Bug: PUT /v1/portforward "failed setting forwarded ports"

[nzoba]

Is this urgent?

No

Host OS

UGOSPRO Linux (based on Debian)

CPU arch

x86_64

VPN service provider

Windscribe

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-06-29T11:29:25.299Z (commit 93cc5a4) on Linux 6.12.30+ (x86_64)

What's the problem 🤔

Hi,

I'm trying to script the automatic renewal of the ephemeral forwarding port on Windscribe.
For the gluetun part, I'm using the endpoint PUT /v1/portforward.
But when I call this endpoint I have this error

WARN [http server] failed setting forwarded ports: setting port forwarded at runtime is not supported with internally running port forwarding code

I'm note using the VPN_PORT_FORWARDING=on option since it's not compatible with Windscribe.

I may be wrong but I think the commit a1ef736 which was supposed to block the endpoint when VPN_PORT_FORWARDING is ON is also blocking when it's OFF.

I tried removing the FIREWALL_VPN_INPUT_PORTS but it did not change anything.

Share your logs (at least 10 lines)

2026-07-02T01:00:51+02:00 INFO [routing] default route found: interface eth0, gateway 172.28.101.1, assigned IP 172.28.101.3 and family v4
2026-07-02T01:00:51+02:00 INFO [routing] local ethernet link found: eth0
2026-07-02T01:00:51+02:00 INFO [routing] local ipnet found: 172.28.101.0/24
2026-07-02T01:00:51+02:00 INFO [firewall] enabling...
2026-07-02T01:00:52+02:00 INFO [firewall] enabled successfully
2026-07-02T01:00:52+02:00 INFO [storage] merging by most recent 27405 hardcoded servers and 27397 servers read from manifest file /gluetun/servers/manifest.json
2026-07-02T01:00:52+02:00 INFO [storage] Using windscribe servers from file which are 59 days more recent
2026-07-02T01:00:52+02:00 INFO Alpine version: 3.23.5
2026-07-02T01:00:52+02:00 INFO OpenVPN version: 2.6.20
2026-07-02T01:00:52+02:00 INFO Firewall version: iptables v1.8.11
2026-07-02T01:00:52+02:00 INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: windscribe
|   |   └── Server selection settings:
|   |       ├── VPN type: wireguard
|   |       ├── Cities: frankfurt
|   |       └── Wireguard selection settings:
|   ├── Wireguard settings:
|   |   ├── Private key: 8Oa...F0=
|   |   ├── Pre-shared key: CmI...2U=
|   |   ├── Interface addresses:
|   |   |   └── 100.92.188.194/32
|   |   ├── Allowed IPs:
|   |   |   ├── 0.0.0.0/0
|   |   |   └── ::/0
|   |   └── Network interface: tun0
|   |       └── MTU: 1360
|   └── Path MTU discovery:
|       ├── ICMP addresses:
|       |   ├── 1.1.1.1
|       |   └── 8.8.8.8
|       └── TCP addresses:
|           ├── 1.1.1.1:443
|           ├── 8.8.8.8:443
|           ├── 1.1.1.1:53
|           ├── 8.8.8.8:53
|           ├── [2606:4700:4700::1111]:53
|           ├── [2001:4860:4860::8888]:53
|           ├── [2606:4700:4700::1111]:443
|           └── [2001:4860:4860::8888]:443
├── DNS settings:
|   ├── Upstream resolver type: dot
|   ├── Upstream resolvers:
|   |   └── Cloudflare
|   ├── Caching: yes
|   ├── IPv6: no
|   ├── Update period: every 24h0m0s
|   └── DNS filtering settings:
|       ├── Block malicious: yes
|       └── Block ads: no
├── Firewall settings:
|   ├── Enabled: yes
|   ├── Iptables settings:
|   |   └── Log level: info
|   └── VPN input ports:
|       └── 10830
├── Log settings:
|   └── Log level: info
├── IPv6 settings:
|   └── Check addresses:
|       ├── [2001:4860:4860::8888]:53
|       └── [2606:4700:4700::1111]:53
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target addresses:
|   |   ├── cloudflare.com:443
|   |   └── github.com:443
|   ├── Small health check type: ICMP echo request
|   |   └── ICMP target IPs:
|   |       ├── 1.1.1.1
|   |       └── 8.8.8.8
|   └── Restart VPN on healthcheck failure: yes
├── SOCKS5 proxy server settings:
|   └── Enabled: no
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Servers directory path: /gluetun/servers/
├── OS Alpine settings:
|   ├── Process UID: 1003
|   ├── Process GID: 1001
|   └── Timezone: europe/paris
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
├── Server data updater settings:
|   ├── Update period: 24h0m0s
|   ├── Minimum ratio: 0.8
|   ├── Providers to update: windscribe
|   └── Prefer direct download: no
└── Version settings:
    └── Enabled: yes
2026-07-02T01:00:52+02:00 INFO [routing] default route found: interface eth0, gateway 172.28.101.1, assigned IP 172.28.101.3 and family v4
2026-07-02T01:00:52+02:00 INFO [routing] adding route for 0.0.0.0/0
2026-07-02T01:00:52+02:00 INFO [firewall] setting allowed subnets...
2026-07-02T01:00:52+02:00 INFO [routing] default route found: interface eth0, gateway 172.28.101.1, assigned IP 172.28.101.3 and family v4
2026-07-02T01:00:52+02:00 INFO [healthcheck] listening on 127.0.0.1:9999
2026-07-02T01:00:52+02:00 INFO [http server] read 2 roles from authentication file
2026-07-02T01:00:52+02:00 INFO [http server] http server listening on [::]:8000
2026-07-02T01:00:52+02:00 INFO [firewall] allowing VPN connection...
2026-07-02T01:00:52+02:00 INFO [wireguard] Using available kernelspace implementation
2026-07-02T01:00:52+02:00 INFO [wireguard] Connecting to 149.36.50.3:1194
2026-07-02T01:00:52+02:00 INFO [vpn] wireguard setup is complete. Note wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the wireguard connection is not working.
2026-07-02T01:00:52+02:00 INFO [firewall] setting allowed input port 10830 through interface tun0...
2026-07-02T01:00:52+02:00 INFO [dns] DNS server listening on [::]:53
2026-07-02T01:00:52+02:00 INFO [dns] ready and using DNS server with dot upstream resolvers
2026-07-02T01:00:52+02:00 INFO [dns] downloading hostnames and IP block lists
2026-07-02T01:00:53+02:00 INFO [dns] leak check report: 149.36.50.1 (50%), 172.70.245.164 (10%), 172.68.24.44 (5%), 172.68.24.45 (5%), 172.70.241.124 (5%), 172.70.241.125 (5%), 172.70.244.42 (5%), 172.70.245.166 (5%), 172.70.249.51 (5%), 172.71.140.41 (5%)
2026-07-02T01:00:53+02:00 INFO [ip getter] Public IP address is 149.36.50.12 (Germany, Hesse, Frankfurt am Main - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-07-02T01:00:53+02:00 INFO [vpn] You are running on the bleeding edge of latest!
2026-07-02T01:01:03+02:00 WARN [http server] failed setting forwarded ports: setting port forwarded at runtime is not supported with internally running port forwarding code
2026-07-02T01:01:03+02:00 INFO [http server] 500 PUT /v1/portforward wrote 31B to 172.28.101.12:52570 in 150.813µs

Share your configuration

# docker-compose.yaml
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    security_opt:
      - no-new-privileges:true
    pids_limit: 100
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - SETGID
      - SETUID
      - NET_ADMIN
      - NET_RAW
    devices:
      - /dev/net/tun:/dev/net/tun
    # ports:
    #   - 8888:8888/tcp # HTTP proxy
    #   - 8388:8388/tcp # Shadowsocks
    #   - 8388:8388/udp # Shadowsocks
    #   - 8080:8080 # qbittorrent
    #   - 9696:9696 # prowlarr
    #   - 8191:8191 # flaresolverr
    volumes:
      - ${DATA_PATH}/gluetun:/gluetun
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - VPN_SERVICE_PROVIDER=windscribe
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
      - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
      - WIREGUARD_PRESHARED_KEY=${WIREGUARD_PRESHARED_KEY}
      - WIREGUARD_MTU=1360
      - SERVER_CITIES=Frankfurt
      - TZ=${TZ}
      - UPDATER_PERIOD=24h
      - FIREWALL_VPN_INPUT_PORTS=${FIREWALL_VPN_INPUT_PORTS}
    restart: unless-stopped
    labels:
      - deunhealth.restart.on.unhealthy=true
    networks:
      - arr-stack



# config.toml
[[roles]]
name = "port-renewal"
routes = ["PUT /v1/portforward"]
auth = "apikey"
apikey = "my_api_key"

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[pradhyumk]

I would like to bump this issue as well. I am using AirVPN and my forwarded port was closed, despite setting FIREWALL_VPN_INPUT_PORTS.

Reverting to Docker tag pr-2537 worked.