[ip getter] says operation not permitted

[itsfarbod]

I'm trying to use gluetun for connecting my parrot os container to the hack the box vpn for the starting point lab.
but i got some errors from [ip gettter] and warnings from [dns over tls].
The command that i use to run the container:

sudo docker run -it --rm --cap-add=NET_ADMIN \                                                                                                                     1 ↵
-e VPN_SERVICE_PROVIDER=custom -e VPN_TYPE=openvpn \
-v /home/farbod/Desktop/custom.ovpn:/gluetun/custom.conf:ro \
-e OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf qmcgaw/gluetun

And the output:

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================

Running version latest built on 2022-09-14T00:22:08.314Z (commit 875690a)

🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
🐛 Bug? https://github.com/qdm12/gluetun/issues/new
✨ New feature? https://github.com/qdm12/gluetun/issues/new
☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2022-09-14T12:38:46Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-09-14T12:38:46Z INFO [routing] local ethernet link found: eth0
2022-09-14T12:38:46Z INFO [routing] local ipnet found: 172.17.0.0/16
2022-09-14T12:38:46Z INFO [firewall] enabling...
2022-09-14T12:38:46Z INFO [firewall] enabled successfully
2022-09-14T12:38:46Z INFO [storage] creating /gluetun/servers.json with 11721 hardcoded servers
2022-09-14T12:38:46Z INFO Alpine version: 3.16.2
2022-09-14T12:38:47Z INFO OpenVPN 2.4 version: 2.4.12
2022-09-14T12:38:47Z INFO OpenVPN 2.5 version: 2.5.6
2022-09-14T12:38:47Z INFO Unbound version: 1.15.0
2022-09-14T12:38:47Z INFO IPtables version: v1.8.8
2022-09-14T12:38:47Z INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: custom
|   |   └── Server selection settings:
|   |       ├── VPN type: openvpn
|   |       └── OpenVPN server selection settings:
|   |           ├── Protocol: UDP
|   |           └── Custom configuration file: /gluetun/custom.conf
|   └── OpenVPN settings:
|       ├── OpenVPN version: 2.5
|       ├── User: [not set]
|       ├── Password: [not set]
|       ├── Custom configuration file: /gluetun/custom.conf
|       ├── Network interface: tun0
|       ├── Run OpenVPN as: root
|       └── Verbosity level: 1
├── DNS settings:
|   ├── DNS server address to use: 127.0.0.1
|   ├── Keep existing nameserver(s): no
|   └── DNS over TLS settings:
|       ├── Enabled: yes
|       ├── Update period: every 24h0m0s
|       ├── Unbound settings:
|       |   ├── Authoritative servers:
|       |   |   └── cloudflare
|       |   ├── Caching: yes
|       |   ├── IPv6: no
|       |   ├── Verbosity level: 1
|       |   ├── Verbosity details level: 0
|       |   ├── Validation log level: 0
|       |   ├── System user: root
|       |   └── Allowed networks:
|       |       ├── 0.0.0.0/0
|       |       └── ::/0
|       └── DNS filtering settings:
|           ├── Block malicious: yes
|           ├── Block ads: no
|           ├── Block surveillance: no
|           └── Blocked IP networks:
|               ├── 127.0.0.1/8
|               ├── 10.0.0.0/8
|               ├── 172.16.0.0/12
|               ├── 192.168.0.0/16
|               ├── 169.254.0.0/16
|               ├── ::1/128
|               ├── fc00::/7
|               ├── fe80::/10
|               ├── ::ffff:7f00:1/104
|               ├── ::ffff:a00:0/104
|               ├── ::ffff:a9fe:0/112
|               ├── ::ffff:ac10:0/108
|               └── ::ffff:c0a8:0/112
├── Firewall settings:
|   └── Enabled: yes
├── Log settings:
|   └── Log level: INFO
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: cloudflare.com:443
|   ├── Read header timeout: 100ms
|   ├── Read timeout: 500ms
|   └── VPN wait durations:
|       ├── Initial duration: 6s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   └── Logging: yes
├── OS Alpine settings:
|   ├── Process UID: 1000
|   └── Process GID: 1000
├── Public IP settings:
|   ├── Fetching: every 12h0m0s
|   └── IP file path: /tmp/gluetun/ip
└── Version settings:
    └── Enabled: yes
2022-09-14T12:38:47Z INFO IPv6 is not supported
2022-09-14T12:38:47Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-09-14T12:38:47Z INFO [routing] adding route for 0.0.0.0/0
2022-09-14T12:38:47Z INFO [firewall] setting allowed subnets...
2022-09-14T12:38:47Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-09-14T12:38:47Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2022-09-14T12:38:47Z INFO [pprof] http server listening on [::]:6060
2022-09-14T12:38:47Z INFO [dns over tls] using plaintext DNS at address 1.1.1.1
2022-09-14T12:38:47Z INFO [http server] http server listening on [::]:8000
2022-09-14T12:38:47Z INFO [healthcheck] listening on 127.0.0.1:9999
2022-09-14T12:38:47Z INFO [firewall] allowing VPN connection...
2022-09-14T12:38:47Z INFO [openvpn] 2022-09-14 12:38:47 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2022-09-14T12:38:47Z INFO [openvpn] OpenVPN 2.5.6 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 17 2022
2022-09-14T12:38:47Z INFO [openvpn] library versions: OpenSSL 1.1.1q  5 Jul 2022, LZO 2.10
2022-09-14T12:38:47Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]23.19.62.79:1337
2022-09-14T12:38:47Z INFO [openvpn] UDP link local: (not bound)
2022-09-14T12:38:47Z INFO [openvpn] UDP link remote: [AF_INET]23.19.62.79:1337
2022-09-14T12:38:48Z INFO [openvpn] [htb] Peer Connection Initiated with [AF_INET]23.19.62.79:1337
2022-09-14T12:38:48Z INFO [openvpn] TUN/TAP device tun0 opened
2022-09-14T12:38:48Z INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2022-09-14T12:38:49Z INFO [openvpn] /sbin/ip link set dev tun0 up
2022-09-14T12:38:49Z INFO [openvpn] /sbin/ip addr add dev tun0 10.10.14.84/23
2022-09-14T12:38:49Z INFO [openvpn] UID set to nonrootuser
2022-09-14T12:38:49Z INFO [openvpn] Initialization Sequence Completed
2022-09-14T12:38:49Z INFO [dns over tls] downloading DNS over TLS cryptographic files
2022-09-14T12:38:49Z WARN [dns over tls] cannot update files: Get "https://www.internic.net/domain/named.root": dial tcp: lookup www.internic.net on 1.1.1.1:53: write udp 172.17.0.2:58784->1.1.1.1:53: write: operation not permitted
2022-09-14T12:38:49Z INFO [dns over tls] attempting restart in 10s
2022-09-14T12:38:49Z ERROR [ip getter] Get "https://ipinfo.io/": dial tcp: lookup ipinfo.io on 1.1.1.1:53: write udp 172.17.0.2:55146->1.1.1.1:53: write: operation not permitted
2022-09-14T12:38:49Z INFO [ip getter] retrying in 5s
2022-09-14T12:38:49Z ERROR [vpn] cannot get version information: Get "https://api.github.com/repos/qdm12/gluetun/commits": dial tcp: lookup api.github.com on 1.1.1.1:53: write udp 172.17.0.2:42715->1.1.1.1:53: write: operation not permitted
2022-09-14T12:38:53Z INFO [healthcheck] program has been unhealthy for 6s: restarting VPN
2022-09-14T12:38:53Z INFO [vpn] stopping
2022-09-14T12:38:53Z INFO [vpn] starting
2022-09-14T12:38:53Z INFO [firewall] allowing VPN connection...
2022-09-14T12:38:53Z INFO [openvpn] 2022-09-14 12:38:53 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2022-09-14T12:38:53Z INFO [openvpn] OpenVPN 2.5.6 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 17 2022
2022-09-14T12:38:53Z INFO [openvpn] library versions: OpenSSL 1.1.1q  5 Jul 2022, LZO 2.10
2022-09-14T12:38:53Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]23.19.62.79:1337
2022-09-14T12:38:53Z INFO [openvpn] UDP link local: (not bound)
2022-09-14T12:38:53Z INFO [openvpn] UDP link remote: [AF_INET]23.19.62.79:1337
2022-09-14T12:38:54Z INFO [openvpn] [htb] Peer Connection Initiated with [AF_INET]23.19.62.79:1337
2022-09-14T12:38:54Z INFO [openvpn] TUN/TAP device tun0 opened
2022-09-14T12:38:54Z INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2022-09-14T12:38:54Z INFO [openvpn] /sbin/ip link set dev tun0 up
2022-09-14T12:38:54Z INFO [openvpn] /sbin/ip addr add dev tun0 10.10.14.84/23
2022-09-14T12:38:54Z ERROR [ip getter] Get "https://ipinfo.io/": dial tcp: lookup ipinfo.io on 1.1.1.1:53: write udp 172.17.0.2:43113->1.1.1.1:53: write: operation not permitted
2022-09-14T12:38:54Z INFO [ip getter] retrying in 5s
2022-09-14T12:38:54Z INFO [openvpn] UID set to nonrootuser
2022-09-14T12:38:54Z INFO [openvpn] Initialization Sequence Completed
2022-09-14T12:38:59Z INFO [dns over tls] downloading DNS over TLS cryptographic files
2022-09-14T12:38:59Z WARN [dns over tls] cannot update files: Get "https://www.internic.net/domain/named.root": dial tcp: lookup www.internic.net on 1.1.1.1:53: write udp 172.17.0.2:57582->1.1.1.1:53: write: operation not permitted
2022-09-14T12:38:59Z INFO [dns over tls] attempting restart in 20s
2022-09-14T12:38:59Z ERROR [ip getter] Get "https://ipinfo.io/": dial tcp: lookup ipinfo.io on 1.1.1.1:53: write udp 172.17.0.2:44373->1.1.1.1:53: write: operation not permitted
2022-09-14T12:38:59Z INFO [ip getter] retrying in 5s
2022-09-14T12:39:04Z ERROR [ip getter] Get "https://ipinfo.io/": dial tcp: lookup ipinfo.io on 1.1.1.1:53: write udp 172.17.0.2:46550->1.1.1.1:53: write: operation not permitted
2022-09-14T12:39:04Z INFO [ip getter] retrying in 5s
2022-09-14T12:39:04Z INFO [healthcheck] program has been unhealthy for 11s: restarting VPN
2022-09-14T12:39:04Z INFO [vpn] stopping
2022-09-14T12:39:04Z INFO [vpn] starting
2022-09-14T12:39:04Z INFO [firewall] allowing VPN connection...
2022-09-14T12:39:04Z INFO [openvpn] 2022-09-14 12:39:04 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2022-09-14T12:39:04Z INFO [openvpn] OpenVPN 2.5.6 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 17 2022
2022-09-14T12:39:04Z INFO [openvpn] library versions: OpenSSL 1.1.1q  5 Jul 2022, LZO 2.10
2022-09-14T12:39:04Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]23.19.62.79:1337
2022-09-14T12:39:04Z INFO [openvpn] UDP link local: (not bound)
2022-09-14T12:39:04Z INFO [openvpn] UDP link remote: [AF_INET]23.19.62.79:1337
2022-09-14T12:39:05Z INFO [openvpn] [htb] Peer Connection Initiated with [AF_INET]23.19.62.79:1337
2022-09-14T12:39:05Z INFO [openvpn] TUN/TAP device tun0 opened
2022-09-14T12:39:05Z INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2022-09-14T12:39:05Z INFO [openvpn] /sbin/ip link set dev tun0 up
2022-09-14T12:39:05Z INFO [openvpn] /sbin/ip addr add dev tun0 10.10.14.84/23
2022-09-14T12:39:05Z INFO [openvpn] UID set to nonrootuser
2022-09-14T12:39:05Z INFO [openvpn] Initialization Sequence Completed
2022-09-14T12:39:09Z ERROR [ip getter] Get "https://ipinfo.io/": dial tcp: lookup ipinfo.io on 1.1.1.1:53: write udp 172.17.0.2:35701->1.1.1.1:53: write: operation not permitted
2022-09-14T12:39:09Z INFO [ip getter] retrying in 5s
^C
2022-09-14T12:39:11Z WARN Caught OS signal interrupt, shutting down
2022-09-14T12:39:11Z INFO http server: terminated ✔️
2022-09-14T12:39:11Z INFO updater ticker: terminated ✔️
2022-09-14T12:39:11Z INFO dns ticker: terminated ✔️
2022-09-14T12:39:11Z INFO control: terminated ✔️
2022-09-14T12:39:11Z INFO updater: terminated ✔️
2022-09-14T12:39:11Z INFO public IP: terminated ✔️
2022-09-14T12:39:11Z INFO tickers: terminated ✔️
2022-09-14T12:39:11Z INFO HTTP health server: terminated ✔️
2022-09-14T12:39:11Z INFO vpn: terminated ✔️
2022-09-14T12:39:11Z INFO port forwarding: terminated ✔️
2022-09-14T12:39:11Z INFO shadowsocks proxy: terminated ✔️
2022-09-14T12:39:11Z INFO [dns over tls] downloading DNS over TLS cryptographic files
2022-09-14T12:39:11Z INFO public IP: terminated ✔️
2022-09-14T12:39:11Z INFO http proxy: terminated ✔️
2022-09-14T12:39:11Z INFO unbound: terminated ✔️
2022-09-14T12:39:11Z INFO pprof server: terminated ✔️
2022-09-14T12:39:11Z INFO other: terminated ✔️
2022-09-14T12:39:11Z INFO [routing] routing cleanup...
2022-09-14T12:39:11Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.2
2022-09-14T12:39:11Z INFO [routing] deleting route for 0.0.0.0/0
2022-09-14T12:39:11Z INFO Shutdown successful

The vpn doesn't need username and password to connect.
And this is the .ovpn file for the vpn:
custom.ovpn.txt

[itsfarbod]

I tried to connect to a normal custom OpenVPN server and it worked fine.
Its seems Hack the box lab VPN is limiting the connections to its own network.
Here is a link about their lab and VPN: https://help.hackthebox.com/en/articles/5185687-introduction-to-lab-access.
for DNS Over TLS i tried to disable it with -e DOT=no and it worked and i got rid of warning.
But after connecting to VPN the Gluetun can not access the ipinfo.io to get the ip information.
by receiving errors from ip getter the healthcheck considers container unhealthy and after several attempts stopes the VPN and tries again.
Having an option to disable ip getter would be helpful.
Also i think that after receiving the address information, the program will try to check the health of the connection with healthchecker and then there will be another problem.

[qdm12]

Its seems Hack the box lab VPN is limiting the connections to its own network.

Oh ok bummer, thanks for reporting this.

by receiving errors from ip getter the healthcheck considers container unhealthy and after several attempts stopes the VPN and tries again.

No healthcheck is independent and queries cloudflare.com:443 instead (see the wiki).

Having an option to disable ip getter would be helpful.

Indeed, can you please create an issue for this? Thanks!

[uberroot4]

@qdm12 Are there any updates on this? I have pretty much the same situation as the original author. Connection the the VPN can be established successfully, I can ping the DNS and internal IP addresses added by the VPN server. resolv.conf seems also to be correctly altered. Literally tried my luck on everything I found yesterday without any luck so far