From ef8dc293e5a74c6e0ed7ec55004767c80d32bdcb Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Tue, 14 Apr 2026 22:08:40 -0500 Subject: [PATCH] Set HEALTH_ICMP_TARGET_IPS to WireGuard gateway for periodic health check ProtonVPN does not NAT ICMP to external IPs (1.1.1.1, 8.8.8.8), causing the periodic small health check to always fail and restart the VPN loop. 10.2.0.1 (WireGuard gateway) responds to ICMP at ~28ms and remains reachable as long as the WireGuard tunnel itself is up. --- servers/legion/k8s/fornax/worker/base/deployment.yaml | 2 ++ servers/legion/k8s/media/fornax-workers.yaml | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/servers/legion/k8s/fornax/worker/base/deployment.yaml b/servers/legion/k8s/fornax/worker/base/deployment.yaml index 24a8542..c14b7b9 100644 --- a/servers/legion/k8s/fornax/worker/base/deployment.yaml +++ b/servers/legion/k8s/fornax/worker/base/deployment.yaml @@ -87,6 +87,8 @@ spec: value: "10.43.0.10:53" - name: HEALTH_TARGET_ADDRESS value: "api.protonvpn.ch:443,account.proton.me:443" + - name: HEALTH_ICMP_TARGET_IPS + value: "10.2.0.1" - name: FIREWALL_OUTBOUND_SUBNETS value: 10.42.0.0/16,10.43.0.0/16 ports: diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml index 2f89d6f..faa58fc 100644 --- a/servers/legion/k8s/media/fornax-workers.yaml +++ b/servers/legion/k8s/media/fornax-workers.yaml @@ -116,6 +116,8 @@ spec: value: "10.43.0.10:53" - name: HEALTH_TARGET_ADDRESS value: "api.protonvpn.ch:443,account.proton.me:443" + - name: HEALTH_ICMP_TARGET_IPS + value: "10.2.0.1" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" volumeMounts: @@ -334,6 +336,8 @@ spec: value: "10.43.0.10:53" - name: HEALTH_TARGET_ADDRESS value: "api.protonvpn.ch:443,account.proton.me:443" + - name: HEALTH_ICMP_TARGET_IPS + value: "10.2.0.1" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" volumeMounts: