• 1 Post
  • 18 Comments
Joined 10 months ago
Cake day: August 22nd, 2025





— UPDATE 2025-10-18 —

I never found the solution for OpenVPN, I think there may be some steps missing from Proton’s ovpn guide (as of this writing) regarding setting up a vpn zone but I am no longer actively looking for solutions. What I did instead was reset the router to default and followed the guide for WireGuard https://protonvpn.com/support/openwrt-wireguard which worked flawlessly and does what I need it to do. Thanks everyone for the help in troubleshooting!

— ORIGINAL POST —

Hi all, as the title says I’m trying to set up Proton VPN on an old router, with the goal of piping 100% of my home traffic through the VPN. I followed this tutorial I found https://protonvpn.com/support/how-to-set-up-protonvpn-on-openwrt-routers and as soon as I got to the end of it, I couldn’t access the internet with the VPN instance started. If I turn it off, the router behaves normally. I’ve looked through the instructions and I can’t see where I’ve deviated from them, and I’m a little out of my element with routers so I’m not sure how to improvise. Any advice on what to try would be appreciated!

Facts:

  • with the VPN service down, both the router and connected clients are able to access the internet (ping 8.8.8.8 is the test). However, with the VPN service up neither the router nor any connected client appears to be able to access the internet at all.
  • running OpenWRT 24.10.3, which should be supported
  • using the Free tier of Proton, I don’t think that should be impacting as I don’t see anything that says I can’t do this with the Free tier, but it may be relevant
  • The OpenWRT router is currently behind my ISP router, which again I don’t think is relevant (and it’s how I would like the final topology to look anyway) but IDRK.

selected log snippets from the router. NOTE there are a ton of logs with the repeated EHOSTUNREACH array of varying lengths, they all seem to have the same error at the end: Host is unreachable (fd=5,code=148)

daemon.warn openvpn(protonvpn)[19695]: NOTE setsockopt TCP_NODELAY=1 failed
daemon.warn openvpn(protonvpn)[19695] sitnl_send: rtnl: generic error (-128): Network unreachable
...
daemon.notice openvpn(protonvpn)[19695]: WARNING: OpenVPN was configured to add an IPv6 route. However, no IPv6 has been configured for tun0, therefore the route installation may fail or may not work as expected.
...
daemon.notice openvpn(protonvpn)[19695]: Initialization Sequence Completed
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
... # This block repeats over and over
daemon.notice openvpn(protonvpn)[19695]: SIGUSR1[soft,tls-error] received, process restarting
daemon.warn openvpn(protonvpn)[19695]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
daemon.notice openvpn(protonvpn)[19695]: TCP/UDP: Preserving recently used remote address: [AF_INET]89.187.171.225:51820
daemon.warn openvpn(protonvpn)[19695]: NOTE: setsockopt TCP_NODELAY=1 failed
daemon.notice openvpn(protonvpn)[19695]: UDPv4 link local: (not bound)
daemon.notice openvpn(protonvpn)[19695]: UDPv4 link remote: [AF_INET]89.187.171.225:51820
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH|EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
daemon.err openvpn(protonvpn)[19695]: TLS Error: TLS handshake failed
daemon.notice openvpn(protonvpn)[19695]: SIGUSR1[soft,tls-error] received, process restarting

  • It does something similar, in that you can replicate servers and have one act as a failover for another, but I think you’d need a lot of extra code to sync the primary game host with the failover hosts, and more to make sure all the clients detect a failed host and all gracefully switch to the same failover host, and probably a hundred other things I’m not thinking of. If I were going to build something like this I probably would look to kubernetes as a foundation but there would be a lot of customization on top of that.


  • I love this idea. As others have said, a distributed game server would be a really tall order, and AFAIK there’s not really anything already made that does what you’re describing. But you could have a setup where one server hosts the game and syncs the game state with the other servers in the network, and if one server fails the network decides which failover server to connect to, all the clients connect to that server and continue playing on the new host. But it would be a gargantuan task to implement something like that.


  • My computer was getting older and slower and I couldn’t afford a new one and wanted to squeeze as much performance out of it as I could. That and, I heard it was all the rage with hackers and I fancied myself a bit of a hacker.



  • I didn’t realize it until after she died, but I mourned my relationship with my mom for years before she actually kicked the bucket. I had long since accepted that she didn’t want to have any kind of relationship with me and that I would almost certainly never have any meaningful relationship with her, unless she had a serious change of heart. So I just assumed that I would never speak to her again. Then when she actually died, it just kinda… ticked from 0.1% chance to 0.0% chance. Still felt shitty to have it finally close on that note, but I hadn’t really expected anything different. I still sometimes wonder if I could have had some kind of breakthrough conversation with her but the reality is that she made her choices and there was nothing I could do to change her mind.


  • it’s an extra hurdle, but it’s far from a guaranteed barrier. There’s a whole class of exploits called container escapes (or hypervisor escapes if you’re dealing with old-school VMs) that specifically focus on escalating an attack from a compromised container into whatever machine is hosting the container.



  • Thanks ❤️ I really wish I knew what to do, because I still have relatives on both sides that are deep in the cult. Not to mention my inlaws 🤦 They occupy a spectrum of dangerous / crazy and some of them I don’t talk to at all, some I still talk to occasionally but it’s hard to figure out where the cutoff line is. I think I’ve had some productive conversations around how dangerous Trump / MAGA are, but it’s hard to tell because I think the effects only manifest in the long term really and it’s hard to tell whether I’m helping or just pushing them away. I don’t think anyone suddenly has a lightbulb and thinks “Oh god, I’m in a cult”, at least not in my experience. It’s more gradual and requires sustained conversations, which incidentally is why cults generally encourage victims to cut off family members who aren’t also in the groupthink. So, I just try to meet the ones I don’t think would likely try to kill me for being trans where they are and do my best to be a good influence in the sphere of influence I have.

    As for the reroll, lol I hear ya, but as a wise wizard once said, “so do all who live to see such times. But that is not for them to decide. All we have to decide is what to do with the time that is given us.”


  • My parents were both… medium-core republicans. Didn’t go to rallies or buy swag, but they weren’t interested in non-R candidates or ideas. Dad died of covid before the vaccine was available. Pre-existing immune deficiencies. He was one of the ones they couldn’t fit in the morgues because they were all full. My mom watched all this happen, still refused to get vaccinated, got covid twice (that she told me of) and died of “complications from asthma” two years after the vaccines were generally available. IDK what role covid played in her death but I doubt it helped much. I really don’t know what I could have said to her if watching dad pass in isolation wasn’t enough. I think about it a lot though.




  • Nice, I appreciate the analysis. I’m still early enough on with Jellyfin that I’m still willing to ascribe every issue to user error but I think I see what you mean. But I keep telling myself that I will contribute to a large multi-dev OSS project at some point and still never have; contributing code in public is still kinda nerve-wracking. maybe if I have a selfish enough reason to fix something I’ll finally push through that 😆


  • Good question; I did not know what Emby is until just now. I will explore it some more, I’m having issues getting the jellyfin ios/android clients to connect consistently to my server so I might ultimately do that instead / in parallel but I’m leery of freemium solutions.


  • I finally set up Jellyfin and Sonarr! I’ve been using Plex and manually managing torrents for a while now, recently found the *arr services and they are very impressive. Got the Jackett - Sonarr - Jellyfin - Nginx stack set up, now working on getting SSL + DynDNS so I can make it available remotely. Also accidentally blasted my ratio downloading a bunch of TV shows all at once so gotta seed up for a bit before i fill it out more. But so far the setup has been pleasantly breezy for how complex a setup it is ❤️