Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

fix(vpn): PIA OpenVPN port 53 -> 8080 (53 is DNS-intercepted on this network)

Browse Source 
Port 53 also got no PIA replies: this network transparently intercepts outbound
:53, so dig works but OpenVPN-over-53 is swallowed. An NTP/123 probe from the host
returned fine, proving arbitrary non-53 UDP works bidirectionally (so it's
port-specific: 1197 conflict + 53 DNS-intercept, not a UDP block). Move to 8080
(community-verified for PIA, non-DNS, non-1197).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-22 16:39:30 -05:00
1 parent 7a88863f71
commit 4cde690008
4 files changed
+20 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

clusters/base/cluster-vars.yaml
+3 -2
View File
@@ -43,9 +43,10 @@ data:
# which lacks PF; NOT a US region, which also lack PF)
CLUSTER_POD_CIDR: "10.0.0.0/8" # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
# FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel
# NOTE: PIA OpenVPN port is HARDCODED "53" in gluetun-gateway.yaml, not a cluster-var — Flux/kustomize
# NOTE: PIA OpenVPN port is HARDCODED "8080" in gluetun-gateway.yaml, not a cluster-var — Flux/kustomize
# strips quotes around a bare "${VAR}" so a numeric value coerces to int, which k8s rejects for an env
# value (same gotcha as the Longhorn numberOfReplicas fix). See DECISIONS-LOG.
# value (same gotcha as the Longhorn numberOfReplicas fix). 8080 chosen: 1197 conflicts with the home
# OpenVPN server, 53 is DNS-intercepted here; both confirmed by tcpdump. See DECISIONS-LOG.
# --- identity / auth (ADR-0014) ---
KEYCLOAK_REPLICAS: "1" # dev 1 | prod 2 (HA)