2.4 version: 2.4.11
2021/07/25 17:06:49 INFO OpenVPN 2.5 version: 2.5.2
2021/07/25 17:06:49 INFO Unbound version: 1.13.1
2021/07/25 17:06:49 INFO IPtables version: v1.8.7
2021/07/25 17:06:49 INFO Settings summary below:
|--OpenVPN:
   |--Version: 2.5
   |--Verbosity level: 3
   |--Provider:
      |--Private Internet Access settings:
         |--Network protocol: udp
         |--Regions: de berlin
         |--Encryption preset: strong
         |--Port forwarding:
            |--File path: /tmp/gluetun/forwarded_port
|--DNS:
   |--Plaintext address: 1.1.1.1
   |--DNS over TLS:
      |--Unbound:
          |--DNS over TLS providers:
              |--Cloudflare
          |--Listening port: 53
          |--Access control:
              |--Allowed:
                  |--0.0.0.0/0
                  |--::/0
          |--Caching: enabled
          |--IPv4 resolution: enabled
          |--IPv6 resolution: enabled
          |--Verbosity level: 1/5
          |--Verbosity details level: 0/4
          |--Validation log level: 0/2
          |--Username: 
      |--Blacklist:
         |--Blocked categories: malicious, surveillance, ads
         |--Additional IP networks blocked: 9
      |--Update: every 24h0m0s
|--Firewall:
   |--Outbound subnets: 192.168.0.0/24
|--System:
   |--Process user ID: 1000
   |--Process group ID: 1000
   |--Timezone: europe/london
|--Health:
   |--Server address: 127.0.0.1:9999
   |--OpenVPN:
      |--Initial duration: 6s
      |--Addition duration: 5s
|--HTTP control server:
   |--Listening port: 8000
   |--Logging: enabled
|--Public IP getter:
   |--Fetch period: 12h0m0s
   |--IP file: /tmp/gluetun/ip
|--Github version information: enabled
2021/07/25 17:06:49 INFO storage: creating /gluetun/servers.json with 11022 hardcoded servers
2021/07/25 17:06:49 INFO routing: default route found: interface eth0, gateway 172.20.0.1
2021/07/25 17:06:49 INFO routing: local ethernet link found: eth0
2021/07/25 17:06:49 INFO routing: local ipnet found: 172.20.0.0/24
2021/07/25 17:06:49 INFO routing: default route found: interface eth0, gateway 172.20.0.1
2021/07/25 17:06:49 INFO routing: adding route for 0.0.0.0/0
2021/07/25 17:06:49 INFO firewall: firewall disabled, only updating allowed subnets internal list
2021/07/25 17:06:49 INFO routing: default route found: interface eth0, gateway 172.20.0.1
2021/07/25 17:06:49 INFO routing: adding route for 192.168.0.0/24
2021/07/25 17:06:49 INFO openvpn configurator: checking for device /dev/net/tun
2021/07/25 17:06:49 INFO firewall: enabling...
2021/07/25 17:06:50 INFO firewall: enabled successfully
2021/07/25 17:06:50 INFO dns over tls: using plaintext DNS at address 1.1.1.1
2021/07/25 17:06:50 INFO healthcheck: listening on 127.0.0.1:9999
2021/07/25 17:06:50 INFO http server: listening on :8000
2021/07/25 17:06:50 INFO firewall: setting VPN connection through firewall...
2021/07/25 17:06:50 INFO openvpn configurator: starting OpenVPN 2.5
2021/07/25 17:06:50 INFO openvpn: 2021-07-25 17:06:50 DEPRECATED OPTION: ncp-disable. Disabling cipher negotiation is a deprecated debug feature that will be removed in OpenVPN 2.6
2021/07/25 17:06:50 INFO openvpn: OpenVPN 2.5.2 armv7-alpine-linux-musleabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on May  4 2021
2021/07/25 17:06:50 INFO openvpn: library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
2021/07/25 17:06:50 INFO openvpn: CRL: loaded 1 CRLs from file -----BEGIN X509 CRL-----
2021/07/25 17:06:50 INFO openvpn: MIIDWDCCAUAwDQYJKoZIhvcNAQENBQAwgegxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTETMBEGA1UEBxMKTG9zQW5nZWxlczEgMB4GA1UEChMXUHJpdmF0ZSBJbnRlcm5ldCBBY2Nlc3MxIDAeBgNVBAsTF1ByaXZhdGUgSW50ZXJuZXQgQWNjZXNzMSAwHgYDVQQDExdQcml2YXRlIEludGVybmV0IEFjY2VzczEgMB4GA1UEKRMXUHJpdmF0ZSBJbnRlcm5ldCBBY2Nlc3MxLzAtBgkqhkiG9w0BCQEWIHNlY3VyZUBwcml2YXRlaW50ZXJuZXRhY2Nlc3MuY29tFw0xNjA3MDgxOTAwNDZaFw0zNjA3MDMxOTAwNDZaMCYwEQIBARcMMTYwNzA4MTkwMDQ2MBECAQYXDDE2MDcwODE5MDA0NjANBgkqhkiG9w0BAQ0FAAOCAgEAppFfEpGsasjB1QgJcosGpzbf2kfRhM84o2TlqY1ua+Gi5TMdKydA3LJcNTjlI9a0TYAJfeRX5IkpoglSUuHuJgXhP3nEvX10mjXDpcu/YvM8TdE5JV2+EGqZ80kFtBeOq94WcpiVKFTR4fO+VkOK9zwspFfb1cNs9rHvgJ1QMkRUF8PpLN6AkntHY0+6DnigtSaKqldqjKTDTv2OeH3nPoh80SGrt0oCOmYKfWTJGpggMGKvIdvU3vH9+EuILZKKIskt+1dwdfA5Bkz1GLmiQG7+9ZZBQUjBG9Dos4hfX/rwJ3eU8oUIm4WoTz9rb71SOEuUUjP5NPy9HNx2vx+cVvLsTF4ZDZaUztW9o9JmIURDtbeyqxuHN3prlPWB6aj73IIm2dsDQvs3XXwRIxs8NwLbJ6CyEuvEOVCskdM8rdADWx1J0lRNlOJ0Z8ieLLEmYAA834VN1SboB6wJIAPxQU3rcBhXqO9y8aa2oRMg8NxZ5gr+PnKVMqag1x0IxbIgLxtkXQvxXxQHEMSODzvcOfK/nBRBsqTj30P+R87sU8titOoxNeRnBDRNhdEy/QGAqGh62ShPpQUCJdnKRiRTjnil9hMQHevoSuFKeEMO30FQL7BZyo37GFU+q1WPCplVZgCP9hC8Rn5K2+f6KLFo5bhtowSmu+GY1yZtg+RTtsA=
2021/07/25 17:06:50 INFO openvpn: -----END X509 CRL-----
2021/07/25 17:06:50 INFO openvpn: TCP/UDP: Preserving recently used remote address: [AF_INET]154.13.1.70:1197
2021/07/25 17:06:50 INFO openvpn: Socket Buffers: R=[180224->180224] S=[180224->180224]
2021/07/25 17:06:50 INFO openvpn: UDP link local: (not bound)
2021/07/25 17:06:50 INFO openvpn: UDP link remote: [AF_INET]154.13.1.70:1197
2021/07/25 17:06:51 INFO openvpn: TLS: Initial packet from [AF_INET]154.13.1.70:1197, sid=4609788e d0ac83bf
2021/07/25 17:06:51 INFO openvpn: VERIFY OK: depth=1, C=US, ST=CA, L=LosAngeles, O=Private Internet Access, OU=Private Internet Access, CN=Private Internet Access, name=Private Internet Access, [email protected]
2021/07/25 17:06:51 INFO openvpn: VERIFY KU OK
2021/07/25 17:06:51 INFO openvpn: Validating certificate extended key usage
2021/07/25 17:06:51 INFO openvpn: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2021/07/25 17:06:51 INFO openvpn: VERIFY EKU OK
2021/07/25 17:06:51 INFO openvpn: VERIFY OK: depth=0, C=US, ST=CA, L=LosAngeles, O=Private Internet Access, OU=Private Internet Access, CN=berlin420, name=berlin420
2021/07/25 17:06:51 INFO openvpn: Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 4096 bit RSA, signature: RSA-SHA512
2021/07/25 17:06:51 INFO openvpn: [berlin420] Peer Connection Initiated with [AF_INET]154.13.1.70:1197
2021/07/25 17:06:52 INFO openvpn: SENT CONTROL [berlin420]: 'PUSH_REQUEST' (status=1)
2021/07/25 17:06:52 INFO openvpn: PUSH: Received control message: 'PUSH_REPLY,comp-lzo no,redirect-gateway def1,route-ipv6 2000::/3,dhcp-option DNS 10.0.0.243,route-gateway 10.7.110.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.7.110.15 255.255.255.0,peer-id 0'
2021/07/25 17:06:52 INFO openvpn: Pushed option removed by filter: 'route-ipv6 2000::/3'
2021/07/25 17:06:52 INFO openvpn: OPTIONS IMPORT: timers and/or timeouts modified
2021/07/25 17:06:52 INFO openvpn: OPTIONS IMPORT: compression parms modified
2021/07/25 17:06:52 INFO openvpn: OPTIONS IMPORT: --ifconfig/up options modified
2021/07/25 17:06:52 INFO openvpn: OPTIONS IMPORT: route options modified
2021/07/25 17:06:52 INFO openvpn: OPTIONS IMPORT: route-related options modified
2021/07/25 17:06:52 INFO openvpn: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2021/07/25 17:06:52 INFO openvpn: OPTIONS IMPORT: peer-id set
2021/07/25 17:06:52 INFO openvpn: OPTIONS IMPORT: adjusting link_mtu to 1625
2021/07/25 17:06:52 INFO openvpn: Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2021/07/25 17:06:52 INFO openvpn: Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
2021/07/25 17:06:52 INFO openvpn: Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2021/07/25 17:06:52 INFO openvpn: Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
2021/07/25 17:06:52 INFO openvpn: ROUTE_GATEWAY 172.20.0.1/255.255.255.0 IFACE=eth0 HWADDR=02:42:ac:14:00:02
2021/07/25 17:06:52 INFO openvpn: TUN/TAP device tun0 opened
2021/07/25 17:06:52 INFO openvpn: /sbin/ip link set dev tun0 up mtu 1500
2021/07/25 17:06:52 INFO openvpn: /sbin/ip link set dev tun0 up
2021/07/25 17:06:52 INFO openvpn: /sbin/ip addr add dev tun0 10.7.110.15/24
2021/07/25 17:06:52 INFO openvpn: /sbin/ip route add 154.13.1.70/32 via 172.20.0.1
2021/07/25 17:06:52 INFO openvpn: /sbin/ip route add 0.0.0.0/1 via 10.7.110.1
2021/07/25 17:06:52 INFO openvpn: /sbin/ip route add 128.0.0.0/1 via 10.7.110.1
2021/07/25 17:06:52 INFO openvpn: UID set to nonrootuser
2021/07/25 17:06:52 INFO openvpn: Initialization Sequence Completed
2021/07/25 17:06:52 INFO VPN routing IP address: 154.13.1.70
2021/07/25 17:06:52 INFO dns over tls: downloading DNS over TLS cryptographic files
2021/07/25 17:06:53 INFO healthcheck: healthy!
2021/07/25 17:06:54 INFO dns over tls: downloading hostnames and IP block lists
2021/07/25 17:07:01 INFO dns over tls: init module 0: validator
2021/07/25 17:07:01 INFO dns over tls: init module 1: iterator
2021/07/25 17:07:01 INFO dns over tls: start of service (unbound 1.13.1).
2021/07/25 17:07:01 INFO dns over tls: generate keytag query _ta-4a5c-4f66. NULL IN
2021/07/25 17:07:01 INFO dns over tls: generate keytag query _ta-4a5c-4f66. NULL IN
2021/07/25 17:07:02 INFO dns over tls: ready

Result of GET http://192.168.0.77:8001/v1/openvpn/portforwarded

{"port":0}

File is not created either.

Has anything changed recently?

Answered by qdm12

Jul 25, 2021

Maybe, I have reworked a bunch of code recently. Try with qmcgaw/gluetun:v3.20.0 to see if it works?

Anyway thanks for taking the time to post the discussion, I'll investigate and fix my :latest mistake 😉

View full answer

qdm12 · 2021-07-25T23:01:37Z

qdm12
Jul 25, 2021
Maintainer

Maybe, I have reworked a bunch of code recently. Try with qmcgaw/gluetun:v3.20.0 to see if it works?

Anyway thanks for taking the time to post the discussion, I'll investigate and fix my :latest mistake 😉

8 replies

qdm12 Jul 26, 2021
Maintainer

@BrodyStone21 what version are you running? Make sure to re-pull latest since it got fixed only 30 minutes ago.

qdm12 Jul 27, 2021
Maintainer

@manz4rk and/or @BrodyStone21 would you please try running image qmcgaw/gluetun:pf-rework? I have reworked port forwarding quite a lot, it will very likely fail, so that's why I need a PIA subscriber to test it out before merging it in :latest and breaking the world 😄 Thanks!

BrodyStone21 Jul 27, 2021

@qdm12 I actually ended up canceling my PIA membership and switching to Mullvad since they allowed greater control over port forwarding. I'd be happy to try that out though if you'd like me to.

ghost Jul 27, 2021

@qdm12 Of course! Just deployed and got this:

2021/07/27 16:37:10 ERROR port forwarding: cannot allow port through firewall: cannot set allowed port 53542 through interface : failed iptables command "iptables --append INPUT -i  -p tcp --dport 53542 -j ACCEPT": Bad argument `tcp,
Try `iptables -h' or 'iptables --help' for more information.: exit status 2,
2021/07/27 16:37:10 INFO port forwarding: port forwarded is 53542,
2021/07/27 16:37:10 INFO firewall: setting allowed input port 53542 through interface ...,
2021/07/27 16:37:10 INFO port forwarding: writing port file /tmp/gluetun/forwarded_port

qdm12 Jul 27, 2021
Maintainer

No worry @BrodyStone21 I guess it's also quite nice to configure port forwarding through a web UI rather than the ~2k lines of code needed to get a port forwarded with PIA!

As a side note, I'm reworking this as it blocks for me for Wireguard, so exciting times!

@manz4rk nice, thanks! Found the bug, can you try repulling it? Let's continue the discussion on #542 if you don't mind as I can already see 10 repulls ahead 😄

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PIA: Port forwarding request doesn't run? #533

{{title}}

Replies: 1 comment 8 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

PIA: Port forwarding request doesn't run? #533

ghost Jul 25, 2021

Replies: 1 comment · 8 replies

qdm12 Jul 25, 2021 Maintainer

qdm12 Jul 26, 2021 Maintainer

qdm12 Jul 27, 2021 Maintainer

BrodyStone21 Jul 27, 2021

ghost Jul 27, 2021

qdm12 Jul 27, 2021 Maintainer

ghost
Jul 25, 2021

Replies: 1 comment 8 replies

qdm12
Jul 25, 2021
Maintainer

qdm12 Jul 26, 2021
Maintainer

qdm12 Jul 27, 2021
Maintainer

qdm12 Jul 27, 2021
Maintainer