Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

fix(vpn): PIA OpenVPN port 53 -> 8080 (53 is DNS-intercepted on this network)

Browse Source 
Port 53 also got no PIA replies: this network transparently intercepts outbound
:53, so dig works but OpenVPN-over-53 is swallowed. An NTP/123 probe from the host
returned fine, proving arbitrary non-53 UDP works bidirectionally (so it's
port-specific: 1197 conflict + 53 DNS-intercept, not a UDP block). Move to 8080
(community-verified for PIA, non-DNS, non-1197).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-22 16:39:30 -05:00
1 parent 7a88863f71
commit 4cde690008
4 files changed
+20 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform/vpn-egress/gluetun-gateway.yaml
+6 -5
View File
@@ -41,11 +41,12 @@ spec:
- name: VPN_TYPE
value: "openvpn" # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
- name: OPENVPN_ENDPOINT_PORT
value: "53" # NOT 1197 — the home network NATs its own OpenVPN server there,
# so PIA-on-1197 replies never return (tcpdump-confirmed; DECISIONS-LOG).
# Hardcoded (not a ${var}): Flux/kustomize strips quotes on "${VAR}"
# → int coercion, which k8s rejects for env value (Longhorn-fix gotcha).
# Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201.
value: "8080" # NOT 1197 (home NATs its own OpenVPN server there → replies never
# return) and NOT 53 (this network transparently intercepts :53 DNS,
# swallowing OpenVPN-over-53). 8080 verified: arbitrary UDP works here
# (NTP/123 test). Hardcoded string (not ${var}): Flux/kustomize strips
# quotes on "${VAR}" → int coercion k8s rejects (Longhorn-fix gotcha).
# Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201. See DECISIONS-LOG.
# PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
- name: OPENVPN_USER
valueFrom: