PIA's PF gateway 10.31.128.1 sits inside the /8 cluster-pool, so FIREWALL_OUTBOUND_SUBNETS=10.0.0.0/8 made gluetun route it around the tunnel and port forwarding timed out (getSignature to 10.31.128.1:19999). /16 covers actual pod allocations and excludes PIA's 10.31.x. Co-Authored-By: Claude Opus 4.8 <[email protected]>