Bug: VPN Stability Issue with ProtonVPN

[KhaledMostafaME]

Is this urgent?

Yes

Host OS

Synology Docker

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2025-11-19T13:15:30.717Z (commit 3128454)

What's the problem 🤔

Hello Team,

I'm using gluetun with ProtonVPN WireGuard, the VPN tunnel establishes successfully and shows healthy! status initially. However, after approximately 5 minutes of stable operation, the vpn enters a continuous restart loop with health check failures. The pattern repeats indefinitely, making the vpn unsuitable for stable, long-running operations with dependent services (qBittorrent, Jellyfin, etc.).

I have been troubleshooting this issue for the past week with no success. I have tested numerous configurations, environment variables, and workarounds without achieving stable operation.

I would appreciate your support helping me to solve this issue.

Share your logs (at least 10 lines)

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================
Running version latest built on 2025-11-19T13:15:30.717Z (commit 3128454)
🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2025-11-19T20:22:37+04:00 INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.2 and family v4
2025-11-19T20:22:37+04:00 INFO [routing] local ethernet link found: eth0
2025-11-19T20:22:37+04:00 INFO [routing] local ipnet found: 172.20.0.0/16
2025-11-19T20:22:37+04:00 INFO [firewall] enabling...
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --policy INPUT DROP
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --policy OUTPUT DROP
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --policy FORWARD DROP
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --policy INPUT DROP
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --policy OUTPUT DROP
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --policy FORWARD DROP
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -i lo -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append INPUT -i lo -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o lo -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append OUTPUT -o lo -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o eth0 -s 172.20.0.2 -d 172.20.0.0/16 -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append OUTPUT -o eth0 -d ff02::1:ff00:0/104 -j ACCEPT
2025-11-19T20:22:37+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -i eth0 -d 172.20.0.0/16 -j ACCEPT
2025-11-19T20:22:37+04:00 INFO [firewall] enabled successfully
2025-11-19T20:22:38+04:00 INFO [storage] merging by most recent 20962 hardcoded servers and 20962 servers read from /gluetun/servers.json
2025-11-19T20:22:38+04:00 DEBUG [netlink] IPv6 is not supported after searching 0 routes
2025-11-19T20:22:38+04:00 INFO Alpine version: 3.22.2
2025-11-19T20:22:38+04:00 INFO OpenVPN 2.5 version: 2.5.10
2025-11-19T20:22:38+04:00 INFO OpenVPN 2.6 version: 2.6.14
2025-11-19T20:22:38+04:00 INFO IPtables version: v1.8.11
2025-11-19T20:22:38+04:00 INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: protonvpn
|   |   ├── Server selection settings:
|   |   |   ├── VPN type: wireguard
|   |   |   ├── Countries: united arab emirates
|   |   |   ├── Port forwarding only servers: yes
|   |   |   └── Wireguard selection settings:
|   |   └── Automatic port forwarding settings:
|   |       ├── Redirection listening port: disabled
|   |       ├── Use code for provider: protonvpn
|   |       ├── Forwarded port file path: /tmp/gluetun/forwarded_port
|   |       ├── Forwarded port up command: /bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORTS}}}" http://127.0.0.1:8090/api/v2/app/setPreferences 2>&1'
|   |       └── Forwarded port down command: /bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":123}" http://127.0.0.1:8090/api/v2/app/setPreferences 2>&1'
|   └── Wireguard settings:
|       ├── Private key: aCg...Hs=
|       ├── Interface addresses:
|       |   └── 10.2.0.2/32
|       ├── Allowed IPs:
|       |   ├── 0.0.0.0/0
|       |   └── ::/0
|       ├── Network interface: tun0
|       |   └── MTU: 1320
|       └── Implementation: kernelspace
├── DNS settings:
|   ├── Keep existing nameserver(s): no
|   ├── DNS server address to use: 8.8.8.8
|   ├── DNS forwarder server enabled: yes
|   ├── Upstream resolver type: dot
|   ├── Upstream resolvers:
|   |   └── cloudflare
|   ├── Caching: yes
|   ├── IPv6: no
|   ├── Update period: every 24h0m0s
|   └── DNS filtering settings:
|       ├── Block malicious: yes
|       ├── Block ads: no
|       └── Block surveillance: no
├── Firewall settings:
|   ├── Enabled: yes
|   └── Outbound subnets:
|       ├── 192.168.1.0/24
|       ├── 172.20.0.0/16
|       ├── 192.168.70.0/24
|       └── 172.19.0.0/24
├── Log settings:
|   └── Log level: debug
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: 8.8.8.8:443
|   ├── ICMP target IP: 8.8.8.8
|   └── Restart VPN on healthcheck failure: yes
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 1032
|   ├── Process GID: 65536
|   └── Timezone: asia/dubai
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
├── Server data updater settings:
|   ├── Update period: 1h0m0s
|   ├── DNS address: 1.1.1.1:53
|   ├── Minimum ratio: 0.8
|   ├── Providers to update: protonvpn
|   ├── Proton API email: khaledmostafame@gmail.com
|   └── Proton API password: [set]
└── Version settings:
    └── Enabled: yes
2025-11-19T20:22:38+04:00 WARN DNS address is set to 8.8.8.8 so the local forwarding DNS server will not be used. The default value changed to 127.0.0.1 so it uses the internal DNS server. If this server fails to start, the IPv4 address of the first plaintext DNS server corresponding to the first DNS provider chosen is used.
2025-11-19T20:22:38+04:00 INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.2 and family v4
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -4 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -6 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -f 0 rule add from 172.20.0.2/32 lookup 200 pref 100
2025-11-19T20:22:38+04:00 INFO [routing] adding route for 0.0.0.0/0
2025-11-19T20:22:38+04:00 DEBUG [routing] ip route replace 0.0.0.0/0 via 172.20.0.1 dev eth0 table 200
2025-11-19T20:22:38+04:00 INFO [firewall] setting allowed subnets...
2025-11-19T20:22:38+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o eth0 -s 172.20.0.2 -d 192.168.1.0/24 -j ACCEPT
2025-11-19T20:22:38+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o eth0 -s 172.20.0.2 -d 172.20.0.0/16 -j ACCEPT
2025-11-19T20:22:38+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o eth0 -s 172.20.0.2 -d 192.168.70.0/24 -j ACCEPT
2025-11-19T20:22:38+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o eth0 -s 172.20.0.2 -d 172.19.0.0/24 -j ACCEPT
2025-11-19T20:22:38+04:00 INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.2 and family v4
2025-11-19T20:22:38+04:00 INFO [routing] adding route for 192.168.1.0/24
2025-11-19T20:22:38+04:00 DEBUG [routing] ip route replace 192.168.1.0/24 via 172.20.0.1 dev eth0 table 199
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -4 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -6 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -f 0 rule add to 192.168.1.0/24 lookup 199 pref 99
2025-11-19T20:22:38+04:00 INFO [routing] adding route for 172.20.0.0/16
2025-11-19T20:22:38+04:00 DEBUG [routing] ip route replace 172.20.0.0/16 via 172.20.0.1 dev eth0 table 199
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -4 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -6 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -f 0 rule add to 172.20.0.0/16 lookup 199 pref 99
2025-11-19T20:22:38+04:00 INFO [routing] adding route for 192.168.70.0/24
2025-11-19T20:22:38+04:00 DEBUG [routing] ip route replace 192.168.70.0/24 via 172.20.0.1 dev eth0 table 199
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -4 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -6 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -f 0 rule add to 192.168.70.0/24 lookup 199 pref 99
2025-11-19T20:22:38+04:00 INFO [routing] adding route for 172.19.0.0/24
2025-11-19T20:22:38+04:00 DEBUG [routing] ip route replace 172.19.0.0/24 via 172.20.0.1 dev eth0 table 199
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -4 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -6 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -f 0 rule add to 172.19.0.0/24 lookup 199 pref 99
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -4 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -6 rule list
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -f 0 rule add to 172.20.0.0/16 lookup 254 pref 98
2025-11-19T20:22:38+04:00 INFO [dns] filter updated: 0 hostnames, 0 IPs, 0 IP prefixes blocked
2025-11-19T20:22:38+04:00 INFO [dns] using plaintext DNS at address 8.8.8.8
2025-11-19T20:22:38+04:00 INFO [healthcheck] listening on 127.0.0.1:9999
2025-11-19T20:22:38+04:00 INFO [http server] http server listening on [::]:8000
2025-11-19T20:22:38+04:00 DEBUG [wireguard] Wireguard server public key: fHSz7nXioLz6qt+AoapT4ylVEkHTYpafdELZUmg4W3I=
2025-11-19T20:22:38+04:00 DEBUG [wireguard] Wireguard client private key: aCg...Hs=
2025-11-19T20:22:38+04:00 DEBUG [wireguard] Wireguard pre-shared key: [not set]
2025-11-19T20:22:38+04:00 INFO [firewall] allowing VPN connection...
2025-11-19T20:22:38+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -d 178.249.212.162 -o eth0 -p udp -m udp --dport 51820 -j ACCEPT
2025-11-19T20:22:38+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o tun0 -j ACCEPT
2025-11-19T20:22:38+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append OUTPUT -o tun0 -j ACCEPT
2025-11-19T20:22:38+04:00 INFO [wireguard] Connecting to 178.249.212.162:51820
2025-11-19T20:22:38+04:00 DEBUG [netlink] ip -f inet rule add lookup 51820 pref 101
2025-11-19T20:22:38+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2025-11-19T20:22:44+04:00 WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: dialing: dial tcp4 8.8.8.8:443: i/o timeout
2025-11-19T20:22:44+04:00 INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2025-11-19T20:22:44+04:00 INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION
2025-11-19T20:22:44+04:00 INFO [vpn] stopping
2025-11-19T20:22:44+04:00 DEBUG [wireguard] closing controller client...
2025-11-19T20:22:44+04:00 DEBUG [wireguard] removing IPv4 rule...
2025-11-19T20:22:44+04:00 DEBUG [netlink] ip -f inet rule del lookup 51820 pref 101
2025-11-19T20:22:44+04:00 DEBUG [wireguard] shutting down link...
2025-11-19T20:22:44+04:00 DEBUG [wireguard] deleting link...
2025-11-19T20:22:45+04:00 INFO [vpn] starting
2025-11-19T20:22:45+04:00 DEBUG [wireguard] Wireguard server public key: fHSz7nXioLz6qt+AoapT4ylVEkHTYpafdELZUmg4W3I=
2025-11-19T20:22:45+04:00 DEBUG [wireguard] Wireguard client private key: aCg...Hs=
2025-11-19T20:22:45+04:00 DEBUG [wireguard] Wireguard pre-shared key: [not set]
2025-11-19T20:22:45+04:00 INFO [firewall] allowing VPN connection...
2025-11-19T20:22:45+04:00 INFO [wireguard] Connecting to 178.249.212.162:51820
2025-11-19T20:22:45+04:00 DEBUG [netlink] ip -f inet rule add lookup 51820 pref 101
2025-11-19T20:22:45+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2025-11-19T20:22:51+04:00 WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: dialing: dial tcp4 8.8.8.8:443: i/o timeout
2025-11-19T20:22:51+04:00 INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2025-11-19T20:22:51+04:00 INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION
2025-11-19T20:22:51+04:00 INFO [vpn] stopping
2025-11-19T20:22:51+04:00 DEBUG [wireguard] closing controller client...
2025-11-19T20:22:51+04:00 DEBUG [wireguard] removing IPv4 rule...
2025-11-19T20:22:51+04:00 DEBUG [netlink] ip -f inet rule del lookup 51820 pref 101
2025-11-19T20:22:51+04:00 DEBUG [wireguard] shutting down link...
2025-11-19T20:22:51+04:00 DEBUG [wireguard] deleting link...
2025-11-19T20:22:51+04:00 INFO [vpn] starting
2025-11-19T20:22:51+04:00 DEBUG [wireguard] Wireguard server public key: fHSz7nXioLz6qt+AoapT4ylVEkHTYpafdELZUmg4W3I=
2025-11-19T20:22:51+04:00 DEBUG [wireguard] Wireguard client private key: aCg...Hs=
2025-11-19T20:22:51+04:00 DEBUG [wireguard] Wireguard pre-shared key: [not set]
2025-11-19T20:22:51+04:00 INFO [firewall] allowing VPN connection...
2025-11-19T20:22:51+04:00 INFO [wireguard] Connecting to 178.249.212.162:51820
2025-11-19T20:22:51+04:00 DEBUG [netlink] ip -f inet rule add lookup 51820 pref 101
2025-11-19T20:22:51+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2025-11-19T20:22:57+04:00 WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: dialing: dial tcp4 8.8.8.8:443: i/o timeout
2025-11-19T20:22:57+04:00 INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2025-11-19T20:22:57+04:00 INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION
2025-11-19T20:22:57+04:00 INFO [vpn] stopping
2025-11-19T20:22:57+04:00 DEBUG [wireguard] closing controller client...
2025-11-19T20:22:57+04:00 DEBUG [wireguard] removing IPv4 rule...
2025-11-19T20:22:57+04:00 DEBUG [netlink] ip -f inet rule del lookup 51820 pref 101
2025-11-19T20:22:57+04:00 DEBUG [wireguard] shutting down link...
2025-11-19T20:22:57+04:00 DEBUG [wireguard] deleting link...
2025-11-19T20:22:57+04:00 INFO [vpn] starting
2025-11-19T20:22:57+04:00 DEBUG [wireguard] Wireguard server public key: fHSz7nXioLz6qt+AoapT4ylVEkHTYpafdELZUmg4W3I=
2025-11-19T20:22:57+04:00 DEBUG [wireguard] Wireguard client private key: aCg...Hs=
2025-11-19T20:22:57+04:00 DEBUG [wireguard] Wireguard pre-shared key: [not set]
2025-11-19T20:22:57+04:00 INFO [firewall] allowing VPN connection...
2025-11-19T20:22:57+04:00 INFO [wireguard] Connecting to 178.249.212.162:51820
2025-11-19T20:22:57+04:00 DEBUG [netlink] ip -f inet rule add lookup 51820 pref 101
2025-11-19T20:22:57+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2025-11-19T20:23:03+04:00 WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: dialing: dial tcp4 8.8.8.8:443: i/o timeout
2025-11-19T20:23:03+04:00 INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2025-11-19T20:23:03+04:00 INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION
2025-11-19T20:23:03+04:00 INFO [vpn] stopping
2025-11-19T20:23:03+04:00 DEBUG [wireguard] closing controller client...
2025-11-19T20:23:03+04:00 DEBUG [wireguard] removing IPv4 rule...
2025-11-19T20:23:03+04:00 DEBUG [netlink] ip -f inet rule del lookup 51820 pref 101
2025-11-19T20:23:03+04:00 DEBUG [wireguard] shutting down link...
2025-11-19T20:23:03+04:00 DEBUG [wireguard] deleting link...
2025-11-19T20:23:03+04:00 INFO [vpn] starting
2025-11-19T20:23:03+04:00 DEBUG [wireguard] Wireguard server public key: fHSz7nXioLz6qt+AoapT4ylVEkHTYpafdELZUmg4W3I=
2025-11-19T20:23:03+04:00 DEBUG [wireguard] Wireguard client private key: aCg...Hs=
2025-11-19T20:23:03+04:00 DEBUG [wireguard] Wireguard pre-shared key: [not set]
2025-11-19T20:23:03+04:00 INFO [firewall] allowing VPN connection...
2025-11-19T20:23:03+04:00 INFO [wireguard] Connecting to 178.249.212.162:51820
2025-11-19T20:23:03+04:00 DEBUG [netlink] ip -f inet rule add lookup 51820 pref 101
2025-11-19T20:23:03+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2025-11-19T20:23:09+04:00 WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: dialing: dial tcp4 8.8.8.8:443: i/o timeout
2025-11-19T20:23:09+04:00 INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2025-11-19T20:23:09+04:00 INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION
2025-11-19T20:23:09+04:00 INFO [vpn] stopping
2025-11-19T20:23:09+04:00 DEBUG [wireguard] closing controller client...
2025-11-19T20:23:09+04:00 DEBUG [wireguard] removing IPv4 rule...
2025-11-19T20:23:09+04:00 DEBUG [netlink] ip -f inet rule del lookup 51820 pref 101
2025-11-19T20:23:09+04:00 DEBUG [wireguard] shutting down link...
2025-11-19T20:23:09+04:00 DEBUG [wireguard] deleting link...
2025-11-19T20:23:09+04:00 INFO [vpn] starting
2025-11-19T20:23:09+04:00 DEBUG [wireguard] Wireguard server public key: fHSz7nXioLz6qt+AoapT4ylVEkHTYpafdELZUmg4W3I=
2025-11-19T20:23:09+04:00 DEBUG [wireguard] Wireguard client private key: aCg...Hs=
2025-11-19T20:23:09+04:00 DEBUG [wireguard] Wireguard pre-shared key: [not set]
2025-11-19T20:23:09+04:00 INFO [firewall] allowing VPN connection...
2025-11-19T20:23:09+04:00 INFO [wireguard] Connecting to 178.249.212.162:51820
2025-11-19T20:23:09+04:00 DEBUG [netlink] ip -f inet rule add lookup 51820 pref 101
2025-11-19T20:23:09+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2025-11-19T20:23:15+04:00 WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: dialing: dial tcp4 8.8.8.8:443: i/o timeout
2025-11-19T20:23:15+04:00 INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md

Share your configuration

version: '3.8'

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - SYS_MODULE
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    network_mode: vpn-bridge
    restart: unless-stopped
    labels:
      - com.centurylinklabs.watchtower.enable=false
    security_opt:
      - no-new-privileges:true

    ports:
      - 8090:8090/tcp   # qBittorrent Web UI
      - 8091:8091/tcp   # qBittorrent Private (if used)
      - 8080:80/tcp # Speedtest Tracker
      - 8443:443/tcp # Speedtest Tracker HTTPS 
    environment:
      - PUID=1032
      - PGID=65536
      - TZ=Asia/Dubai

      # VPN config
      - LOG_LEVEL=debug
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - VPN_INTERFACE=tun0
      - SERVER_COUNTRIES=United Arab Emirates
      - WIREGUARD_IMPLEMENTATION=kernelspace
      - WIREGUARD_PRIVATE_KEY=xxxxxxxxxxxxxxxx
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_PROVIDER=protonvpn
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORTS}}}" http://127.0.0.1:8090/api/v2/app/setPreferences 2>&1'
      - VPN_PORT_FORWARDING_DOWN_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":123}" http://127.0.0.1:8090/api/v2/app/setPreferences 2>&1'

      - DNS_SERVER=on
      - DNS_ADDRESS=8.8.8.8
      - UPDATER_PROTONVPN_EMAIL=xxxxxxxx@gmail.com
      - UPDATER_PROTONVPN_PASSWORD=xxxxxxxxxxxxx

      - HEALTH_TARGET_ADDRESS=8.8.8.8:443
      - HEALTH_ICMP_TARGET_IP=8.8.8.8

      - FIREWALL_OUTBOUND_SUBNETS=192.168.1.0/24,172.20.0.0/16,192.168.70.0/24,172.19.0.0/24

      - UPDATER_PERIOD=1h
    
    volumes:
      - ./gluetun:/gluetun
      - /lib/modules:/lib/modules:ro

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[qdm12]

1. Try another VPN server?
2. Check your wireguard key is still valid, maybe re-generate one on protonvpn's side?

The ip it's connecting to is always the same and the error is always startup check: dialing: dial tcp4 8.8.8.8:443: i/o timeout which just indicates the connection is not working. I'm not sure I can help other than that 🤷
edit: Also note it's always startup check so it actually never manages to connect to the vpn server correctly

[KhaledMostafaME]

Using the same config sometimes it does connect to VPN and downloads up to 100 MB/s, but after that it fails and shuts down.

Wireguard key is valid and generated 2-3 days ago.

I tried other locations as well, and I got the same issue.

Sometimes I do get:
2025-11-19T22:50:35+04:00 ERROR [port forwarding] adding port mapping: executing remote procedure call: connection timeout: failed attempts: read udp 10.2.0.2:33398->10.2.0.1:5351: i/o timeout (tries 1, 2, 3, 4, 5, 6, 7, 8, 9)

I'm not sure, is there anything wrong with my config? When I try to change different configuration related to DNS I either get TLS Handshake issue, or failed to pass the healthcheck

[KhaledMostafaME]

After few mins of operational VPN, I always get

2025-11-19T23:10:12+04:00 ERROR HTTP response status is not OK: 500 500 Internal Server Error: small periodic check: all check tries failed: attempt 1 (5.000638308s): timed out waiting for ICMP echo reply, attempt 2 (5.000993419s): timed out waiting for ICMP echo reply, attempt 3 (5.001062469s): timed out waiting for ICMP echo reply, attempt 4 (10.000996698s): timed out waiting for ICMP echo reply, attempt 5 (10.000961167s): timed out waiting for ICMP echo reply, attempt 6 (10.001000498s): timed out waiting for ICMP echo reply, attempt 7 (15.000934006s):

[realeol]

Edit: This issue began with 3.40.1 (basically regarding the issues with ProtonVPN with iptables returning all.

Can confirm the issue.

On the latest release, everything works fine for a few minutes, then gluten fails the aforementioned Health Check. Identical error message, Synology, everything else basically the same. From what I have read it seems isolated to Proton VPN.
Sidenote: Although on newest release (release latest), the container manager warns about being 5 releases behind...
Can't find out more, yet, but happy to help with informations about needed info.

Sidenote: Since roughly 3 releases, I get an abnormal amount of DNS related Info / Warn messages (examples below):

• 2025-11-20T07:53:43+01:00 INFO [dns] response blocked for tracker.foreverpirates.co. because 127.0.0.1 is private and the question name is not local nor exempt from rebinding protection
• 2025-11-20T08:12:13+01:00 INFO [dns] response blocked for tracker.therarbg.to. because 84.54.51.78 belongs to the blocked IP prefix 84.54.51.0/24
• 2025-11-20T08:14:47+01:00 WARN [dns] dialing tls server for request IN A t.213891.xyz.: running TLS handshake with 1.0.0.1:853 (cloudflare-dns.com): read tcp 10.2.0.2:57468->1.0.0.1:853: read: connection reset by peer

The main issues appears to begin with the 3rd WARN.

[m32w]

Can confirm yesterday ProtonVPN stopped working for me, hatcheck restart gluetun every few minutes, the only option is to disable health checks and in qbittorent use external DNS. It somehow works but now i do have like 5% of bandwidth.

 sysctls:
      net.ipv6.conf.all.disable_ipv6: 1
    environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=
      - SERVER_COUNTRIES=Poland,germany,Netherlands
      - WIREGUARD_ADDRESSES=10.2.0.2/32
      #- SERVER_REGIONS=Europe
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on
      - DOT_PROVIDERS=cloudflare
      - TZ=PL

      - HEALTH_TARGET_ADDRESSES=microsoft.com:443,github.com:443
      - HEALTH_ICMP_TARGET_IPS=1.1.1.1,8.8.8.8
      - HEALTH_SERVER_ADDRESS= 127.0.0.1:8118

      #- FIREWALL_VPN_INPUT_PORTS=43362,19843
      #- DNS_UPSTREAM_RESOLVERS=opendns
      #- DNS_ADDRESS=1.1.1.1
      - DNS_SERVER=off
      #- DNS_UPSTREAM_RESOLVER_TYPE=doh #dot, doh or plain
      #DNS settings https://github.com/qdm12/gluetun-wiki/blob/main/setup/options/dns.md
      - FIREWALL_OUTBOUND_SUBNETS=192.168.0.0/16

[ClementG]

I saw in another topic to downgrade to a previous version. I apply it and it works for me !

 services:
   glueton:
     image: qmcgaw/gluetun:v3.40.1
 ...

[qdm12]

@KhaledMostafaME I've added HEALTH_SMALL_CHECK_TYPE which can be icmp or dns. Try pulling latest and setting it to dns to see if it changes anything. Maybe icmp is blocked by the VPN server 🤔 Also can you try to see if v3.39.1 work? Any point of reference when it was working fine?

Regarding

2025-11-19T22:50:35+04:00 ERROR [port forwarding] adding port mapping: executing remote procedure call: connection timeout: failed attempts: read udp 10.2.0.2:33398->10.2.0.1:5351: i/o timeout (tries 1, 2, 3, 4, 5, 6, 7, 8, 9)

Did you generate the wireguard config and ticked nat-pmp port forwarding, see qdm12/gluetun-wiki#145 (comment) ?

When I try to change different configuration related to DNS I either get TLS Handshake issue, or failed to pass the healthcheck

Possibly unrelated, TLS handshake errors on what exactly? I would need more information if you want to investigate that. The connection might be so bad it doesn't let "larger" packets like TLS go through. But imo, if tls can't go through, there is not much use of that connection.

---

The rest of you, answers below in this collapsible, but I'll mark your comments as off-topic since they seem unrelated and lack information. Please all of you try different release tags, different vpn servers. Debug a bit on your own so I can make something out of it. I do use protonvpn and it works perfectly fine on my side, so I can't debug your issues myself.

@realeol I'm not sure your issue is related:

iptables returning all

this is only on the latest image, v3.40.x are still using Alpine 3.20 and not the newer iptables

Although on newest release (release latest), the container manager warns about being 5 releases behind...

5 COMMITS behind, not releases. Which means there is a newer latest. But also you don't to upgrade on every commit 😉 !

Sidenote: Since roughly 3 releases, I get an abnormal amount of DNS related Info / Warn messages

Since v3.40.0, DNS system was replaced (Unbound to "in-house" solution), and my code does log warnings when failing queries. This is a lot more quiet now in the latest image and from future release v3.41.0, especially i/o timeouts are logged at the debug level now. On other log messages:

• response blocked for this is great so you don't pull your hair out. It explains why some resolutions don't go through on purpose. And then you could unblock some if needed / at your own risks. BTW tracker.foreverpirates.co resolving to 127.0.0.1 is kind of sketchy AFAIK.
• read: connection reset by peer means the connection died. More of a consequence than a cause!

---

@m32w yeah the connection just sucks, it's not really the healthcheck at fault. Again connection sucking causes healthcheck to fail, dns to fail etc. Don't mix cause and consequence.

---

@ClementG please be precise. Did you downgrade to v3.40.1? Or below that?

[KhaledMostafaME]

@KhaledMostafaME I've added HEALTH_SMALL_CHECK_TYPE which can be icmp or dns. Try pulling latest and setting it to dns to see if it changes anything. Maybe icmp is blocked by the VPN server 🤔 Also can you try to see if v3.39.1 work? Any point of reference when it was working fine?

Regarding

2025-11-19T22:50:35+04:00 ERROR [port forwarding] adding port mapping: executing remote procedure call: connection timeout: failed attempts: read udp 10.2.0.2:33398->10.2.0.1:5351: i/o timeout (tries 1, 2, 3, 4, 5, 6, 7, 8, 9)

Did you generate the wireguard config and ticked nat-pmp port forwarding, see qdm12/gluetun-wiki#145 (comment) ?

When I try to change different configuration related to DNS I either get TLS Handshake issue, or failed to pass the healthcheck

Possibly unrelated, TLS handshake errors on what exactly? I would need more information if you want to investigate that. The connection might be so bad it doesn't let "larger" packets like TLS go through. But imo, if tls can't go through, there is not much use of that connection.

The rest of you, answers below in this collapsible, but I'll mark your comments as off-topic since they seem unrelated and lack information. Please all of you try different release tags, different vpn servers. Debug a bit on your own so I can make something out of it. I do use protonvpn and it works perfectly fine on my side, so I can't debug your issues myself.

• Okay, I will add HEALTH_SMALL_CHECK_TYPE as dns with the latest image

• I'm not sure how to check if ICMP is blocked by VPN Server

• I will check both latest and 3.39.1 and will get back to you.

• Wireguard config does support port forwarding/nat-pmp.

• Please let me know what additional info do you need to troubleshoot the TLS handshake issue.

[ClementG]

As i said on my previous message, I downgrade to exactly 3.40.1.
I also use proton vpn as provider but in my case, i use OPENVPN instead wireguard.

Edit : And here is the topic where i found this solution : #2992

[KhaledMostafaME]

@qdm12 I've pulled the latest image, and added HEALTH_SMALL_CHECK_TYPE=dns and the vpn didn't get connected

Running version latest built on 2025-11-19T16:15:49.538Z (commit 9f39d47)

Do you suggest any changes on the config below?

version: '3.8'

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - SYS_MODULE
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    network_mode: vpn-bridge
    restart: unless-stopped
    labels:
      - com.centurylinklabs.watchtower.enable=false
    security_opt:
      - no-new-privileges:true

    ports:
      - 8090:8090/tcp   # qBittorrent Web UI
      - 8091:8091/tcp   # qBittorrent Private (if used)
      - 8080:80/tcp # Speedtest Tracker
      - 8443:443/tcp # Speedtest Tracker HTTPS 
    environment:
      - PUID=1032
      - PGID=65536
      - TZ=Asia/Dubai

      # VPN config
      - LOG_LEVEL=debug
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - VPN_INTERFACE=tun0
      #- SERVER_COUNTRIES=Qatar,Morocco
      - SERVER_COUNTRIES=United Arab Emirates
      #- SERVER_COUNTRIES=Qatar,United Arab Emirates,Singapore
      - WIREGUARD_IMPLEMENTATION=kernelspace
      #- WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
      - WIREGUARD_PRIVATE_KEY=
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_PROVIDER=protonvpn
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORTS}}}" http://127.0.0.1:8090/api/v2/app/setPreferences 2>&1'
      - VPN_PORT_FORWARDING_DOWN_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":123}" http://127.0.0.1:8090/api/v2/app/setPreferences 2>&1'

      - DNS_SERVER=on
      - DNS_ADDRESS=8.8.8.8
      - UPDATER_PROTONVPN_EMAIL=
      - UPDATER_PROTONVPN_PASSWORD=

      - HEALTH_SMALL_CHECK_TYPE=dns
      - FIREWALL_OUTBOUND_SUBNETS=192.168.1.0/24,192.168.70.0/24

      - UPDATER_PERIOD=1h
    
    volumes:
      - ./gluetun:/gluetun
      - /lib/modules:/lib/modules:ro

2025-11-20T19:48:13+04:00 ERROR HTTP response status is not OK: 500 500
Internal Server Error: startup check: all check tries failed: parallel attempt 1/2 failed:
dialing: dial tcp4: lookup github.com: i/o timeout, parallel attempt 2/2 failed: dialing:
dial tcp4: lookup cloudflare.com: i/o timeout 2025-11-20T19:48:13+04:00 INFO
Shutdown successful

[KhaledMostafaME]

With qmcgaw/gluetun:v3.40.1

I'm getting the below.

2025-11-20T20:03:56+04:00 ERROR [vpn] getting public IP address information: context canceled
2025-11-20T20:03:56+04:00 DEBUG [netlink] ip -f inet rule del lookup 51820 pref 101
2025-11-20T20:03:56+04:00 DEBUG [wireguard] shutting down link...
2025-11-20T20:03:56+04:00 ERROR [vpn] cannot get version information: Get "https://api.github.com/repos/qdm12/gluetun/releases": context canceled
2025-11-20T20:03:56+04:00 INFO [port forwarding] starting
2025-11-20T20:03:56+04:00 DEBUG [wireguard] deleting link...
2025-11-20T20:03:56+04:00 ERROR [vpn] starting port forwarding service: getting VPN local gateway IP: VPN local gateway IP address not found: in 12 routes
2025-11-20T20:03:56+04:00 INFO [vpn] starting
2025-11-20T20:03:56+04:00 DEBUG [wireguard] Wireguard server public key: fHSz7nXioLz6qt+AoapT4ylVEkHTYpafdELZUmg4W3I=
2025-11-20T20:03:56+04:00 DEBUG [wireguard] Wireguard client private key: aCg...Hs=
2025-11-20T20:03:56+04:00 DEBUG [wireguard] Wireguard pre-shared key: [not set]
2025-11-20T20:03:56+04:00 INFO [firewall] allowing VPN connection...
2025-11-20T20:03:56+04:00 INFO [wireguard] Connecting to 178.249.212.162:51820
2025-11-20T20:03:56+04:00 DEBUG [netlink] ip -f inet rule add lookup 51820 pref 101
2025-11-20T20:03:56+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2025-11-20T20:04:06+04:00 ERROR [vpn] getting public IP address information: fetching information: Get "https://ipinfo.io/": dial tcp: lookup ipinfo.io on 8.8.8.8:53: read udp 10.2.0.2:45187->8.8.8.8:53: i/o timeout
2025-11-20T20:04:06+04:00 INFO [port forwarding] starting
2025-11-20T20:04:08+04:00 INFO [healthcheck] program has been unhealthy for 11s: restarting VPN (healthcheck error: dialing: dial tcp4: lookup cloudflare.com: i/o timeout)
2025-11-20T20:04:08+04:00 INFO [healthcheck] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2025-11-20T20:04:08+04:00 INFO [healthcheck] DO NOT OPEN AN ISSUE UNLESS YOU READ AND TRIED EACH POSSIBLE SOLUTION
2025-11-20T20:04:08+04:00 INFO [vpn] stopping

[qdm12]

@KhaledMostafaME Do you ever manage to connect and establish any connection at all with anything? From all the logs and information you shared so far, it looks like it never manages to connect to anything (startup checks failing whether icmp or plain dns udp). When was it last working?

[KhaledMostafaME]

@KhaledMostafaME Do you ever manage to connect and establish any connection at all with anything? From all the logs and information you shared so far, it looks like it never manages to connect to anything (startup checks failing whether icmp or plain dns udp). When was it last working?

@qdm12 , yes sometimes it does work normally for few mins in same location or different locations.

These days it's working but not stable, last working with stability was about 2 weeks ago, don't remember which commit it was.

[KhaledMostafaME]

Running version latest built on 2025-11-19T16:15:49.538Z (commit 9f39d47)
🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2025-11-21T02:46:33+04:00 INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.4 and family v4
2025-11-21T02:46:33+04:00 INFO [routing] local ethernet link found: eth0
2025-11-21T02:46:33+04:00 INFO [routing] local ipnet found: 172.20.0.0/16
2025-11-21T02:46:33+04:00 INFO [firewall] enabling...
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --policy INPUT DROP
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --policy OUTPUT DROP
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --policy FORWARD DROP
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --policy INPUT DROP
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --policy OUTPUT DROP
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --policy FORWARD DROP
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -i lo -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append INPUT -i lo -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o lo -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append OUTPUT -o lo -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o eth0 -s 172.20.0.4 -d 172.20.0.0/16 -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append OUTPUT -o eth0 -d ff02::1:ff00:0/104 -j ACCEPT
2025-11-21T02:46:33+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -i eth0 -d 172.20.0.0/16 -j ACCEPT
2025-11-21T02:46:33+04:00 INFO [firewall] enabled successfully
2025-11-21T02:46:34+04:00 INFO [storage] merging by most recent 20962 hardcoded servers and 20962 servers read from /gluetun/servers.json
2025-11-21T02:46:35+04:00 DEBUG [netlink] IPv6 is not supported after searching 0 routes
2025-11-21T02:46:35+04:00 INFO Alpine version: 3.22.2
2025-11-21T02:46:35+04:00 INFO OpenVPN 2.5 version: 2.5.10
2025-11-21T02:46:35+04:00 INFO OpenVPN 2.6 version: 2.6.14
2025-11-21T02:46:35+04:00 INFO IPtables version: v1.8.11
2025-11-21T02:46:35+04:00 INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: protonvpn
|   |   ├── Server selection settings:
|   |   |   ├── VPN type: wireguard
|   |   |   ├── Countries: united arab emirates
|   |   |   ├── Port forwarding only servers: yes
|   |   |   └── Wireguard selection settings:
|   |   └── Automatic port forwarding settings:
|   |       ├── Redirection listening port: disabled
|   |       ├── Use code for provider: protonvpn
|   |       ├── Forwarded port file path: /tmp/gluetun/forwarded_port
|   |       ├── Forwarded port up command: /bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORTS}}}" http://127.0.0.1:8090/api/v2/app/setPreferences 2>&1'
|   |       └── Forwarded port down command: /bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":123}" http://127.0.0.1:8090/api/v2/app/setPreferences 2>&1'
|   └── Wireguard settings:
|       ├── Private key: aCg...Hs=
|       ├── Interface addresses:
|       |   └── 10.2.0.2/32
|       ├── Allowed IPs:
|       |   ├── 0.0.0.0/0
|       |   └── ::/0
|       ├── Network interface: tun0
|       |   └── MTU: 1320
|       └── Implementation: kernelspace
├── DNS settings:
|   ├── Keep existing nameserver(s): no
|   ├── DNS server address to use: 8.8.8.8
|   ├── DNS forwarder server enabled: yes
|   ├── Upstream resolver type: dot
|   ├── Upstream resolvers:
|   |   └── cloudflare
|   ├── Caching: yes
|   ├── IPv6: no
|   ├── Update period: every 24h0m0s
|   └── DNS filtering settings:
|       ├── Block malicious: yes
|       ├── Block ads: no
|       └── Block surveillance: no
├── Firewall settings:
|   ├── Enabled: yes
|   └── Outbound subnets:
|       ├── 192.168.1.0/24
|       └── 192.168.70.0/24
├── Log settings:
|   └── Log level: debug
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target addresses:
|   |   ├── microsoft.com:443
|   |   └── google.com:443
|   ├── ICMP target IPs:
|   |   ├── 1.1.1.1
|   |   └── 8.8.8.8
|   └── Restart VPN on healthcheck failure: yes
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 1032
|   ├── Process GID: 65536
|   └── Timezone: asia/dubai
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
├── Server data updater settings:
|   ├── Update period: 1h0m0s
|   ├── DNS address: 1.1.1.1:53
|   ├── Minimum ratio: 0.8
|   ├── Providers to update: protonvpn
|   ├── Proton API email: khaledmostafame@gmail.com
|   └── Proton API password: [set]
└── Version settings:
    └── Enabled: yes
2025-11-21T02:46:35+04:00 WARN DNS address is set to 8.8.8.8 so the local forwarding DNS server will not be used. The default value changed to 127.0.0.1 so it uses the internal DNS server. If this server fails to start, the IPv4 address of the first plaintext DNS server corresponding to the first DNS provider chosen is used.
2025-11-21T02:46:35+04:00 INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.4 and family v4
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -4 rule list
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -6 rule list
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -f 0 rule add from 172.20.0.4/32 lookup 200 pref 100
2025-11-21T02:46:35+04:00 INFO [routing] adding route for 0.0.0.0/0
2025-11-21T02:46:35+04:00 DEBUG [routing] ip route replace 0.0.0.0/0 via 172.20.0.1 dev eth0 table 200
2025-11-21T02:46:35+04:00 INFO [firewall] setting allowed subnets...
2025-11-21T02:46:35+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o eth0 -s 172.20.0.4 -d 192.168.1.0/24 -j ACCEPT
2025-11-21T02:46:35+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o eth0 -s 172.20.0.4 -d 192.168.70.0/24 -j ACCEPT
2025-11-21T02:46:35+04:00 INFO [routing] default route found: interface eth0, gateway 172.20.0.1, assigned IP 172.20.0.4 and family v4
2025-11-21T02:46:35+04:00 INFO [routing] adding route for 192.168.1.0/24
2025-11-21T02:46:35+04:00 DEBUG [routing] ip route replace 192.168.1.0/24 via 172.20.0.1 dev eth0 table 199
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -4 rule list
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -6 rule list
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -f 0 rule add to 192.168.1.0/24 lookup 199 pref 99
2025-11-21T02:46:35+04:00 INFO [routing] adding route for 192.168.70.0/24
2025-11-21T02:46:35+04:00 DEBUG [routing] ip route replace 192.168.70.0/24 via 172.20.0.1 dev eth0 table 199
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -4 rule list
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -6 rule list
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -f 0 rule add to 192.168.70.0/24 lookup 199 pref 99
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -4 rule list
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -6 rule list
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -f 0 rule add to 172.20.0.0/16 lookup 254 pref 98
2025-11-21T02:46:35+04:00 INFO [dns] filter updated: 0 hostnames, 0 IPs, 0 IP prefixes blocked
2025-11-21T02:46:35+04:00 INFO [healthcheck] listening on 127.0.0.1:9999
2025-11-21T02:46:35+04:00 INFO [dns] using plaintext DNS at address 8.8.8.8
2025-11-21T02:46:35+04:00 INFO [http server] http server listening on [::]:8000
2025-11-21T02:46:35+04:00 DEBUG [wireguard] Wireguard server public key: fHSz7nXioLz6qt+AoapT4ylVEkHTYpafdELZUmg4W3I=
2025-11-21T02:46:35+04:00 DEBUG [wireguard] Wireguard client private key: aCg...Hs=
2025-11-21T02:46:35+04:00 DEBUG [wireguard] Wireguard pre-shared key: [not set]
2025-11-21T02:46:35+04:00 INFO [firewall] allowing VPN connection...
2025-11-21T02:46:35+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -d 178.249.212.162 -o eth0 -p udp -m udp --dport 51820 -j ACCEPT
2025-11-21T02:46:35+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append OUTPUT -o tun0 -j ACCEPT
2025-11-21T02:46:35+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append OUTPUT -o tun0 -j ACCEPT
2025-11-21T02:46:35+04:00 INFO [wireguard] Connecting to 178.249.212.162:51820
2025-11-21T02:46:35+04:00 DEBUG [netlink] ip -f inet rule add lookup 51820 pref 101
2025-11-21T02:46:35+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2025-11-21T02:46:41+04:00 INFO [dns] downloading hostnames and IP block lists
2025-11-21T02:46:45+04:00 INFO [dns] filter updated: 727299 hostnames, 40757 IPs, 4439 IP prefixes blocked
2025-11-21T02:46:45+04:00 INFO [dns] DNS server listening on [::]:53
2025-11-21T02:46:45+04:00 INFO [dns] ready
2025-11-21T02:46:46+04:00 INFO [ip getter] Public IP address is 84.252.115.3 (France, Provence-Alpes-Côte d'Azur, Marseille - source: ipinfo)
2025-11-21T02:46:48+04:00 INFO [vpn] You are running 7 commits behind the most recent latest
2025-11-21T02:46:48+04:00 INFO [port forwarding] starting
2025-11-21T02:46:48+04:00 INFO [port forwarding] gateway external IPv4 address is 84.252.115.3
2025-11-21T02:46:49+04:00 INFO [port forwarding] port forwarded is 40695
2025-11-21T02:46:49+04:00 INFO [firewall] setting allowed input port 40695 through interface tun0...
2025-11-21T02:46:49+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -i tun0 -p tcp -m tcp --dport 40695 -j ACCEPT
2025-11-21T02:46:49+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append INPUT -i tun0 -p tcp -m tcp --dport 40695 -j ACCEPT
2025-11-21T02:46:49+04:00 DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -i tun0 -p udp -m udp --dport 40695 -j ACCEPT
2025-11-21T02:46:49+04:00 DEBUG [firewall] /usr/sbin/ip6tables-legacy --append INPUT -i tun0 -p udp -m udp --dport 40695 -j ACCEPT
2025-11-21T02:46:49+04:00 INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2025-11-21T02:46:49+04:00 INFO [port forwarding] --2025-11-21 02:46:49--  http://127.0.0.1:8090/api/v2/app/setPreferences
2025-11-21T02:46:49+04:00 INFO [port forwarding] Connecting to 127.0.0.1:8090... connected.
2025-11-21T02:46:49+04:00 INFO [port forwarding] HTTP request sent, awaiting response... 200 OK
2025-11-21T02:46:49+04:00 INFO [port forwarding] Length: 0 [text/plain]
2025-11-21T02:46:49+04:00 INFO [port forwarding] Saving to: 'STDOUT'
2025-11-21T02:46:49+04:00 INFO [port forwarding] 
2025-11-21T02:46:49+04:00 INFO [port forwarding]      0K                                                        0.00 =0s
2025-11-21T02:46:49+04:00 INFO [port forwarding] 
2025-11-21T02:46:49+04:00 INFO [port forwarding] 2025-11-21 02:46:49 (0.00 B/s) - written to stdout [0/0]
2025-11-21T02:46:49+04:00 INFO [port forwarding] 
2025-11-21T02:47:34+04:00 DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-11-21T02:47:46+04:00 DEBUG [healthcheck] ICMP echo attempt 1/10 failed: timed out waiting for ICMP echo reply
2025-11-21T02:47:51+04:00 DEBUG [healthcheck] ICMP echo attempt 2/10 failed: timed out waiting for ICMP echo reply
2025-11-21T02:47:56+04:00 DEBUG [healthcheck] ICMP echo attempt 3/10 failed: timed out waiting for ICMP echo reply
2025-11-21T02:48:06+04:00 DEBUG [healthcheck] ICMP echo attempt 4/10 failed: timed out waiting for ICMP echo reply
2025-11-21T02:48:16+04:00 DEBUG [healthcheck] ICMP echo attempt 5/10 failed: timed out waiting for ICMP echo reply
2025-11-21T02:48:38+04:00 DEBUG [port forwarding] port forwarded 40695 maintained
2025-11-21T02:49:23+04:00 DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-11-21T02:49:23+04:00 DEBUG [port forwarding] port forwarded 40695 maintained
2025-11-21T02:50:08+04:00 DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-11-21T02:50:09+04:00 DEBUG [port forwarding] port forwarded 40695 maintained