Tunnels can't reach API's despite traffic to google etc. going through.
Posted by Cheap_Tank7844@reddit | sysadmin | View on Reddit | 3 comments
I'm making this post because I've been trying to setup a tunnel and every. single. time. it causes TLS handshake failures to happen. I've tried lowering MTU, I've tried a whole bunch of things in hopes that it would fix this problem.
I was searching online for a post about this, and it seems no one has made a post about these issues in the past which confuses me because this is the 5th time I've tried setting up a tunnel. My initial idea was to setup a GRE tunnel and just block off all outside traffic except from the VPS (server A) through which all traffic will go. When this failed, pterodactyl0 was either sending traffic outside of the tunnel which got blocked by the iptables because we wanted traffic to go through the tunnel. When it was sending traffic through the tunnels, the handshake failures returned.
I figured it must have been an issue with my setup so I went and tried Wireguard, the same exact problem... I'm so lost on why handshake failures keep happening, here's the console errors whenever I curl Minecraft's API:
root@test:~# curl
https://api.minecraftservices.com
curl: (35) error:0A000410:SSL routines::sslv3 alert handshake failure
Here's the error inside the container:
08:46:53 ERROR]: Failed to request yggdrasil public key
com.mojang.authlib.exceptions.MinecraftClientException: Failed to read from https://api.minecraftservices.com/publickeys due to api.minecraftservices.com
at com.mojang.authlib.minecraft.client.MinecraftClient.readInputStream(MinecraftClient.java:111) ~[authlib-6.0.58.jar:?]
at com.mojang.authlib.minecraft.client.MinecraftClient.get(MinecraftClient.java:56) ~[authlib-6.0.58.jar:?]
at com.mojang.authlib.yggdrasil.YggdrasilServicesKeyInfo.fetch(YggdrasilServicesKeyInfo.java:114) ~[authlib-6.0.58.jar:?]
rootj0@reddit
You have Netskope or a CASB running between the traffic?
dustojnikhummer@reddit
This is more of a r/homelab thing, BUT.
I remember having a similar issue a few months back, and it in fact was the issue of MTUs. I accidentally borked MTU for all devices on a specific VLAN. Sadly it was not on a VPS, but at my home server.
https://serverfault.com/questions/1170054/why-does-an-ssl-handshake-fail-due-to-small-mtu
BlackV@reddit
given that that is all Minecraft
you want /r/techsupport or /r/minecraft or /r/gaming /r/homelab