Bug: conntrack flush fails on older kernels (4.4.x)

[mrwogu]

Is this urgent?

No

Host OS

Synology NAS (DSM)

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-02-23T20:46:41.174Z (commit 625a63e)

What's the problem 🤔

conntrack flush fails on older kernels (4.4.x) - "netlink receive: invalid argument"

After the recent commit [625a63e] that added conntrack flushing on startup, gluetun fails to start on hosts running older kernels.

Error

ERROR flushing conntrack: netfilter query: netlink receive: invalid argument

Environment

• Kernel: 4.4.302+
• VPN provider: ProtonVPN
• VPN type: WireGuard

nf_conntrack module status

The module is loaded and functional with 8 dependents:

nf_conntrack_ipv6       6656  2
nf_defrag_ipv6          6487  1 nf_conntrack_ipv6
nf_conntrack_ipv4      11666  20
nf_defrag_ipv4          1539  1 nf_conntrack_ipv4
nf_conntrack           62242  8 ip_vs,nf_nat,xt_state,nf_nat_ipv4,xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_ipv4,nf_conntrack_ipv6

Analysis

The nf_conntrack kernel module is loaded and working, but the netlink conntrack flush API used by github.com/ti-mo/conntrack appears to require a newer kernel. Kernel 4.4.x may not support all NFNL_SUBSYS_CTNETLINK message types or flags that the library sends.

Expected behavior

Gluetun should either:

1. Gracefully handle the conntrack flush failure (log a warning instead of a fatal error), or
2. Detect kernel compatibility before attempting the flush

Suggested fix

Treat conntrack flush failure as non-fatal - a warning rather than a startup-blocking error. The flush is an optimization (clearing stale connections), not a requirement for VPN functionality.

Workaround

Pinning to a gluetun version released before this commit (v3.41.1)

Share your logs (at least 10 lines)

2026-02-23T22:45:25+01:00 ERROR flushing conntrack: netfilter query: netlink receive: invalid argument
2026-02-23T22:45:25+01:00 INFO Shutdown successful

Share your configuration

`cap_add: NET_ADMIN` is set
`/dev/net/tun` mounted

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[ok1ok1]

Same problem. Reverted to last stable.

[aaronmitchellharris]

I'm also experiencing this

[THX723]

is there a workaround without reverting to previous build?

[dustin-hawkins]

qmcgaw/gluetun:v3.41.0 confirmed working on Synology

[LinkPhoenix]

The recent change in commit 625a63e adding FlushConntrack() after firewall activation breaks Gluetun on NAS hardware like Synology DS918+ (and so many other models) running Docker.

Root cause: NAS kernels (DSM ~4.4) lack conntrack/netfilter modules (nft_compat, xt_conntrack) or container permissions for ti-mo/conntrack library. Error: ERROR flushing conntrack: netfilter query: netlink receive: invalid argument.

Impact: Container fails to start on latest qmcgaw/gluetun image. Works fine on v3.41.0 (pre-commit).

Only workaround: Pin to qmcgaw/gluetun:v3.41.0 in docker-compose.yml:

image: qmcgaw/gluetun:v3.41.0

No kernel module hacks possible on stock DSM. FIREWALL=off also bypasses but loses killswitch.

Suggested fix: Add env flag to disable conntrack flush (e.g. FLUSH_CONNTRACK=false) for NAS users, with graceful error handling instead of hard failure.

Tested on DS918+ DSM 7.x - confirmed working on v3.41.0. Please backport or add compatibility.
M

[janusloo]

I am also having this issue on my Synology DS-920+. Can confirm that it works after pinning version v3.41.0. Hope for a good solution in the next commit. thanks !!

[barto28]

Same issue here on DSM latest. gluetun:v3.41.0 did the trick :)

[mrtnd]

Same on Synology DS720+. Previous images works.

[BeutelHeu]

Same issue here on DSM latest. gluetun:v3.41.0 did the trick :)

3.41.1 works too

[JPar99]

Same behaviour on Synology, DS220+, DS225+ and DS723+.

Can verify that commit 625a63e
is the culprit. Reverted back to latest stable v3.41.1 which works.

[mrtnd]

The latest release that works is from 2 weeks ago. This one https://github.com/qdm12/gluetun/releases/tag/v3.41.1
The release that doesn't work and points to "latest" on docker is from 13 hours ago and as of now it is not yet published as a release on github.

[LinkPhoenix]

⚠️There is no need to say “confirmation on my NAS...” ⚠️

This affects many NAS devices (and surely other peripherals), and all the information is in :
original post and other explanations in my posts above.

A PR has been opened (thank JPar99). For now, you have the solution: stay on version 3.41.0 and wait for a new version that resolves this issue to be released.

image: qmcgaw/gluetun:v3.41.0

So please be patient, the developer is the only one maintaining this fabulous project.