SSL-handshake syscall: Connection refused

[olvier]

Dear folks,

i would appreciate your help :)
First i tried with the TLDR configuration of "perfect privacy". Handling with the same error,
i've read many wikis and issues here, and tried some environmental variables.
Without any luck.

I'll get a new IP, and also the right port is communicated (torrenting linux images),
but i'm still "not connectable" and have no idea why.
I guess is has sth to do with the following problems mentioned in the logs.

Here are the logs of portainer/docker

2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z ERROR [dns over tls] SSL_handshake syscall: Connection refused
2022-09-10T18:05:09Z INFO [healthcheck] unhealthy: cannot dial: dial tcp4: lookup cloudflare.com on 192.168.0.1:53: server misbehaving
2022-09-10T18:05:13Z INFO [dns over tls] falling back on plaintext DNS at address 1.1.1.1
2022-09-10T18:05:13Z WARN [dns over tls] DNS is not working: after 10 tries: lookup github.com on 192.168.0.1:53: server misbehaving
2022-09-10T18:05:13Z INFO [dns over tls] attempting restart in 1m20s
2022-09-10T18:05:14Z INFO [healthcheck] healthy!

Here is my docker creating routine

docker run \
--name=vpn_qmcgaw-gluetun \
--cap-add=NET_ADMIN \
-e VPN_SERVICE_PROVIDER="perfect privacy" \
-e OPENVPN_USER=pp1234567 -e OPENVPN_PASSWORD=1234567890 \
-e SERVER_CITIES=Rotterdam \
-e OPENVPN_PROTOCOL=udp \
-e VPN_TYPE=openvpn \
-e VPN_INTERFACE=tun0 \
-e OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf \
-v /volume1/docker/openvpn-client/vpn/Rotterdam1.conf:/gluetun/custom.conf:ro \
-v /volume1/docker/openvpn-client/vpn/ca.crt:/gluetun/ca.crt:ro \
-p 32768:32768 \
-p 32769:32769 \
-p 32779:32779 \
qmcgaw/gluetun

The added variables from wikis are the following, but w/o those the behavior isn't different.

-e OPENVPN_PROTOCOL=udp \
-e VPN_TYPE=openvpn \
-e VPN_INTERFACE=tun0 \
-e OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf \
-v /volume1/docker/openvpn-client/vpn/Rotterdam1.conf:/gluetun/custom.conf:ro \
-v /volume1/docker/openvpn-client/vpn/ca.crt:/gluetun/ca.crt:ro \

[olvier]

After going back to "untouched mode", there are still the same errors.

[olvier]

I wrote the mail 2-3 days ago, did you received it? Otherwise it's maybe in the SPAM-Folder ;) Whould be great to hearing back from you!

First of all: have a nice weekend :)

[qdm12]

Hello, I searched for it, maybe send me your email address so i can search better 😄 I'm not gonna lie I have a pile of gluetun related emails & notification emails coming everyday so it's hard to keep track!

[qdm12]

Never mind just found it now!

[qdm12]

Got the same errors... but my setup also works on various other providers (mullvad, airvpn most recently).

Now the even weirder thing is with DOT=off, I can nslookup github.com, but nslookup ipinfo.io fails.
What I think is happening is perfect privacy block DNS over TLS (port 853 TCP), and they intercept and filter your unencrypted DNS traffic (dumb traffic to 1.1.1.1 on port 53 UDP).

If they advertise it on their website that it's for your protection, sure I guess (although blocking DoT sucks).
If they don't, it's rather sketchy; this is like blocking https and only allowing http so they can manipulate your traffic (potentially spy on you too). I would send an email to their support 😢

[olvier]

hey,

thanks you for your time in failure analysis!

I played i little bit around and had killed those TrackStop-Filters in perfect privacy.
Now, your container instantly obtained the ip and was able to connect w/o any error.

Unfortunately, the port is still closed, while checking it with port-checker.
I would be really happy, if you could take a look to it, again O:). Do you find any curious behaviour?

Hopeful greetings

[olvier]

I played i little bit around and had killed those TrackStop-Filters in perfect privacy. Now, your container instantly obtained the ip and was able to connect w/o any error.

This solved the error mentioned here in #1144

I checked all three, and I had to disable all

• Tracking & Advertising Filter
• Fraud Filter
• Fake News Filter