will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix gluetun DNS: disable DoT, use k8s coredns as plaintext resolver

Browse Source 
DoT (port 853) to 1.1.1.1 through ProtonVPN VPN tunnel gets TCP RST,
causing gluetun healthcheck to fail (can't resolve github.com /
cloudflare.com). k8s coredns at 10.43.0.10 is reachable via eth0
within FIREWALL_OUTBOUND_SUBNETS, bypassing the VPN for DNS while
letting all other traffic tunnel correctly.

Also rename VPN_ENDPOINT_IP/PORT to WIREGUARD_ENDPOINT_IP/PORT to
suppress gluetun deprecation warnings.
This commit is contained in:
Will Anderson
2026-04-14 21:32:57 -05:00
parent 741191a7e6
commit a1623eda39
2 changed files with 18 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/fornax/worker/base/deployment.yaml
+6 -4
View File
@@ -75,12 +75,14 @@ spec:
value: PLACEHOLDER_PUBLIC_KEY
- name: WIREGUARD_ADDRESSES
value: 10.2.0.2/32
- name: VPN_ENDPOINT_IP
- name: WIREGUARD_ENDPOINT_IP
value: PLACEHOLDER_ENDPOINT_IP
- name: VPN_ENDPOINT_PORT
- name: WIREGUARD_ENDPOINT_PORT
value: "51820"
- name: DNS_KEEP_NAMESERVER
value: "on"
- name: DOT
value: "off"
- name: DNS_ADDRESS
value: "10.43.0.10"
- name: FIREWALL_OUTBOUND_SUBNETS
value: 10.42.0.0/16,10.43.0.0/16
ports:
servers/legion/k8s/media/fornax-workers.yaml
+12 -8
View File
@@ -104,12 +104,14 @@ spec:
value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA="
- name: WIREGUARD_ADDRESSES
value: "10.2.0.2/32"
- name: VPN_ENDPOINT_IP
- name: WIREGUARD_ENDPOINT_IP
value: "95.173.217.29"
- name: VPN_ENDPOINT_PORT
- name: WIREGUARD_ENDPOINT_PORT
value: "51820"
- name: DNS_KEEP_NAMESERVER
value: "on"
- name: DOT
value: "off"
- name: DNS_ADDRESS
value: "10.43.0.10"
- name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16"
volumeMounts:
@@ -316,12 +318,14 @@ spec:
value: "wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo="
- name: WIREGUARD_ADDRESSES
value: "10.2.0.2/32"
- name: VPN_ENDPOINT_IP
- name: WIREGUARD_ENDPOINT_IP
value: "146.70.58.130"
- name: VPN_ENDPOINT_PORT
- name: WIREGUARD_ENDPOINT_PORT
value: "51820"
- name: DNS_KEEP_NAMESERVER
value: "on"
- name: DOT
value: "off"
- name: DNS_ADDRESS
value: "10.43.0.10"
- name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16"
volumeMounts: