Container Protonvpn losing connection

General Discussions
,
1

Before I start I want to thank everyone who comes to read my topic, I hope this can help in some way other people.

protonvpn is disconnecting after a while running, fails to verify the connection and does not automatically reconnect. getting into infinite loop on error.

It only manages to make the connection again after I stop the container and after a few minutes I start the container it reconnects and stays in this cycle.

protonvpn docker image

My Docker Compose

Container Log:

[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (3/5) after 2 seconds 
[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (4/5) after 2 seconds 
[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (5/5) after 2 seconds 
[ERROR   ] Failed to verify connection! 
[SUCCESS ] Successfully restored DNS(resolvconf) 
[NOTICE  ] Removing IP rule (IPv4) 
[INFO    ] Removing WireGuard interface 
[NOTICE  ] Skipped validating default IPCHECK_URL 
[INFO    ] Refresing server metadata (for us-free-53.protonvpn.net) 
[SUCCESS ] Successfully refreshed server metadata 
[SUCCESS ] Server us-free-53.protonvpn.net is online 
[SUCCESS ] WIREGUARD_PRIVATE_KEY(oG32u**********) is a valid key 
[SUCCESS ] net.ipv4.conf.all.rp_filter is already set to 2 
[NOTICE  ] Creating WireGuard Interface - protonwire0 
[INFO    ] Setting WireGuard interface address - 10.2.0.2 
[INFO    ] Setting WireGuard interface MTU to 1480 
[SUCCESS ] Configured WireGuard private key 
[INFO    ] WireGuard interface is configured with peer - N1o6VqzZtb0UCQvmkZGQ(146.70.174.66) 
[INFO    ] Bringing WireGuard interface up 
[SUCCESS ] Configured fwmark on WireGuard interface to - 0xca6d 
[NOTICE  ] Creating routes (IPv4) 
[SUCCESS ] Successfully configured DNS (resolvconf) 
[INFO    ] Verifying connection 
[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (1/5) after 2 seconds 
[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (2/5) after 2 seconds 
[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (3/5) after 2 seconds 
[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (4/5) after 2 seconds 
[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (5/5) after 2 seconds 
[ERROR   ] Failed to verify connection!

some possibilities that I questioned, for this problem:

protonvpn servers with maximum connections capacity?

Itā€™s not the problem, this problem occurred on a server that was currently at less than 70% capacity

Multiple protonvpn/wireguard containers, simultaneously connected to the same protonvpn account?

I tested 4 vpn connection containers, during 24hrs, in some cases 2 remained connected and in others only 1.

I did the test with just 1 vpn container and had the same problem. so I discarded multiple connections

If anyone has any idea of ā€‹ā€‹the possible cause of the problem or suggestion of change in compose. Or another alternative to use. Will be Very welcome

2

It seems to be a TLS handshake error. There is an older report mentioning the same error code

There is no answer though.If protonvpn has a verbose mode you can find out more about what domainā€™s TLS is not supported and after that you can try to find out why.

How do you run Docker? Are you using Docker CE or Docker Desktop?

1 Like
3

Thanks for the answer. This error you mentioned, was in an old version of this image for openvpn, current uses wireguard.

the problem seems to be the same to me, which makes me think that maybe itā€™s from the image itself, or some configuration that I didnā€™t do correctly.

would it be this?

Is it possible to put --verbose in compose? or just with docker run?

I am using ubuntu server, docker ce and portainer ce

4

If you scroll down, the README also shows how you can enable debug logs in a compose file using variables.

DEBUG: 1
1 Like
5

Thanks. it only shows curl error 35, searching I know it has to do with SSL. I will never find out what is causing this problem for me.

Iā€™ll have to look for another alternative again. I canā€™t make anything work 100%. Iā€™ve tried Tor, Privoxy/Torā€¦ and nothing.

Iā€™m going to invest some more time in this image, try to discover something new, since it was as far as I could get.

[DEBUG   ] Added route - 232.0.0.0/5 to table 51821 (IPv4) 
[DEBUG   ] KillSwitch is disabled (IPv4) 
[DEBUG   ] Configuring IP rules (IPv4) 
[DEBUG   ] Adding IP rule for Table 51821 (IPv4) 
[TRACE   ] (resolvconf set) mv: can't rename '/etc/resolv.conf.215.openresolv': Resource busy 
[DEBUG   ] Successfully updated /etc/resolv.conf (via resolvconf) 
[SUCCESS ] Successfully configured DNS (resolvconf) 
[INFO    ] Verifying connection 
[DEBUG   ] WireGuard interface - protonwire0 is present 
[DEBUG   ] Connected to peer - tHhN+km281/X+TgM628NVZaa0fMVrUwN1E3e5z99C1Q= 
[DEBUG   ] Connected to server: NL-FREE#354138(nl-free-138.protonvpn.net) 
[DEBUG   ] Not validating country 
[DEBUG   ] Not validating if server supports P2P 
[DEBUG   ] Not validating if server supports Stremaing 
[DEBUG   ] Not validating if server supports Tor 
[DEBUG   ] Not validating if server supports SecureCore 
[DEBUG   ] Allowed ExitIPs  - 169.150.218.21 169.150.218.22 169.150.218.23 169.150.218.24 169.150.218.25 
[DEBUG   ] Checking client IP via https://protonwire-api.vercel.app/v1/client/ip 
[DEBUG   ] Healthcheck curl exit code - 35 
[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (1/5) after 2 seconds 
[DEBUG   ] WireGuard interface - protonwire0 is present 
[DEBUG   ] Connected to peer - tHhN+km281/X+TgM628NVZaa0fMVrUwN1E3e5z99C1Q= 
[DEBUG   ] Connected to server: NL-FREE#354138(nl-free-138.protonvpn.net) 
[DEBUG   ] Not validating country 
[DEBUG   ] Not validating if server supports P2P 
[DEBUG   ] Not validating if server supports Stremaing 
[DEBUG   ] Not validating if server supports Tor 
[DEBUG   ] Not validating if server supports SecureCore 
[DEBUG   ] Allowed ExitIPs  - 169.150.218.21 169.150.218.22 169.150.218.23 169.150.218.24 169.150.218.25 
[DEBUG   ] Checking client IP via https://protonwire-api.vercel.app/v1/client/ip 
[DEBUG   ] Healthcheck curl exit code - 35 
[ERROR   ] curl command exited with 35 
[ERROR   ] Retry (2/5) after 2 seconds 
=====================================================================
[DEBUG   ] METADATA_URL                        : https://protonwire-api.vercel.app/v1/server 
[DEBUG   ] WATCHDOG_USEC is not set or invalid 
[DEBUG   ] __PROTONWIRE_HCR                    : /tmp/protonwire.hc.response 
[DEBUG   ] __PROTONWIRE_SRV_INFO_FILE          : /tmp/protonwire.server.json 
[DEBUG   ] XDG_RUNTIME_DIR                     : NA 
[DEBUG   ] RUNTIME_DIRECTORY                   : NA 
[DEBUG   ] Using resolvconf(8) for DNS (systemd is not available) 
[DEBUG   ] Checking requirements 
[DEBUG   ] Running as container IDENTITY=uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) 
[DEBUG   ] IPCHECK_URL                         : https://protonwire-api.vercel.app/v1/client/ip 
[DEBUG   ] PROTONVPN_SERVER                    : nl-free-138.protonvpn.net 
[INFO    ] Removing WireGuard interface 
[NOTICE  ] Removing IP rule (IPv4) 
[DEBUG   ] Deleting route - 232.0.0.0/5 in table 51821 (IPv4) 
[DEBUG   ] Deleting route - 228.0.0.0/6 in table 51821 (IPv4) 
[DEBUG   ] Deleting route - 226.0.0.0/7 in table 51821 (IPv4) 
[DEBUG   ] Deleting route - 225.0.0.0/8 in table 51821 (IPv4) 
[DEBUG   ] Deleting route - 224.128.0.0/9 in table 51821 (IPv4) 
[DEBUG   ] Deleting route - 224.64.0.0/10 in table 51821 (IPv4) 
[DEBUG   ] Deleting route - 224.16.0.0/12 in table 51821 (IPv4) 
[DEBUG   ] Deleting route - 224.32.0.0/11 in table 51821 (IPv4)
6

Itā€™s not the best option, but at least Iā€™ll be able to use it for now and I wonā€™t need to manually restart the container to reconnect.

Until I come up with a better option, it will do.

import subprocess
import time
from systemd import journal

containers_file = 'containers.txt'
healthcheck_url = 'https://icanhazip.com/'
failed_containers = []

def check_connection(container_name, container_id):
    try:
        command = ['docker', 'exec', container_id, 'curl', '-s', healthcheck_url]
        output = subprocess.check_output(command).decode('utf-8')
        if output.strip() == "":
            journal.send(f"Connection failed for {container_name}")
            failed_containers.append(container_name)
        else:
            journal.send(f"Connection successful for {container_name}")
    except subprocess.CalledProcessError:
        journal.send(f"Connection failed for {container_name}")
        failed_containers.append(container_name)

def restart_container(container_id):
    subprocess.run(['docker', 'stop', container_id])
    time.sleep(120)
    subprocess.run(['docker', 'start', container_id])

def monitor_containers():
    with open(containers_file, 'r') as file:
        for line in file:
            container_info = line.strip().split(':')
            container_name = container_info[0]
            container_id = container_info[1]

            check_connection(container_name, container_id)

            if container_name in failed_containers:
                journal.send(f"Restarting container {container_name} due to connection failure")
                restart_container(container_id)
            else:
                journal.send(f"Skipping restart for {container_name} as connection is successful")

            time.sleep(20)

monitor_containers()