From 7d2cea8402814bffdbd597d71ff9fbfe176bd3e3 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 22 Aug 2026 23:36:51 -0500 Subject: [PATCH] fix(vpn): narrow FIREWALL_OUTBOUND_SUBNETS to 10.0.0.0/16 (PF gateway overlap) PIA's PF gateway 10.31.128.1 sits inside the /8 cluster-pool, so FIREWALL_OUTBOUND_SUBNETS=10.0.0.0/8 made gluetun route it around the tunnel and port forwarding timed out (getSignature to 10.31.128.1:19999). /16 covers actual pod allocations and excludes PIA's 10.31.x. Co-Authored-By: Claude Opus 4.8 --- clusters/base/cluster-vars.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/clusters/base/cluster-vars.yaml b/clusters/base/cluster-vars.yaml index a1773e1..998f5b3 100644 --- a/clusters/base/cluster-vars.yaml +++ b/clusters/base/cluster-vars.yaml @@ -41,8 +41,11 @@ data: PIA_REGION: "SE Stockholm" # operator's choice (Sweden). PIA's OpenVPN region name is # "SE Stockholm" — PF-capable (NOT "SE Streaming Optimized", # which lacks PF; NOT a US region, which also lack PF) - CLUSTER_POD_CIDR: "10.0.0.0/8" # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun - # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel + CLUSTER_POD_CIDR: "10.0.0.0/16" # Gluetun FIREWALL_OUTBOUND_SUBNETS (bypass for steered client pods). + # NARROWED from the /8 cluster-pool: /8 overlaps PIA's tunnel gateway + # 10.31.128.1, so gluetun routed PIA's own PF gateway AROUND the tunnel + # → port forwarding timed out. /16 covers actual pod allocations + # (Cilium assigns /24 per node from 10.0.0.0 up) and excludes 10.31.x. # NOTE: Phase-3 VPN uses PIA's default OpenVPN UDP port + gluetun's server-list UPDATER (the bundled list # was stale, dialing retired IPs). Port/region are not cluster-vars (see gluetun-gateway.yaml). See DECISIONS-LOG.