Improve IPtables error message

[romainguinot]

What's the feature 🧐

I set up a fresh version of gluetun's latest to cleanup the duplicate environment variables.
When starting it through the official docker container, i had an error message about an incompatible or missing iptables.

In reality, it is because i forgot to give it the NET_ADMIN capability. Perhaps the error message could be improved ?

As a side question, mullvad's downloadable config provides a DNS address, but not sure if that one should be used in the gluetun container config instead of unblock on localhost ?

Extra information and references

No response

[qdm12]

Perhaps the error message could be improved ?

Done in 39a62f5! It should show

ERROR NET_ADMIN capability is missing: iptables v1.8.7 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded. (exit status 3)

As a side question, mullvad's downloadable config provides a DNS address, but not sure if that one should be used in the gluetun container config instead of unblock on localhost ?

You can set DOT=off and DNS_ADDRESS=1.2.3.4 where 1.2.3.4 is the DNS address Mullvad provides.
By default gluetun uses a local DNS server that relays requests/responses over TLS to Cloudflare (you can change which providers as well with DOT_PROVIDERS).

[romainguinot]

Thanks very much for the quick reply and fix !
I had also set up FIREWALL_OUTBOUND_SUBNETS so that some docker containers routed through gluetun could still connect to other containers not routed through gluetun.

In that scenario, i imagine that it's not possible to use Mullvad's own DNS instead of the gluetun's local DNS + cloudflare ?

Cheers.

[qdm12]

I just found out Mullvad supports DoT and DoH https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/#:~:text=Open%20your%20device's%20Settings.,adblock.doh.mullvad.net

It should be possible to use it later once #137 is fixed, so feel free to subscribe to it 😉

Although ideally privacy-wise it's better to do 'dns split horizon' which means uniformly distribute your DNS traffic to multiple providers (google, Cloudflare, quad9 etc.) such that none have a full traffic analysis. Handing over all your DNS to Mullvad would allow them to track your behavior, especially since they can match your IP to your account ID. Well I trust Mullvad so this is just my theoretical paranoid point of view!

[romainguinot]

Thanks ! for now i'll leave it as is then. i've subscribed to #137 as well.