i/o timeouts

[p145085]

2025-08-20T05:37:51+02:00 INFO [vpn] starting
2025-08-20T05:37:51+02:00 INFO [firewall] allowing VPN connection...
2025-08-20T05:37:51+02:00 INFO [wireguard] Using available kernelspace implementation
2025-08-20T05:37:51+02:00 INFO [wireguard] Connecting to xxx.xx.xxx.xx:51820
2025-08-20T05:37:51+02:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2025-08-20T05:37:51+02:00 INFO [firewall] setting allowed input port 51820 through interface tun0...
2025-08-20T05:38:01+02:00 ERROR [vpn] getting public IP address information: fetching information: Get "https://ipinfo.io/": dial tcp: lookup ipinfo.io on 1.1.1.1:53: read udp 10.70.18.225:40789->1.1.1.1:53: i/o timeout

I can't remember changing anything in particular before this happened.
The gluetun developers specifically said not to contact them about this and DNS issues.
So I'm trying with you Techhut repo because it relates to your servarr stack which ran fine for a month or so.
I also tried generating a new VPN / Wireguard config and updating my .env file, still same issue.
May be related: Jellyfin is not browsable even though docker says it's healthy.

Let me know if you need to see my compose file if you don't immediately know what the issue is.

[JohnCode1]

I am fairly new to all this and just got my homelab set up about a month ago as well. Do you have static mapings set up with your router for all your containers and vms? Maybe an IP changed from DHCP Server? I had alot of issues getting glueten to run as my provider is PIA and I couldn't get it to run with Wiregaurd and had to use OpenVPN. Lastly I would double check your config with the recommended set up for your provider on glueten

[p145085]

I am fairly new to all this and just got my homelab set up about a month ago as well. Do you have static mapings set up with your router for all your containers and vms? Maybe an IP changed from DHCP Server? I had alot of issues getting glueten to run as my provider is PIA and I couldn't get it to run with Wiregaurd and had to use OpenVPN. Lastly I would double check your config with the recommended set up for your provider on glueten

thanks, i looked into it and it appeared to be such an issue. I deleted the gluetun folder and recomposed. seems to be working now.

[p145085]

I spoke too soon, after 2 hours it became unhealthy with the same i/o timeout issues.

[JohnCode1]

so it ran without having to change any ips? sounds like for some reason it is loosing connection after start up if you didn't change anything like ips and what not and started it back up

[p145085]

so it ran without having to change any ips? sounds like for some reason it is loosing connection after start up if you didn't change anything like ips and what not and started it back up

Yep, did not have to change any IPs.

2025-08-25T04:02:24+02:00 INFO [firewall] setting allowed input port 51820 through interface tun0... 2025-08-25T04:02:29+02:00 WARN [dns] dialing tls server for request IN A cloudflare.com.: dial tcp 1.0.0.1:853: i/o timeout 2025-08-25T04:02:29+02:00 WARN [dns] dialing tls server for request IN A ipinfo.io.: dial tcp 1.1.1.1:853: i/o timeout 2025-08-25T04:02:29+02:00 WARN [dns] dialing tls server for request IN AAAA ipinfo.io.: dial tcp 1.1.1.1:853: i/o timeout 2025-08-25T04:02:31+02:00 WARN [dns] dialing tls server for request IN A cloudflare.com.: dial tcp 1.1.1.1:853: i/o timeout 2025-08-25T04:02:34+02:00 WARN [dns] dialing tls server for request IN A ipinfo.io.: dial tcp 1.0.0.1:853: i/o timeout 2025-08-25T04:02:34+02:00 WARN [dns] dialing tls server for request IN AAAA ipinfo.io.: dial tcp 1.0.0.1:853: i/o timeout 2025-08-25T04:02:34+02:00 ERROR [vpn] getting public IP address information: fetching information: Get "https://ipinfo.io/": dial tcp: lookup ipinfo.io on 127.0.0.1:53: read udp 127.0.0.1:48723->127.0.0.1:53: i/o timeout 2025-08-25T04:02:35+02:00 WARN [dns] dialing tls server for request IN A cloudflare.com.: dial tcp 1.1.1.1:853: i/o timeout 2025-08-25T04:02:38+02:00 WARN [dns] dialing tls server for request IN AAAA www.google.com.: dial tcp 1.0.0.1:853: i/o timeout 2025-08-25T04:02:38+02:00 WARN [dns] dialing tls server for request IN A www.google.com.: dial tcp 1.0.0.1:853: i/o timeout 2025-08-25T04:02:40+02:00 WARN [dns] dialing tls server for request IN A cloudflare.com.: dial tcp 1.1.1.1:853: i/o timeout 2025-08-25T04:02:41+02:00 WARN [dns] dialing tls server for request IN AAAA www.google.com.: dial tcp 1.0.0.1:853: i/o timeout 2025-08-25T04:02:41+02:00 WARN [dns] dialing tls server for request IN A www.google.com.: dial tcp 1.0.0.1:853: i/o timeout 2025-08-25T04:02:41+02:00 WARN [dns] dialing tls server for request IN A cloudflare.com.: dial tcp 1.1.1.1:853: i/o timeout 2025-08-25T04:02:43+02:00 WARN [dns] dialing tls server for request IN AAAA www.google.com.: dial tcp 1.0.0.1:853: i/o timeout 2025-08-25T04:02:46+02:00 WARN [dns] dialing tls server for request IN A cloudflare.com.: dial tcp 1.0.0.1:853: i/o timeout

[JohnCode1]

so to me it sounds like glueten is unable to connect to your lan, and i might be wrong, and for some reason when you started fresh it was able to connect then something is changing it preventing it to get access to the internet sorry can't be much more help.

[davidyang]

I'm new to this so having a hard time understanding something. I don't see a way in the compose.yaml file for the gluetun to talk outside the servarrnetwork so it can't send traffic out via Wireguard. If I do a docker run with the wireguard config I create in .env it's able to connect and run. Am I missing something?

[JohnCode1]

@davidyang I am also still learning but if you follow that compose.yml file everything works, not 100 percent how everything is working under the hood but I have been using it for a few months now, but had to change a few things due to using Private Internet Access as my provider. My basic understanding is the ports you open for glueten for the firewall vpn ports is whats allowing it to talk out and back in via the vpn. Note it will only work for apps on that glueten network in the compose file. I did read the Glueten docs and set up a shadowsock which allows me to connect to it via my computer which is convenient

[davidyang]

@JohnCode1 thanks for the awesome response. I also have PIA and was trying to set that up and even bought AirVPN to try. I'm not sure the forwarding port was working, do you have to open a port through your firewall to enable Wireguard to work? I don't see that in the documentation, perhaps it's in @TechHutTV's video?

[JohnCode1]

@davidyang I am using PfSense Firewall and did not have to open any ports, also quick check I always do to ensure its not a port issue with ufw is disable it real fast which technically is insecure so do that at your own risk. Here is my compose.yml and .env setup for pia with a shadowsock

services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
    # If running on an LXC must do additional config
      - /dev/net/tun:/dev/net/tun
    env_file: .env
    networks:
      servarrnetwork:
        ipv4_address: ${GLUETUNIP}
    ports:
      - ${FIREWALL_VPN_INPUT_PORTS}:${FIREWALL_VPN_INPUT_PORTS}
      #- ADD PORTS AS NECESSARY FOR APPS YOU ARE RUNNING UNDER THE VPN
    volumes:
      - ${GLUETUNDATA}:/gluetun
    # Make a '.env' file in the same directory.
    healthcheck:
      test: ping -c 1 www.google.com || exit 1
      interval: 20s
      timeout: 10s
      retries: 5
    restart: unless-stopped

VPN_SERVICE_PROVIDER=private internet access
OPENVPN_USER=#PIA USERNAME
OPENVPN_PASSWORD=#PIA PASSWORD
SERVER_NAMES:vancouver422 #Or server of choice
FIREWALL_VPN_INPUT_PORTS=1197
#If want to use a shadowsock I used it for testing for DNS leaks
#SHADOWSOCKS=on
#SHADOWSOCKS_PASSWORD=#Shadowsockpassword
GLUETENDATA=#PATHTOSTORECONFIG
GLUETENIP=#IPOFVPNNETWORKYOUARECREATING

[davidyang]

What is your config for the servarrnetwork? ChatGPT is saying that it has no way to get out - I'm guessing the port forwarding is important but I never see it connect inside the AirVPN web ui.

[JohnCode1]

@davidyang I don't think chatGPT is the best for this scenario I had to get alot of my info from the glueten wiki on github. I tried using chatgpt to figure out how to setup the shadowsock and got no where and had to go to the docs. If that firewall port is open with the vpn service provider and the correct credentials glueten should handle connecting to your vpn provider.

networks:
  servarrnetwork:
    name: servarrnetwork
    ipam:
      config:
        - subnet: ${SERVERSUBNET}

services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
    # If running on an LXC must do additional config
      - /dev/net/tun:/dev/net/tun
    env_file: .env
    networks:
      servarrnetwork:
        ipv4_address: ${GLUETUNIP}
    ports:
      - ${FIREWALL_VPN_INPUT_PORTS}:${FIREWALL_VPN_INPUT_PORTS}

    volumes:
      - ${GLUETUNDATA}:/gluetun
    # Make a '.env' file in the same directory.
    healthcheck:
      test: ping -c 1 www.google.com || exit 1
      interval: 20s
      timeout: 10s
      retries: 5
    restart: unless-stopped

[davidyang]

is it possible it's something with how the VM is setup?

bios: ovmf
boot: order=scsi0;ide2;net0
cores: 4
cpu: host
efidisk0: vmstore:101/vm-101-disk-0.qcow2,efitype=4m,pre-enrolled-keys=1,size=528K
ide2: vmstore:iso/ubuntu-24.04.3-live-server-amd64.iso,media=cdrom,size=3226020K
machine: q35
memory: 4096
meta: creation-qemu=10.0.2,ctime=1761372645
name: media-server
net0: virtio=BC:24:11:33:30:DA,bridge=vmbr0
numa: 0
ostype: l26
scsi0: vmstore:101/vm-101-disk-1.qcow2,cache=writeback,size=32G
scsihw: virtio-scsi-pci
smbios1: uuid=be89af81-e296-441a-b758-67e31d05fbb5
sockets: 1
virtiofs0: media-files,direct-io=1
vmgenid: f88fb1b6-d267-4653-ad19-44149a09c1ad

[JohnCode1]

@davidyang unfortantly that is out of my realm of knowledge. If you have internet access on your server I.E. able to pull docker images or run ping google.com and it comes back good and you follow the compose file it should work. Most likely it's a firewall or issue of how you have glueten configured. If you have air vpn i would try to follow along closely with his video and double check your set up. Sorry for not being much help.

[davidyang]

OK for future reference with AirVPN, having the .env file with SERVER_COUNTRIES and SERVER_CITIES causes it to fail, I removed those and then it started working.