You are not logged in.
Hello,
For a week now, protonvpn has been blocking my internet access, with kill switch deactivated.
I ping my internet box, my nas and my printer locally, but no access to the web.
I've had no problems since subscribing.
I'm using the extra/proton-vpn-gtk-app 4.9.7-1 package, I've also tried it with flatpak, and the result is the same.
Can you point me to a solution?
Sincerely,
Dany
Offline
When you are connected to the VPN:
ip a
ip -4 r
ip -6 r
ping 8.8.8.8
ping dns.google
Offline
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: enp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 30:9c:23:ff:ce:ed brd ff:ff:ff:ff:ff:ff
altname enx309c23ffceed
3: wlo1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 38:ba:f8:bd:5e:6b brd ff:ff:ff:ff:ff:ff
altname wlp0s20f3
altname wlx38baf8bd5e6b
inet 192.168.1.190/24 brd 192.168.1.255 scope global dynamic noprefixroute wlo1
valid_lft 43182sec preferred_lft 43182sec
inet6 2a01:e0a:dd6:e240:cbc0:db49:170f:7ff2/64 scope global dynamic noprefixroute
valid_lft 85818sec preferred_lft 85818sec
inet6 fe80::19f3:cef2:fcbc:a107/64 scope link noprefixroute
valid_lft forever preferred_lft forever
4: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc htb state DOWN group default qlen 1000
link/ether 52:54:00:92:1f:5d brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
9: proton0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 10.2.0.2/32 scope global noprefixroute proton0
valid_lft forever preferred_lft forever
inet6 2a07:b944::2:2/128 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::24ef:b9af:157e:cfc/64 scope link noprefixroute
valid_lft forever preferred_lft forever
10: ipv6leakintrf0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether ae:31:cc:18:f4:14 brd ff:ff:ff:ff:ff:ff
inet6 fdeb:446c:912d:8da::/64 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 fe80::6dc3:1ae1:6007:aec3/64 scope link noprefixroute
valid_lft forever preferred_lft forever
Offline
daniel@anarchy: ~ $ ip -4 r
default via 192.168.1.254 dev wlo1 proto dhcp src 192.168.1.190 metric 600
192.168.1.0/24 dev wlo1 proto kernel scope link src 192.168.1.190 metric 600
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1 linkdown
Offline
daniel@anarchy: ~ $ ip -6 r
2a01:e0a:dd6:e240::/64 dev wlo1 proto ra metric 600 pref medium
2a07:b944::2:2 dev proton0 proto kernel metric 50 pref medium
fdeb:446c:912d:8da::/64 dev ipv6leakintrf0 proto kernel metric 95 pref medium
fe80::/64 dev proton0 proto kernel metric 1024 pref medium
fe80::/64 dev ipv6leakintrf0 proto kernel metric 1024 pref medium
fe80::/64 dev wlo1 proto kernel metric 1024 pref medium
default via fdeb:446c:912d:8da::1 dev ipv6leakintrf0 proto static metric 95 pref medium
default via fe80::3a07:16ff:fe0c:4494 dev wlo1 proto ra metric 600 pref medium
Offline
daniel@anarchy: ~ $ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) octets de données.
64 octets de 8.8.8.8 : icmp_seq=1 ttl=119 temps=30.1 ms
64 octets de 8.8.8.8 : icmp_seq=2 ttl=119 temps=31.4 ms
64 octets de 8.8.8.8 : icmp_seq=3 ttl=119 temps=31.0 ms
Offline
daniel@anarchy: ~ $ ping dns.google
NOTHING
Offline
Well - the DNS seems broken.
And the assumed "IPv6 leak prevention" interface named "ipv6leakintrf0" splices the default route.
First - depending on your network management - delete the interface "ipv6leakintrf0".
Offline
I have deleted the interface "ipv6leakintrf0" without more success.
Offline
Please post the output of
ls -l /etc/resolv.conf
cat /etc/resolv.conf
resolvectl status
Offline
daniel@anarchy: ~ $ ls -l /etc/resolv.conf
lrwxrwxrwx 1 root root 39 22 juin 18:42 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf
daniel@anarchy: ~ $ cat /etc/resolv.conf
# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.
nameserver 127.0.0.53
options edns0 trust-ad
search .
Offline
daniel@anarchy: ~ $ resolvectl status
Global
Protocols: +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub
Current DNS Server: 193.110.81.0#dns0.eu
DNS Servers: 193.110.81.0#dns0.eu 2a0f:fc80::#dns0.eu 185.253.5.0#dns0.eu 2a0f:fc81::#dns0.eu
Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net 8.8.8.8#dns.google 2606:4700:4700::1111#cloudflare-dns.com
2620:fe::9#dns.quad9.net 2001:4860:4860::8888#dns.google
Link 2 (enp3s0)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6
Protocols: +DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 1.1.1.1
DNS Servers: 1.1.1.1 1.0.0.1 212.27.40.240 212.27.40.241 2606:4700:4700::1111 2606:4700:4700::1001
Default Route: yes
Link 3 (wlo1)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6
Protocols: +DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 1.1.1.1
DNS Servers: 1.1.1.1 1.0.0.1 212.27.40.240 212.27.40.241 2606:4700:4700::1111 2606:4700:4700::1001
Default Route: yes
Link 4 (virbr0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Default Route: no
daniel@anarchy: ~ $
Offline
I have found a solution to have access to internet when protonvpn is activated but it is not the best for privacy.
I have put 1.1.1.1 as a customer DNS server in the protonvpn settings.
I can ping protonvpn DNS but no access to internet :
daniel@anarchy: ~ $ ping 10.2.0.2
PING 10.2.0.2 (10.2.0.2) 56(84) octets de données.
64 octets de 10.2.0.2 : icmp_seq=1 ttl=64 temps=0.093 ms
64 octets de 10.2.0.2 : icmp_seq=2 ttl=64 temps=0.103 ms
Offline
daniel@anarchy: ~ $ resolvectl status (with protonvpn DNS)
Global
Protocols: +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub
Current DNS Server: 193.110.81.0#dns0.eu
DNS Servers: 193.110.81.0#dns0.eu 2a0f:fc80::#dns0.eu 185.253.5.0#dns0.eu 2a0f:fc81::#dns0.eu
Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net 8.8.8.8#dns.google 2606:4700:4700::1111#cloudflare-dns.com
2620:fe::9#dns.quad9.net 2001:4860:4860::8888#dns.google
Link 2 (enp3s0)
Current Scopes: LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6
Protocols: -DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Default Route: no
Link 3 (wlo1)
Current Scopes: LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6
Protocols: -DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Default Route: no
Link 4 (virbr0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Default Route: no
Link 12 (proton0)
Current Scopes: DNS
Protocols: +DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.2.0.1
DNS Servers: 10.2.0.1 2a07:b944::2:1
DNS Domain: ~.
Default Route: yes
Link 13 (ipv6leakintrf0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Default Route: no
Offline
dig @193.110.81.0 google.com
randomly times out for me, the nextdns.io server is probably underdimensioned
10.2.0.2 had not been in use as DNS previously.
Can you
dig @10.2.0.2 google.com
what do you get for
drill google.com
nslookup google.com
Offline
daniel@anarchy: ~ $ dig @10.2.0.2 google.com
;; communications error to 10.2.0.2#53: connection refused
;; communications error to 10.2.0.2#53: connection refused
;; communications error to 10.2.0.2#53: connection refused
; <<>> DiG 9.20.10 <<>> @10.2.0.2 google.com
; (1 server found)
;; global options: +cmd
;; no servers could be reached
Offline
daniel@anarchy: ~ $ drill google.com
bash: drill : commande introuvable
daniel@anarchy: ~ $ nslookup google.com
;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out
;; no servers could be reached
daniel@anarchy: ~ $
Offline
drill is in https://archlinux.org/packages/core/x86_64/ldns/
10.2.0.2 doesn't respond, protonvpn is probably not active (or you're not logged in/registered)?
The stub resolver is configured for a local resolved server, but that's apparently not running?
ss -tulpen
Offline
I have a registered account for protonvpn.
I have signed out and in with no more success.
daniel@anarchy: ~ $ ss -tulpen
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 192.168.122.1:53 0.0.0.0:* ino:1481 sk:1 cgroup:/system.slice/libvirtd.service <->
udp UNCONN 0 0 127.0.0.54:53 0.0.0.0:* uid:978 ino:476 sk:2 cgroup:/system.slice/systemd-resolved.service <->
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* uid:978 ino:474 sk:3 cgroup:/system.slice/systemd-resolved.service <->
udp UNCONN 0 0 0.0.0.0%virbr0:67 0.0.0.0:* ino:1478 sk:4 cgroup:/system.slice/libvirtd.service <->
udp UNCONN 0 0 0.0.0.0:42420 0.0.0.0:* users:(("pcloud",pid=2106,fd=88)) uid:1000 ino:19022 sk:5 cgroup:/user.slice/user-1000.slice/user@1000.service/app.slice/app-gnome-pcloud_02eb63978ebed941994ad328b9dba0fc-1601.scope <->
udp UNCONN 0 0 0.0.0.0:60225 0.0.0.0:* uid:975 ino:8440 sk:6 cgroup:/system.slice/avahi-daemon.service <->
udp UNCONN 0 0 0.0.0.0:44758 0.0.0.0:* ino:62468 sk:1001 cgroup:/system.slice/NetworkManager.service <->
udp UNCONN 0 0 0.0.0.0:53635 0.0.0.0:* uid:951 ino:654 sk:7 cgroup:/system.slice/fah-client.service <->
udp UNCONN 0 0 0.0.0.0:5353 0.0.0.0:* uid:975 ino:8438 sk:8 cgroup:/system.slice/avahi-daemon.service <->
udp UNCONN 0 0 0.0.0.0:5353 0.0.0.0:* uid:978 ino:468 sk:9 cgroup:/system.slice/systemd-resolved.service <->
udp UNCONN 0 0 0.0.0.0:5355 0.0.0.0:* uid:978 ino:458 sk:a cgroup:/system.slice/systemd-resolved.service <->
udp UNCONN 0 0 [::]:35630 [::]:* uid:975 ino:8441 sk:b cgroup:/system.slice/avahi-daemon.service v6only:1 <->
udp UNCONN 0 0 [::]:44758 [::]:* ino:62469 sk:1002 cgroup:/system.slice/NetworkManager.service v6only:1 <->
udp UNCONN 0 0 [::]:5353 [::]:* uid:978 ino:469 sk:c cgroup:/system.slice/systemd-resolved.service v6only:1 <->
udp UNCONN 0 0 [::]:5353 [::]:* uid:975 ino:8439 sk:d cgroup:/system.slice/avahi-daemon.service v6only:1 <->
udp UNCONN 0 0 [::]:5355 [::]:* uid:978 ino:466 sk:e cgroup:/system.slice/systemd-resolved.service v6only:1 <->
tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* uid:978 ino:475 sk:f cgroup:/system.slice/systemd-resolved.service <->
tcp LISTEN 0 2 0.0.0.0:44979 0.0.0.0:* users:(("pcloud",pid=2106,fd=91)) uid:1000 ino:19023 sk:10 cgroup:/user.slice/user-1000.slice/user@1000.service/app.slice/app-gnome-pcloud_02eb63978ebed941994ad328b9dba0fc-1601.scope <->
tcp LISTEN 0 4096 127.0.0.1:631 0.0.0.0:* ino:8512 sk:11 cgroup:/system.slice/system-cups.slice/cups.service <->
tcp LISTEN 0 4096 127.0.0.1:1143 0.0.0.0:* users:(("bridge",pid=1958,fd=14)) uid:1000 ino:16358 sk:12 cgroup:/user.slice/user-1000.slice/user@1000.service/app.slice/app-gnome-Proton\x20Mail\x20Bridge-1562.scope <->
tcp LISTEN 0 32 192.168.122.1:53 0.0.0.0:* ino:1482 sk:13 cgroup:/system.slice/libvirtd.service <->
tcp LISTEN 0 4096 127.0.0.1:1025 0.0.0.0:* users:(("bridge",pid=1958,fd=15)) uid:1000 ino:16360 sk:14 cgroup:/user.slice/user-1000.slice/user@1000.service/app.slice/app-gnome-Proton\x20Mail\x20Bridge-1562.scope <->
tcp LISTEN 0 8 127.0.0.1:39483 0.0.0.0:* users:(("cloud-drive-con",pid=2479,fd=4)) uid:1000 ino:26667 sk:15 cgroup:/user.slice/user-1000.slice/user@1000.service/app.slice/app-gnome-synology\x2ddrive\x2dautostart-1585.scope <->
tcp LISTEN 0 128 127.0.0.1:7396 0.0.0.0:* uid:951 ino:652 sk:16 cgroup:/system.slice/fah-client.service <->
tcp LISTEN 0 4096 127.0.0.54:53 0.0.0.0:* uid:978 ino:477 sk:17 cgroup:/system.slice/systemd-resolved.service <->
tcp LISTEN 0 4096 127.0.0.1:38025 0.0.0.0:* users:(("bridge",pid=1958,fd=13)) uid:1000 ino:16355 sk:18 cgroup:/user.slice/user-1000.slice/user@1000.service/app.slice/app-gnome-Proton\x20Mail\x20Bridge-1562.scope <->
tcp LISTEN 0 4096 0.0.0.0:5355 0.0.0.0:* uid:978 ino:459 sk:19 cgroup:/system.slice/systemd-resolved.service <->
tcp LISTEN 0 4096 [::1]:631 [::]:* ino:8511 sk:1a cgroup:/system.slice/system-cups.slice/cups.service v6only:1 <->
tcp LISTEN 0 4096 [::]:5355 [::]:* uid:978 ino:467 sk:1b cgroup:/system.slice/systemd-resolved.service v6only:1 <->
daniel@anarchy: ~ $
Offline
Please use [code][/code] tags. Edit your posts in this regard.
udp UNCONN 0 0 127.0.0.54:53 0.0.0.0:* uid:978 ino:476 sk:2 cgroup:/system.slice/systemd-resolved.service <->
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* uid:978 ino:474 sk:3 cgroup:/system.slice/systemd-resolved.service <->
tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* uid:978 ino:475 sk:f cgroup:/system.slice/systemd-resolved.service <->
What is the current "resolvectl status" output when enabling protonvpn and how did you end up w/ the nextdns.io DNS in the previous one?
Offline
I have another old laptop with EndeavourOSwith is running well wilt protonvpn :
[daniel@daniel-latitudee6400 ~]$ resolvectl status
Failed to get global data: Could not activate remote peer 'org.freedesktop.resolve1': activation request failed: unknown unit
[daniel@daniel-latitudee6400 ~]$ ls -l /etc/resolv.conf
-rw-r--r-- 1 root root 76 29 juin 14:22 /etc/resolv.conf
[daniel@daniel-latitudee6400 ~]$ cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.2.0.1
nameserver 2a07:b944::2:1
[daniel@daniel-latitudee6400 ~]$
Offline
/etc/resolv.conf is modified when protonvpn is active, this is not the case on my other laptop with the issue.
[daniel@daniel-latitudee6400 ~]$ cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 10.2.0.1
nameserver 2a07:b944::2:1
[daniel@daniel-latitudee6400 ~]$ cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 1.1.1.1
nameserver 1.0.0.1
nameserver 212.27.40.240
# NOTE: the libc resolver may not support more than 3 nameservers.
# The nameservers listed below may not be recognized.
nameserver 212.27.40.241
nameserver 2606:4700:4700::1111
nameserver 2606:4700:4700::1001
[daniel@daniel-latitudee6400 ~]$
Offline
You're not using systemd-resolved there.
I'm inclined to say "because"…
Edit: possibly also prepare for https://bbs.archlinux.org/viewtopic.php?id=306639 (but this is brand new, the latest openresolv was released 3 days ago)
Last edited by seth (2025-06-29 21:45:00)
Offline
This thread is getting confusing.
@DanyBreizh
Please install "ldns", start ProtonVPN, check via "resolvectl status" the IP address of the "Current DNS Server" for the interface "proton0".
Use this IP address in this test while still connected to ProtonVPN:
drill google.com @10.2.0.1
Offline
daniel@anarchy: ~ $ resolvectl status
Global
Protocols: +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub
Current DNS Server: 193.110.81.0#dns0.eu
DNS Servers: 193.110.81.0#dns0.eu 2a0f:fc80::#dns0.eu 185.253.5.0#dns0.eu 2a0f:fc81::#dns0.eu
Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net 8.8.8.8#dns.google 2606:4700:4700::1111#cloudflare-dns.com
2620:fe::9#dns.quad9.net 2001:4860:4860::8888#dns.google
Link 2 (enp3s0)
Current Scopes: LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6
Protocols: -DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Default Route: no
Link 3 (wlo1)
Current Scopes: LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6
Protocols: -DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Default Route: no
Link 4 (virbr0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Default Route: no
Link 9 (proton0)
Current Scopes: DNS
Protocols: +DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.2.0.1
DNS Servers: 10.2.0.1 2a07:b944::2:1
DNS Domain: ~.
Default Route: yes
Link 10 (ipv6leakintrf0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR +mDNS +DNSOverTLS DNSSEC=no/unsupported
Default Route: no
daniel@anarchy: ~ $ drill google.com @10.2.0.1
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 37577
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; google.com. IN A
;; ANSWER SECTION:
google.com. 214 IN A 142.250.75.238
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 6 msec
;; SERVER: 10.2.0.1
;; WHEN: Mon Jun 30 18:08:52 2025
;; MSG SIZE rcvd: 44
daniel@anarchy: ~ $
Offline