ECS queries port `8888` if ingress allows `8888` #1010

NinoSkopac · 2022-05-30T15:59:09Z

NinoSkopac
May 30, 2022

Is this urgent?

Yes

Host OS

Amazon Linux 2 ECS-optimised

CPU arch

aarch64

VPN service provider

Private Internet Access

What are you using to run the container

Other

What is the version of Gluetun

latest in docker hub

What's the problem 🤔

The container keeps restarting if ingress 8888 TCP isn't allowed in a security group.

If I allow 8888, it reaches a steady state. When I delete it, it stops working. All egress is allowed.

It works locally and on EC2 using docker-compose up.

Share your logs

service [OpenvpnClientEcsCdkStack-Service9571FDD8-81c1WQ5PpClR](https://us-east-1.console.aws.amazon.com/ecs/home?region=us-east-1#/clusters/OpenvpnClientEcsCdkStack-ClusterEB0386A7-bSi249yD6pD5/services/OpenvpnClientEcsCdkStack-Service9571FDD8-81c1WQ5PpClR) (instance i-0693254a4b6e23b91) (port 8888) is unhealthy in target-group [Openv-Servi-1FL0A3PFL27JU](https://us-east-1.console.aws.amazon.com/ec2/v2/home?region=us-east-1#TargetGroups:search=arn:aws:elasticloadbalancing:us-east-1:XXXXX:targetgroup/Openv-Servi-1FL0A3PFL27JU/154063a780656037) due to (reason Health checks failed)

Share your configuration

My ENV vars are:


        VPN_SERVICE_PROVIDER: "private internet access",
        OPENVPN_USER: "XXX",
        OPENVPN_PASSWORD: 'XXX',
        SERVER_HOSTNAMES: 'XXX.privacy.network',
        HTTPPROXY: "on",
        HTTPPROXY_LOG: "on",
        HTTPPROXY_STEALTH: "on",
        DNS_KEEP_NAMESERVER: 'on',
        DOT: 'off'

(I had to change DNS configuration, otherwise it doesn't work in ECS.)

qdm12 · 2022-05-30T21:30:16Z

qdm12
May 30, 2022
Maintainer

8888 is used for the http proxy server only. I don't know how allowing it or not on the ecs firewall would crash gluetun. Please share additional information such as logs.

0 replies

NinoSkopac · 2022-05-30T21:53:52Z

NinoSkopac
May 30, 2022
Author

Here you go, sir:

\|   \|       └── OpenVPN server selection settings:
--
\|   \|           ├── Protocol: UDP
\|   \|           └── Private Internet Access encryption preset: strong
\|   └── OpenVPN settings:
\|       ├── OpenVPN version: 2.5
\|       ├── User: [set]
\|       ├── Password: [set]
\|       ├── Private Internet Access encryption preset: strong
\|       ├── Tunnel IPv6: no
\|       ├── Network interface: tun0
\|       ├── Run OpenVPN as: root
\|       └── Verbosity level: 1
├── DNS settings:
\|   ├── DNS server address to use: 127.0.0.1
\|   ├── Keep existing nameserver(s): yes
\|   └── DNS over TLS settings:
\|       └── Enabled: no
├── Firewall settings:
\|   └── Enabled: yes
├── Log settings:
\|   └── Log level: INFO
├── Health settings:
\|   ├── Server listening address: 127.0.0.1:9999
\|   ├── Target address: cloudflare.com:443
\|   └── VPN wait durations:
\|       ├── Initial duration: 6s
\|       └── Additional duration: 5s
├── Shadowsocks server settings:
\|   └── Enabled: no
├── HTTP proxy settings:
\|   ├── Enabled: yes
\|   ├── Listening address: :8888
\|   ├── User:
\|   ├── Password: [not set]
\|   ├── Stealth mode: yes
\|   └── Log: yes
├── Control server settings:
\|   ├── Listening address: :8000
\|   └── Logging: yes
├── OS Alpine settings:
\|   ├── Process UID: 1000
\|   └── Process GID: 1000
├── Public IP settings:
\|   ├── Fetching: every 12h0m0s
\|   └── IP file path: /tmp/gluetun/ip
└── Version settings:
└── Enabled: yes
2022-05-30T21:42:02Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-05-30T21:42:02Z INFO [routing] adding route for 0.0.0.0/0
2022-05-30T21:42:02Z INFO [firewall] setting allowed subnets...
2022-05-30T21:42:02Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-05-30T21:42:02Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2022-05-30T21:42:02Z INFO [pprof] http server listening on [::]:6060
2022-05-30T21:42:02Z INFO [dns over tls] using plaintext DNS at address 1.1.1.1
2022-05-30T21:42:02Z INFO [http server] http server listening on [::]:8000
2022-05-30T21:42:02Z INFO [http proxy] listening on :8888
2022-05-30T21:42:02Z INFO [firewall] allowing VPN connection...
2022-05-30T21:42:02Z INFO [healthcheck] listening on 127.0.0.1:9999
2022-05-30T21:42:02Z INFO [openvpn] OpenVPN 2.5.6 aarch64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Mar 24 2022
2022-05-30T21:42:02Z INFO [openvpn] library versions: OpenSSL 1.1.1o  3 May 2022, LZO 2.10
2022-05-30T21:42:02Z INFO [openvpn] CRL: loaded 1 CRLs from file -----BEGIN X509 CRL-----
2022-05-30T21:42:02Z INFO [openvpn] XXX A SUPER LONG OF CHARS THAT IM REDACTING XXX
2022-05-30T21:42:02Z INFO [openvpn] -----END X509 CRL-----
2022-05-30T21:42:02Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]IP:1197
2022-05-30T21:42:02Z INFO [openvpn] UDP link local: (not bound)
2022-05-30T21:42:02Z INFO [openvpn] UDP link remote: [AF_INET]IP:1197
2022-05-30T21:42:02Z WARN [openvpn] 'link-mtu' is used inconsistently, local='link-mtu 1569', remote='link-mtu 1554'
2022-05-30T21:42:02Z WARN [openvpn] 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
2022-05-30T21:42:02Z WARN [openvpn] 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2022-05-30T21:42:02Z INFO [openvpn] [newyork434] Peer Connection Initiated with [AF_INET]IP:1197
2022-05-30T21:42:02Z INFO [openvpn] TUN/TAP device tun0 opened
2022-05-30T21:42:02Z INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2022-05-30T21:42:02Z INFO [openvpn] /sbin/ip link set dev tun0 up
2022-05-30T21:42:02Z INFO [openvpn] /sbin/ip addr add dev tun0 10.12.110.69/24
2022-05-30T21:42:02Z INFO [openvpn] UID set to nonrootuser
2022-05-30T21:42:02Z INFO [openvpn] Initialization Sequence Completed
2022-05-30T21:42:02Z INFO [ip getter] Public IP address is IP (United States, New York, New York City)
2022-05-30T21:42:02Z ERROR [vpn] cannot get version information: commit not found: 22aedea
2022-05-30T21:42:03Z INFO [healthcheck] healthy!
2022-05-30T21:45:16Z WARN Caught OS signal terminated, shutting down
2022-05-30T21:45:16Z INFO dns ticker: terminated ✔️
2022-05-30T21:45:16Z INFO updater ticker: terminated ✔️
2022-05-30T21:45:16Z INFO http server: terminated ✔️
2022-05-30T21:45:16Z INFO control: terminated ✔️
2022-05-30T21:45:16Z INFO updater: terminated ✔️
2022-05-30T21:45:16Z INFO public IP: terminated ✔️
2022-05-30T21:45:16Z INFO tickers: terminated ✔️
2022-05-30T21:45:16Z INFO HTTP health server: terminated ✔️
2022-05-30T21:45:16Z INFO vpn: terminated ✔️
2022-05-30T21:45:16Z INFO port forwarding: terminated ✔️
2022-05-30T21:45:16Z INFO shadowsocks proxy: terminated ✔️
2022-05-30T21:45:16Z INFO [ip getter] Removing ip file /tmp/gluetun/ip
2022-05-30T21:45:16Z INFO unbound: terminated ✔️
2022-05-30T21:45:16Z INFO public IP: terminated ✔️
2022-05-30T21:45:16Z INFO pprof server: terminated ✔️
2022-05-30T21:45:16Z WARN other: group shutdown timed out: 1 out of 5 goroutines: http proxy: goroutine shutdown timed out: after 400ms ⚠️
2022-05-30T21:45:16Z INFO [routing] routing cleanup...
2022-05-30T21:45:16Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-05-30T21:45:16Z INFO [routing] deleting route for 0.0.0.0/0
2022-05-30T21:45:16Z INFO Shutdown successful

The logs are always like this.

Thank you so much for replying and amazing work on this repo.

0 replies

NinoSkopac · 2022-05-30T21:59:14Z

NinoSkopac
May 30, 2022
Author

ECS events

0 replies

qdm12 · 2022-05-30T23:34:05Z

qdm12
May 30, 2022
Maintainer

I think you might have a healthcheck running, and if it fails, the container runtime sends a kill signal to gluetun (hence Caught OS signal terminated, shutting down). Have a look at your ecs healthcheck setup?

0 replies

NinoSkopac · 2022-05-30T23:57:00Z

NinoSkopac
May 30, 2022
Author

I think so too.

I think it's referring to the health check defined in the Dockerfile and inherited by ECS. I think it's referring to that because I don't have any extra ECS health checks set up.

0 replies

qdm12 · 2022-06-04T14:09:51Z

qdm12
Jun 4, 2022
Maintainer

The Dockerfile healthcheck is documented here and doesn't interact with 8888 at all.

I would say this is due to the publishing of port 8888, and so ECS tries to query that port by default.

I will also convert this from an issue to discussion since it's not a Gluetun bug.

0 replies

NinoSkopac · 2022-06-09T22:56:04Z

NinoSkopac
Jun 9, 2022
Author

Thank you for your input, really appreciate it.

Is there an example for running gluetun on ECS?
Everything's working except the health check.

I'm studying this.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ECS queries port `8888` if ingress allows `8888` #1010

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 7 comments

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

ECS queries port 8888 if ingress allows 8888 #1010

NinoSkopac May 30, 2022

Is this urgent?

Host OS

CPU arch

VPN service provider

What are you using to run the container

What is the version of Gluetun

What's the problem 🤔

Share your logs

Share your configuration

Replies: 7 comments

qdm12 May 30, 2022 Maintainer

NinoSkopac May 30, 2022 Author

NinoSkopac May 30, 2022 Author

qdm12 May 30, 2022 Maintainer

NinoSkopac May 30, 2022 Author

qdm12 Jun 4, 2022 Maintainer

NinoSkopac Jun 9, 2022 Author

ECS queries port `8888` if ingress allows `8888` #1010

NinoSkopac
May 30, 2022

qdm12
May 30, 2022
Maintainer

NinoSkopac
May 30, 2022
Author

NinoSkopac
May 30, 2022
Author

qdm12
May 30, 2022
Maintainer

NinoSkopac
May 30, 2022
Author

qdm12
Jun 4, 2022
Maintainer

NinoSkopac
Jun 9, 2022
Author