Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

fix(vpn): PIA OpenVPN port 53 -> 8080 (53 is DNS-intercepted on this network)

Browse Source 
Port 53 also got no PIA replies: this network transparently intercepts outbound
:53, so dig works but OpenVPN-over-53 is swallowed. An NTP/123 probe from the host
returned fine, proving arbitrary non-53 UDP works bidirectionally (so it's
port-specific: 1197 conflict + 53 DNS-intercept, not a UDP block). Move to 8080
(community-verified for PIA, non-DNS, non-1197).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-22 16:39:30 -05:00
1 parent 7a88863f71
commit 4cde690008
4 files changed
+20 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform/kustomization.yaml
+3 -3
View File
@@ -17,9 +17,9 @@ resources:
- cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
- externaldns # auto DNS records — needs SOPS `cloudflare-api-token`
- gateway # Gateway API listeners (ingress; replaces Traefik)
# ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 53, ADR-0013 amendment).
# NOT PIA's default 1197 — this home network NATs its own OpenVPN server on WAN:1197, which
# collided with the outbound PIA-on-1197 flow (tcpdump-confirmed; DECISIONS-LOG). ----
# ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 8080, ADR-0013 amendment).
# NOT 1197 (home NATs its own OpenVPN server there) and NOT 53 (network intercepts DNS/:53);
# both tcpdump-confirmed. See DECISIONS-LOG. ----
- vpn-egress # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
# ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
- monitoring # kube-prometheus-stack + Loki + Alloy + Alertmanager
platform/vpn-egress/gluetun-gateway.yaml
+6 -5
View File
@@ -41,11 +41,12 @@ spec:
- name: VPN_TYPE
value: "openvpn" # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
- name: OPENVPN_ENDPOINT_PORT
value: "53" # NOT 1197 — the home network NATs its own OpenVPN server there,
# so PIA-on-1197 replies never return (tcpdump-confirmed; DECISIONS-LOG).
# Hardcoded (not a ${var}): Flux/kustomize strips quotes on "${VAR}"
# → int coercion, which k8s rejects for env value (Longhorn-fix gotcha).
# Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201.
value: "8080" # NOT 1197 (home NATs its own OpenVPN server there → replies never
# return) and NOT 53 (this network transparently intercepts :53 DNS,
# swallowing OpenVPN-over-53). 8080 verified: arbitrary UDP works here
# (NTP/123 test). Hardcoded string (not ${var}): Flux/kustomize strips
# quotes on "${VAR}" → int coercion k8s rejects (Longhorn-fix gotcha).
# Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201. See DECISIONS-LOG.
# PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
- name: OPENVPN_USER
valueFrom: