vanja/gluetun
1
0
Fork 0
mirror of https://github.com/qdm12/gluetun.git synced 2026-08-14 00:03:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Big rework of the wiki

Quentin McGaw (desktop)
2021-09-16 16:08:25 -04:00
parent 69741f8d64
commit 6a6b56853d
58 changed files with 1396 additions and 946 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Advanced setup/DNS options.md
+21
@@ -0,0 +1,21 @@
## Environment variables
💁 The following environment variables are all optional.
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `DOT` | `on` | `on`, `off` | Activate DNS over TLS with Unbound |
| `DOT_PROVIDERS` | `cloudflare` | `cloudflare`, `google`, `quad9`, `quadrant`, `cleanbrowsing` | Comma delimited list of DNS over TLS providers |
| `DOT_CACHING` | `on` | `on`, `off` | Unbound caching |
| `DOT_IPV6` | `off` | `on`, `off` | DNS IPv6 resolution |
| `DOT_PRIVATE_ADDRESS` | All private CIDRs ranges | | Comma separated list of CIDRs or single IP addresses Unbound won't resolve to. Note that the default setting prevents DNS rebinding |
| `DOT_VERBOSITY` | `1` | `0` to `5` | Unbound verbosity level |
| `DOT_VERBOSITY_DETAILS` | `0` | `0` to `4` | Unbound details verbosity level |
| `DOT_VALIDATION_LOGLEVEL` | `0` | `0` to `2` | Unbound validation log level |
| `DNS_UPDATE_PERIOD` | `24h` | i.e. `0`, `30s`, `5m`, `24h` | Period to update block lists and cryptographic files and restart Unbound. Set to `0` to deactivate updates |
| `BLOCK_MALICIOUS` | `on` | `on`, `off` | Block malicious hostnames and IPs with Unbound |
| `BLOCK_SURVEILLANCE` | `off` | `on`, `off` | Block surveillance hostnames and IPs with Unbound |
| `BLOCK_ADS` | `off` | `on`, `off` | Block ads hostnames and IPs with Unbound |
| `UNBLOCK` | |i.e. `domain1.com,x.domain2.co.uk` | Comma separated list of domain names to leave unblocked with Unbound |
| `DNS_PLAINTEXT_ADDRESS` | `1.1.1.1` | Any IP address | IP address to use as DNS resolver if `DOT` is `off` |
| `DNS_KEEP_NAMESERVER` | `off` | `on` or `off` | Keep the nameservers in /etc/resolv.conf untouched, but disabled DNS blocking features |
Setup/Docker secrets.md → Advanced setup/Docker secrets.md
+2 -2
@@ -1,5 +1,7 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.docker-secrets)
💁 Note this is **a bit pointless**, since gluetun already takes care of unsetting sensitive environment variables after reading them at start.
If you use Docker Compose or Docker Swarm, you can optionally use [Docker secret files](https://docs.docker.com/engine/swarm/secrets/) for all sensitive values such as your Openvpn credentials, instead of using environment variables.
The following secrets can be used:
@@ -14,5 +16,3 @@ The following secrets can be used:
Note that you can change the secret file path in the container by changing the environment variable in the form `<capitalizedSecretName>_SECRETFILE`.
For example, `OPENVPN_PASSWORD_SECRETFILE` defaults to `/run/secrets/openvpn_password` which you can change.
💁 This is really more of an option than a necessity, since all these sensitive inputs are read by gluetun and then written as files in the container, and gluetun already takes care of unsetting sensitive environment variables like `OPENVPN_USER` at start. It might be however useful in more advanced setup using Kubernetes for example.
Advanced setup/Firewall options.md
+21
@@ -0,0 +1,21 @@
## Environment variables
💁 The following environment variables are all optional.
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `FIREWALL` | `on` | `on` or `off` | Turn on or off the container built-in firewall. You should use it for **debugging purposes** only. |
| `FIREWALL_VPN_INPUT_PORTS` | | i.e. `1000,8080` | Comma separated list of ports to allow from the VPN server side (useful for **vyprvpn** port forwarding) |
| `FIREWALL_INPUT_PORTS` | | i.e. `1000,8000` | Comma separated list of ports to allow through the default interface. This seems needed for Kubernetes sidecars. |
| `FIREWALL_DEBUG` | `off` | `on` or `off` | Prints every firewall related command. You should use it for **debugging purposes** only. |
| `FIREWALL_OUTBOUND_SUBNETS` | | i.e. `192.168.1.0/24,192.168.10.121,10.0.0.5/28` | Comma separated subnets that Gluetun and the containers sharing its network stack are allowed to access. This involves firewall and routing modifications. |
## Custom iptables rules
If you need to specify additional iptables rules to be run after the built-in iptables rules, you can use the file at `/iptables/post-rules.txt` with one iptables command per line and these will automatically be run on container start.
For example the `/iptables/post-rules.txt` file could contain:
```sh
iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p udp --sport 1197 -j ACCEPT
iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p tcp --sport 1197 -j ACCEPT
```
Advanced setup/HTTP control server options.md
+10
@@ -0,0 +1,10 @@
## Environment variables
💁 The following environment variables are all optional.
This is to configure the [HTTP Control server](HTTP Control server).
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `HTTP_CONTROL_SERVER_PORT` | `8000` | `1` to `65535` | Listening port for the HTTP control server |
| `HTTP_CONTROL_SERVER_LOG` | `on` | `on` or `off` | Enable logging of HTTP requests |
Advanced setup/HTTP proxy options.md
+12
@@ -0,0 +1,12 @@
## Environment variables
💁 The following environment variables are all optional.
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `HTTPPROXY` | `off` | `on`, `off` | Enable the internal HTTP proxy |
| `HTTPPROXY_LOG` | `off` | `on` or `off` | Logs every tunnel requests |
| `HTTPPROXY_PORT` | `8888` | `1024` to `65535` | Internal port number for the HTTP proxy to listen on |
| `HTTPPROXY_USER` | | | Username to use to connect to the HTTP proxy |
| `HTTPPROXY_PASSWORD` | | | Password to use to connect to the HTTP proxy |
| `HTTPPROXY_STEALTH` | `off` | `on` or `off` | Stealth mode means HTTP proxy headers are not added to your requests |
Setup/Openvpn file.md → Advanced setup/OpenVPN configuration file.md
Advanced setup/OpenVPN options.md
+17
@@ -0,0 +1,17 @@
## Environment variables
💁 The following environment variables are all optional.
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `PROTOCOL` | `udp` | `udp` or `tcp` | Network protocol to use, only valid for OpenVPN |
| `OPENVPN_VERSION` | `2.5` | `2.4` or `2.5` | Set the OpenVPN version to run |
| `OPENVPN_VERBOSITY` | `1` | `0` to `6` | Openvpn verbosity level |
| `OPENVPN_FLAGS` | | Openvpn flags | Space delimited openvpn flags to pass to `openvpn` |
| `OPENVPN_ROOT` | `no` | `yes` or `no` | Run OpenVPN as root |
| `OPENVPN_TARGET_IP` | | Valid IP address | Specify a target VPN IP address to use |
| `OPENVPN_CIPHER` | | i.e. `aes-256-gcm` | Specify a custom cipher to use. It will also set `ncp-disable` if using AES GCM for PIA |
| `OPENVPN_AUTH` | | i.e. `sha256` | Specify a custom auth algorithm to use |
| `OPENVPN_IPV6` | `off` | `on`, `off` | Enable tunneling of IPv6 (only for Mullvad) |
| `OPENVPN_MSSFIX` | `0` | `0` to `9999` | Set the MSS fix parameter. Set to `0` to use the defaults. |
| `OPENVPN_INTERFACE` | `tun0` | Any interface name | Specify a custom network interface name to use |
Advanced setup/Other options.md
+13
@@ -0,0 +1,13 @@
## Environment variables
💁 The following environment variables are all optional.
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `TZ` | | i.e. `Europe/London` | Specify a timezone to use to have correct log times |
| `PUID` | `1000` | | User ID to run as non root and for ownership of files written |
| `PGID` | `1000` | | Group ID to run as non root and for ownership of files written |
| `PUBLICIP_PERIOD` | `12h` | Valid duration | Period to check for public IP address. Set to `0` to disable. |
| `PUBLICIP_FILE` | `/tmp/gluetun/ip` | Any filepath | Filepath to store the public IP address assigned. This will be removed in the `v4` program, instead you might want to use the [HTTP control server](HTTP-control-server) |
| `VERSION_INFORMATION` | `on` | `on`, `off` | Logs a message indicating if a newer version is available once the VPN is connected |
| `UPDATER_PERIOD` | `0` | Valid duration string such as `24h` | Period to update all VPN servers information in memory and to /gluetun/servers.json. Set to `0` to disable. This does a burst of DNS over TLS requests, which may be blocked if you set `BLOCK_MALICIOUS=on` for example. |
Servers/Servers Readme.md → Advanced setup/Outdated servers.md
+6 -16
@@ -1,21 +1,10 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.readme)
## Servers Readme
This directory contains tables of servers information at the time of writing this document.
It also contains [a document describing how to update your server information locally](Updating-Servers).
💁 For each VPN provider there is a corresponding document, such as [Windscribe Servers](Windscribe-Servers).
### Obtain up to date information
⚠️ The servers information in the Wiki might get outdated, so you have the following options to obtain up to date information:
If you encounter some server information which is outdated, you can do the following:
1. [Try environment variables](Try-environment-variables)
1. [Check the repository servers.json](Check-the-repository-servers.json)
1. [Check your servers.json](Check-your-servers.json)
#### Try environment variables
### Try environment variables
You can try environment variables, such as setting `REGION=somevalue` and the program will exit, stating which options are available depending on the VPN service provider selected. For example:
@@ -32,10 +21,11 @@ INFO Shutdown successful
#### Check the repository servers.json
There is a [`internal/constants/servers.json`](https://raw.githubusercontent.com/qdm12/gluetun/master/internal/constants/servers.json) file containing all the server information for each VPN service provider in JSON format.
There is a [`internal/storage/servers.json`](https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json) file containing all the server information for each VPN service provider in JSON format.
- For the latest image `qmcgaw/gluetun`, you can check the [master branch servers.json](https://raw.githubusercontent.com/qdm12/gluetun/master/internal/constants/servers.json)
- For tagged images `qmcgaw/gluetun:v3.x.x` after `v3.20.0`, you can check the servers.json in the corresponding tree. For example at [raw.githubusercontent.com/qdm12/gluetun/v3.20.0/internal/constants/servers.json](https://raw.githubusercontent.com/qdm12/gluetun/v3.20.0/internal/constants/servers.json) for release image tag `v3.21.0`
- For the latest image `qmcgaw/gluetun`, you can check the [master branch servers.json](https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json)
- For tagged images `qmcgaw/gluetun:v3.x.x` from `v3.24.0`, you can check the servers.json in the corresponding tree. For example at [raw.githubusercontent.com/qdm12/gluetun/v3.24.0/internal/storage/servers.json](https://raw.githubusercontent.com/qdm12/gluetun/v3.24.0/internal/storage/servers.json) for release image tag `v3.24.0`
- For tagged images `qmcgaw/gluetun:v3.x.x` from `v3.21.0`, you can check the servers.json in the corresponding tree. For example at [raw.githubusercontent.com/qdm12/gluetun/v3.21.0/internal/constants/servers.json](https://raw.githubusercontent.com/qdm12/gluetun/v3.21.0/internal/constants/servers.json) for release image tag `v3.21.0`
- For tagged images `qmcgaw/gluetun:v3.x.x` before `v3.21.0`, you can check the Go files in the constants directory in the corresponding tree for example at [github.com/qdm12/gluetun/tree/v3.17.0/internal/constants](https://github.com/qdm12/gluetun/tree/v3.20.0/internal/constants/servers.json) for release image tag `v3.17.0`
⚠️ Note that if you update the server information yourself more recently than the server information in the source code, this approach does not work and your `servers.json` file takes precedence. See the section below in this case.
Advanced setup/Shadowsocks options.md
+11
@@ -0,0 +1,11 @@
## Environment variables
💁 The following environment variables are all optional.
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `SHADOWSOCKS` | `off` | `on`, `off` | Enable the internal Shadowsocks proxy |
| `SHADOWSOCKS_LOG` | `off` | `on`, `off` | Enable logging |
| `SHADOWSOCKS_ADDRESS` | `:8388` | Listening address | Internal listening address for Shadowsocks |
| `SHADOWSOCKS_PASSWORD` | | | Password to use to connect to Shadowsocks |
| `SHADOWSOCKS_CIPHER` | `chacha20-ietf-poly1305` | `chacha20-ietf-poly1305`, `aes-128-gcm`, `aes-256-gcm` | AEAD Cipher to use for Shadowsocks |
Servers/Updating Servers.md → Advanced setup/Updating servers.md
Advanced setup/VPN server port forwarding.md
+34
@@ -0,0 +1,34 @@
💁 Each VPN service provider supporting port forwarding have their own section on their own page on how to set it up.
🔴 This is **NOT** about [Docker port mapping](Port-mapping)
## Test it
Assuming:
- your gluetun container name is `gluetun`
- your VPN public IP address is `99.99.99.99`
- your VPN port forwarded is `8888`
You can test it with:
```sh
docker exec -it gluetun /bin/sh
# Change amd64 to your CPU architecture
wget -qO port-checker https://github.com/qdm12/port-checker/releases/download/v0.3.0/port-checker_0.3.0_linux_amd64
chmod +x port-checker
./port-checker -port 8888
```
Then in your browser, access [http://99.99.99.99:8888](http://99.99.99.99:8888).
It should show you your browser IP address and user agent.
You should also see the request logged in the port-checker output.
Finally, back to the terminal, press `CTRL+C` to stop port-checker and enter `exit` to quit the interactive shell in `gluetun`.
## Deluge
[@jawilson](https://github.com/jawilson) developed a plugin to automagically update the forwarded port in Deluge: [**deluge-piaportplugin**](https://github.com/jawilson/deluge-piaportplugin)
Feel free to thank him on his repository 👍
FAQ/Bandwidth speeds.md
-1
@@ -38,7 +38,6 @@ I ran multiple tests using different clients, servers and regions to clarify all
| --- | --- | --- | --- | --- | --- |
| `windows` | Windows | Docker desktop on WSL2 | AMD 5900x | `amd64` | `24` |
| `arch` | Arch Linux | Docker | AMD 2600x | `amd64` | `12` |
| `rpi4` | Raspbian 32 bit | Docker | Raspberry Pi 4 A72 | `arm64` | `4` |
- We use `speedtest-cli` to test the bandwidth on all speedtest hosts with:
FAQ/Explanations.md
+26 -1
@@ -1,4 +1,13 @@
The following document explains different aspects of gluetun and how it works.
## What files does it download after tunneling
If `DOT=off`, Unbound won't run and therefore no file will be downloaded by the program at all.
If `DOT=on`, after tunneling, it downloads at start (and periodically if `DNS_UPDATE_PERIOD` is not `0`):
- [DNS named root](https://github.com/qdm12/files/blob/master/named.root.updated) and the [DNS root key](https://github.com/qdm12/files/blob/master/root.key.updated) for Unbound
- If `BLOCK_MALICIOUS=on`: [Malicious hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound
- If `BLOCK_SURVEILLANCE=on`: [Surveillance hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound
- If `BLOCK_ADS=on`: [Ads hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound
## Server information
@@ -13,3 +22,19 @@ These however can get outdated. In this case, you have multiple options:
- Pull the latest Docker image `docker pull qmcgaw/gluetun`. I update myself the server information *hardcoded* in the program from time to time, so you will get new ones by updating gluetun.
- Follow the [Updating Servers](Updating-Servers#cli-operation) guide if none of the servers work. Ideally, you can still find one VPN server working, connect to it and just set `-e UPDATE_PERIOD=24h` so server information is fully updated every 24 hours. On a container restart or settings change, gluetun will pick up the server information you just updated from `/gluetun/servers.json` and use it.
## What is all this Go code
The Go code was essentially a big rewrite of the previous shell entrypoint.
It now acts a supervisor program, and has a built-in HTTP control server.
It allows for:
- better testing
- better maintainability
- ease of implementing new features
- faster start time
- asynchronous/parallel operations
- Restarting openvpn/unbound when needed without quitting the container
It is mostly made of the [internal directory](https://github.com/qdm12/gluetun/tree/master/internal) and the entry Go file [cmd/main.go](https://github.com/qdm12/gluetun/blob/master/cmd/gluetun/main.go).
FAQ/Iptables errors.md
+24
@@ -0,0 +1,24 @@
## `Table does not exist (do you need to insmod?)`
This is common on Raspberry Pis.
If you encounter the error:
```log
iptables v1.8.4 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
```
You likely need to update your system with `rpi-update`, see [#400](https://github.com/qdm12/gluetun/issues/400) for more information.
## `Permission denied (you must be root)`
If you use Portainer to run the container and get the error:
```log
2020-05-03T09:04:11.283Z ERROR failed executing "-P INPUT ACCEPT": iptables v1.8.3 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.: exit status 3```
```
This might be because Portainer does not set the `--cap_add=NET_ADMIN` successfully.
You might need to run the container without Portainer in this case. More information on [#139](https://github.com/qdm12/gluetun/issues/139).
FAQ/Mullvad.md
-24
@@ -1,24 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.faq.mullvad)
## IPv6
If you want to tunnel IPv6 with Mullvad, follow the following.
1. Ensure your Kernel has IPv6
```sh
lsmod | grep ipv6
```
Should show something.
1. Set the environment variable `OPENVPN_IPV6` to `on`
1. Enable IPv6 in Docker for this container:
- For a Docker run command, add the flag `--sysctl net.ipv6.conf.all.disable_ipv6=0` (or `--sysctl net.ipv6.conf.all.disable=0` on some systems)
- For docker-compose.yml files, add this to your `gluetun` config block:
```yml
sysctls:
- net.ipv6.conf.all.disable_ipv6=0
```
1. Start the container
FAQ/Openvpn.md → FAQ/OpenVPN errors.md
-28
@@ -1,5 +1,3 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.faq.openvpn)
## Inconsistence warnings
You might see some warnings for Private Internet Access and others, similar to:
@@ -16,32 +14,6 @@ It is mainly because the option [disable-occ](https://openvpn.net/community-reso
Private Internet Access explains [here why](https://www.privateinternetaccess.com/helpdesk/kb/articles/why-do-i-get-cipher-auth-warnings-when-i-connect) the warnings show up.
## Exiting on ping timeout
If your Openvpn drops the connection because of a ping timeout, the container will exit
and connected containers will lose their connection to it, even if it restarts.
You will obtain an error similar to:
```s
openvpn: Wed Mar 18 22:13:00 2020 [3a51ae90324bcb0719cb399b650c64d4] Inactivity timeout (--ping-restart), restarting,
openvpn: Wed Mar 18 22:13:00 2020 SIGUSR1[soft,ping-restart] received, process restarting,
...
openvpn: Wed Mar 18 22:13:17 2020 Preserving previous TUN/TAP instance: tun0,
openvpn: Wed Mar 18 22:13:17 2020 NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.,
openvpn: Wed Mar 18 22:13:17 2020 ERROR: Linux route delete command failed: external program exited with error status: 2,
openvpn: Wed Mar 18 22:13:17 2020 ERROR: Linux route delete command failed: external program exited with error status: 2,
openvpn: Wed Mar 18 22:13:17 2020 ERROR: Linux route delete command failed: external program exited with error status: 2,
openvpn: Wed Mar 18 22:13:17 2020 ERROR: Linux route delete command failed: external program exited with error status: 2,
openvpn: Wed Mar 18 22:13:17 2020 /sbin/ip addr del dev tun0 local 10.6.11.6 peer 10.6.11.5,
openvpn: Wed Mar 18 22:13:17 2020 Linux ip addr del failed: external program exited with error status: 2,
openvpn: Wed Mar 18 22:13:18 2020 ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1),
openvpn: Wed Mar 18 22:13:18 2020 Exiting due to fatal error,
exit status 1
```
To allow openvpn to restart itself, run openvpn with root by setting the environment variable `OPENVPN_ROOT=yes`.
## Interrupted system call
It may happen, quite rarely though, that Openvpn is killed in a loop by the host system.
FAQ/Portainer.md
-12
@@ -1,12 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.faq.portainer)
## Iptables permission
If you use Portainer to run the container and get the error:
```
2020-05-03T09:04:11.283Z ERROR failed executing "-P INPUT ACCEPT": iptables v1.8.3 (legacy): can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.: exit status 3```
```
This might be because portainer does not set the `--cap_add=NET_ADMIN` successfully. You might need to run the container without Portainer in this case. More information on [this issue](https://github.com/qdm12/gluetun/issues/139).
FAQ/Raspberry Pi.md
-11
@@ -1,11 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.faq.raspberrypi)
## Iptables error
If you encounter the error
```log
iptables v1.8.4 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
```
You might need to update with `rpi-update`, see #400 for more information.
Home.md
+24 -1
@@ -8,4 +8,27 @@
You can navigate pages on the right side bar 👉
There are pages about the container setup, advanced configuration, servers updating, FAQ and contributing documentation.
If this is your first time:
- Are you a Raspberry Pi user? Check out the [32 bit prerequisites page](32-bit-prerequisites)
- Are you a Synology user? Check out the [Synology prerequisites page](Synology-prerequisites)
- Are you a 32 bit OS user? Check out the [32 bit prerequisites page](32-bit-prerequisites)
And then pick your VPN provider on the right and start from there!
Do you want to use *Wireguard* with a custom configuration? Check out the [Custom provider page](Custom-provider)
Other important optional pages:
- [Connect a container to gluetun](Connect-a-container-to-gluetun)
- [Connect a LAN device to gluetun](Connect-a-LAN-device-to-gluetun)
- [Port mapping](Port-mapping)
- [Docker image tags](Docker-image-tags)
If you encounter issues:
1. Please check one of the page of the FAQ from the righ side bar 👉
2. Please open a [Github discussion](https://github.com/qdm12/gluetun/discussions/new)
3. If it's definitely a bug, please create a [Github issue](https://github.com/qdm12/gluetun/issues/new/choose)
🐛 Found a bug in the Wiki?! [Please create an issue](https://github.com/qdm12/gluetun/issues/new?assignees=&labels=%F0%9F%93%84+Wiki+issue&template=wiki+issue.md&title=Wiki+issue%3A+)
More-information.md
-38
@@ -1,38 +0,0 @@
## Table of content
1. [What is all this Go code](#What-is-all-this-Go-code)
1. [What files does it download after tunneling](#What-files-does-it-download-after-tunneling)
1. [Healthcheck](#Healthcheck)
## What is all this Go code
The Go code was essentially a big rewrite of the previous shell entrypoint.
It now acts a supervisor program, and has a built-in HTTP control server.
It allows for:
- better testing
- better maintainability
- ease of implementing new features
- faster start time
- asynchronous/parallel operations
- Restarting openvpn/unbound when needed without quitting the container
It is mostly made of the [internal directory](../internal) and the entry Go file [cmd/main.go](../cmd/main.go).
## What files does it download after tunneling
If `DOT=off`, Unbound won't run and therefore no file will be downloaded by the program at all.
If `DOT=on`, after tunneling, it downloads at start (and periodically if `DNS_UPDATE_PERIOD` is not `0`):
- [DNS named root](https://github.com/qdm12/files/blob/master/named.root.updated) and the [DNS root key](https://github.com/qdm12/files/blob/master/root.key.updated) for Unbound
- If `BLOCK_MALICIOUS=on`: [Malicious hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound
- If `BLOCK_SURVEILLANCE=on`: [Surveillance hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound
- If `BLOCK_ADS=on`: [Ads hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound
## Healthcheck
For Docker, docker-compose and Docker Swarm, there is a built-in [Docker healthcheck](https://docs.docker.com/engine/reference/builder/#healthcheck) running periodically which verifies DNS resolution of github.com is working, to ensure DNS over TLS **and** the Openvpn connection are both working.
If this is bothering you, you [can disable it](Advanced-setup#Disable-the-healthcheck).
Servers/Ivpn Servers.md
-49
@@ -1,49 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.ivpn)
The list of servers for IVPN is shown below:
| Country | City | Hostname |
| --- | --- | --- |
| Australia | | `au-nsw.gw.ivpn.net` |
| Austria | | `at.gw.ivpn.net` |
| Belgium | | `be.gw.ivpn.net` |
| Brazil | | `br.gw.ivpn.net` |
| Canada | Montreal | `ca-qc.gw.ivpn.net` |
| Canada | Toronto | `ca.gw.ivpn.net` |
| Czech Republic | | `cz.gw.ivpn.net` |
| Denmark | | `dk.gw.ivpn.net` |
| Finland | | `fi.gw.ivpn.net` |
| France | | `fr.gw.ivpn.net` |
| Germany | | `de.gw.ivpn.net` |
| Hong Kong | | `hk.gw.ivpn.net` |
| Hungary | | `hu.gw.ivpn.net` |
| Iceland | | `is.gw.ivpn.net` |
| Israel | | `il.gw.ivpn.net` |
| Italy | | `it.gw.ivpn.net` |
| Japan | | `jp.gw.ivpn.net` |
| Luxembourg | | `lu.gw.ivpn.net` |
| Netherlands | | `nl.gw.ivpn.net` |
| Norway | | `no.gw.ivpn.net` |
| Poland | | `pl.gw.ivpn.net` |
| Portugal | | `pt.gw.ivpn.net` |
| Romania | | `ro.gw.ivpn.net` |
| Serbia | | `rs.gw.ivpn.net` |
| Singapore | | `sg.gw.ivpn.net` |
| Slovakia | | `sk.gw.ivpn.net` |
| Sweden | | `se.gw.ivpn.net` |
| Switzerland | | `ch.gw.ivpn.net` |
| USA | Atlanta | `us-ga.gw.ivpn.net` |
| USA | Chicago | `us-il.gw.ivpn.net` |
| USA | Dallas | `us-tx.gw.ivpn.net` |
| USA | Las Vegas | `us-nv.gw.ivpn.net` |
| USA | Los Angeles | `us-ca.gw.ivpn.net` |
| USA | Miami | `us-fl.gw.ivpn.net` |
| USA | New Jersey | `us-nj.gw.ivpn.net` |
| USA | New York | `us-ny.gw.ivpn.net` |
| USA | Phoenix | `us-az.gw.ivpn.net` |
| USA | Salt Lake City | `us-ut.gw.ivpn.net` |
| USA | Seattle | `us-wa.gw.ivpn.net` |
| USA | Washington | `us-dc.gw.ivpn.net` |
| Ukraine | | `ua.gw.ivpn.net` |
| United Kingdom | London | `gb.gw.ivpn.net` |
| United Kingdom | Manchester | `gb-man.gw.ivpn.net` |
Servers/Nordvpn Servers.md
-5
@@ -1,5 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.nordvpn)
The list of servers for NordVPN is available in the [source code](https://github.com/qdm12/gluetun/blob/master/internal/constants/nordvpn.go#L46).
The table of servers cannot be put here unfortunately as there are too many servers and the Github markdown engine then fails.
Servers/VPN Unlimited Servers.md
-84
@@ -1,84 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.vpnunlimited)
The list of servers for VPN Unlimited (KeepSolid) is shown below:
| Country | City | Hostname | Free | Stream |
| --- | --- | --- | --- | --- |
| Argentina | | `ar.vpnunlimitedapp.com` | no | no |
| Australia | Sydney | `au-syd.vpnunlimitedapp.com` | no | no |
| Austria | | `at.vpnunlimitedapp.com` | no | no |
| Belarus | | `by.vpnunlimitedapp.com` | no | no |
| Belgium | | `be.vpnunlimitedapp.com` | no | no |
| Bosnia and Herzegovina | | `ba.vpnunlimitedapp.com` | no | no |
| Brazil | | `br.vpnunlimitedapp.com` | no | no |
| Bulgaria | | `bg.vpnunlimitedapp.com` | no | no |
| Canada | | `ca.vpnunlimitedapp.com` | no | no |
| Canada | Toronto | `ca-tr.vpnunlimitedapp.com` | no | no |
| Canada | Vancouver | `ca-vn.vpnunlimitedapp.com` | no | no |
| Costa Rica | | `cr.vpnunlimitedapp.com` | no | no |
| Croatia | | `hr.vpnunlimitedapp.com` | no | no |
| Cyprus | | `cy.vpnunlimitedapp.com` | no | no |
| Czech Republic | | `cz.vpnunlimitedapp.com` | no | no |
| Denmark | | `dk.vpnunlimitedapp.com` | no | no |
| Estonia | | `ee.vpnunlimitedapp.com` | no | no |
| Finland | | `fi.vpnunlimitedapp.com` | no | no |
| France | | `fr.vpnunlimitedapp.com` | no | no |
| France | Roubaix | `fr-rbx.vpnunlimitedapp.com` | no | no |
| Germany | | `de.vpnunlimitedapp.com` | no | no |
| Germany | Düsseldorf | `de-dus.vpnunlimitedapp.com` | no | no |
| Greece | | `gr.vpnunlimitedapp.com` | no | no |
| Hungary | | `hu.vpnunlimitedapp.com` | no | no |
| Iceland | | `is.vpnunlimitedapp.com` | no | no |
| India | | `in.vpnunlimitedapp.com` | no | no |
| India | Karnataka | `in-ka.vpnunlimitedapp.com` | no | no |
| Ireland | Dublin | `ie-dub.vpnunlimitedapp.com` | no | no |
| Isle of Man | | `im.vpnunlimitedapp.com` | no | no |
| Israel | | `il.vpnunlimitedapp.com` | no | no |
| Italy | Milan | `it-mil.vpnunlimitedapp.com` | no | no |
| Japan | | `jp.vpnunlimitedapp.com` | no | no |
| Korea | | `kr.vpnunlimitedapp.com` | no | no |
| Kuala Lumpur | | `mys.vpnunlimitedapp.com` | no | no |
| Latvia | | `lv.vpnunlimitedapp.com` | no | no |
| Libya | | `ly.vpnunlimitedapp.com` | no | no |
| Lithuania | | `lt.vpnunlimitedapp.com` | no | no |
| Luxembourg | | `lu.vpnunlimitedapp.com` | no | no |
| Mexico | | `mx.vpnunlimitedapp.com` | no | no |
| Moldova | | `md.vpnunlimitedapp.com` | no | no |
| Netherlands | | `nl.vpnunlimitedapp.com` | no | no |
| New Zealand | | `nz.vpnunlimitedapp.com` | no | no |
| Norway | | `no.vpnunlimitedapp.com` | no | no |
| Oman | | `om.vpnunlimitedapp.com` | no | no |
| Poland | | `pl.vpnunlimitedapp.com` | no | no |
| Portugal | | `pt.vpnunlimitedapp.com` | no | no |
| Romania | | `ro.vpnunlimitedapp.com` | no | no |
| Serbia | | `rs.vpnunlimitedapp.com` | no | no |
| Singapore | | `sg-free.vpnunlimitedapp.com` | yes | no |
| Singapore | | `sg.vpnunlimitedapp.com` | no | no |
| Slovakia | | `sk.vpnunlimitedapp.com` | no | no |
| Slovenia | | `si.vpnunlimitedapp.com` | no | no |
| South Africa | | `za.vpnunlimitedapp.com` | no | no |
| Spain | | `es.vpnunlimitedapp.com` | no | no |
| Sweden | | `se.vpnunlimitedapp.com` | no | no |
| Switzerland | | `ch.vpnunlimitedapp.com` | no | no |
| Thailand | | `th.vpnunlimitedapp.com` | no | no |
| Turkey | | `tr.vpnunlimitedapp.com` | no | no |
| United Arab Emirates | | `ae.vpnunlimitedapp.com` | no | no |
| United Kingdom | | `uk.vpnunlimitedapp.com` | no | no |
| United Kingdom | London | `uk-cv.vpnunlimitedapp.com` | no | no |
| United Kingdom | London | `uk-lon.vpnunlimitedapp.com` | no | no |
| United States | | `us-stream.vpnunlimitedapp.com` | no | yes |
| United States | | `us.vpnunlimitedapp.com` | no | no |
| United States | Chicago | `us-chi.vpnunlimitedapp.com` | no | no |
| United States | Dallas | `us-dal.vpnunlimitedapp.com` | no | no |
| United States | Denver | `us-den.vpnunlimitedapp.com` | no | no |
| United States | Houston | `us-hou.vpnunlimitedapp.com` | no | no |
| United States | Las Vegas | `us-lv.vpnunlimitedapp.com` | no | no |
| United States | Los Angeles | `us-la.vpnunlimitedapp.com` | no | no |
| United States | Miami | `us-mia.vpnunlimitedapp.com` | no | no |
| United States | New York | `us-ny-free.vpnunlimitedapp.com` | yes | no |
| United States | New York | `us-ny.vpnunlimitedapp.com` | no | no |
| United States | Saint Louis | `us-sl.vpnunlimitedapp.com` | no | no |
| United States | Salt Lake City | `us-slc.vpnunlimitedapp.com` | no | no |
| United States | San Francisco | `us-sf.vpnunlimitedapp.com` | no | no |
| United States | Seattle | `us-sea.vpnunlimitedapp.com` | no | no |
| Vietnam | | `vn.vpnunlimitedapp.com` | no | no |
Servers/WeVPN Servers.md
-7
@@ -1,7 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.wevpn)
The list of servers for WeVPN is shown below:
| City | Hostname |
| --- | --- |
| Los Angeles | `losangeles.wevpn.com` |
Setup/Advanced setup.md
-20
@@ -1,20 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.advanced)
## Custom iptables rules
If you need to specify additional iptables rules to be run after the built-in iptables rules, you can use the file at `/iptables/post-rules.txt` with one iptables command per line and these will automatically be run on container start.
For example the `/iptables/post-rules.txt` file could contain:
```sh
iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p udp --sport 1197 -j ACCEPT
iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p tcp --sport 1197 -j ACCEPT
```
## Disable the healthcheck
If the Docker healthcheck (not running in Kubernetes) is bothering you because it accesses ip echo websites periodically, you can disable with `--no-healthcheck` or for docker-compose.yml:
```yml
healthcheck:
disable: true
```
Setup/Client certificate.md
-43
@@ -1,43 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.client-certificate)
🛑 These instructions are only for specific VPN providers, such as Cyberghost. You should not read this if it not mentioned.
Your client certificate is usually of the form:
```pem
-----BEGIN CERTIFICATE-----
...
...
-----END CERTIFICATE-----
```
It may be given to you as a separate file or inlined in your Openvpn configuration file by your VPN service provider.
First, you need to take your client certificat (from its start line `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`) and place it in a file on your host that we name `client.crt`
The easiest path is to bind mount it in gluetun in the `/gluetun` directory, so you can:
1. Move `client.crt` to `/yourpath/gluetun/client.crt` on your host
1. Run gluetun bind mounting `-v /yourpath/gluetun:/gluetun`
If you use Docker Compose or Docker Swarm, you can optionally use a [Docker secret file](https://docs.docker.com/engine/swarm/secrets/), using the secret name `openvpn_clientcrt`.
For example:
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
# ...
secrets:
- openvpn_clientcrt
secrets:
openvpn_clientcrt:
file: ./client.crt
```
💁 This is really more of an option than a necessity, since all these sensitive inputs are read by gluetun and then written as files in the container, and gluetun already takes care of unsetting sensitive variables like `OPENVPN_USER` at start.
If you need it, you can also change the default client certificate secret file path (`/run/secrets/openvpn_clientcrt`) by setting `-e OPENVPN_CLIENTCRT_SECRETFILE=/run/secrets/anothername` for example, where the secret would then need to be `anothername` instead of `openvpn_clientcrt`.
Setup/Client key.md
-43
@@ -1,43 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.client-key)
🛑 These instructions are only for specific VPN providers, such as Cyberghost and VPN Unlimited. You should not read this if it not mentioned.
Your client key is usually of the form:
```pem
-----BEGIN PRIVATE KEY-----
...
...
-----END PRIVATE KEY-----
```
It may be given to you as a separate file or inlined in your Openvpn configuration file by your VPN service provider.
First, you need to take your key (from its start line `-----BEGIN PRIVATE KEY-----` to `-----END PRIVATE KEY-----`) and place it in a file on your host that we name `client.key`.
The easiest path is to bind mount it in gluetun in the `/gluetun` directory, so you can:
1. Move `client.key` to `/yourpath/gluetun/client.key` on your host
1. Run gluetun bind mounting `-v /yourpath/gluetun:/gluetun`
If you use Docker Compose or Docker Swarm, you can optionally use a [Docker secret file](https://docs.docker.com/engine/swarm/secrets/), using the secret name `openvpn_clientkey`.
For example:
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
# ...
secrets:
- openvpn_clientkey
secrets:
openvpn_clientkey:
file: ./client.key
```
💁 This is really more of an option than a necessity, since all these sensitive inputs are read by gluetun and then written as files in the container, and gluetun already takes care of unsetting sensitive variables like `OPENVPN_USER` at start.
If you need it, you can also change the default client key secret file path (`/run/secrets/openvpn_clientkey`) by setting `-e OPENVPN_CLIENTKEY_SECRETFILE=/run/secrets/anothername` for example, where the secret would then need to be `anothername` instead of `openvpn_clientkey`.
Setup/Connect to gluetun.md → Setup/Connect a LAN device to gluetun.md
+3 -19
@@ -1,24 +1,8 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.connect-to-gluetun)
There are various ways to connect a container or device to Gluetun, as described below.
There are various ways to connect a device to Gluetun.
💡 If you are connecting containers to Gluetun's network stack, you might want to also check the [Port mapping page](Port-mapping) to know how to access ports of containers connected to Gluetun.
## Container in the same docker-compose.yml
Add `network_mode: "service:gluetun"` to your second container so that it uses the `gluetun` network stack.
There is no need for `depends_on`.
## External container to Gluetun
Add `--network=container:gluetun` when launching the container, provided Gluetun is already running.
## Container in another docker-compose.yml
Add `network_mode: "container:gluetun"` to your *docker-compose.yml*, provided Gluetun is already running.
## Devices with the HTTP proxy
## HTTP proxy
This is useful for some clients such as Chrome, Firefox or Kodi.
@@ -31,7 +15,7 @@ This is useful for some clients such as Chrome, Firefox or Kodi.
1. With your HTTP proxy client, connect to the Docker host (i.e. `192.168.1.10`) on port `8888`. You need to enter your credentials if you set them with `HTTPPROXY_USER` and `HTTPPROXY_PASSWORD`. Note that Chrome does not support authentication.
1. If you set `HTTPPROXY_LOG` to `on`, more information will be logged in the Docker logs.
## Devices with the Shadowsocks proxy
## Shadowsocks proxy
1. Setup a Shadowsocks proxy client, there is a list of [ShadowSocks clients for **all platforms**](https://shadowsocks.org/en/download/clients.html)
- **note** some clients do not tunnel UDP so your DNS queries will be done locally and not through Gluetun and its built in DNS over TLS
Setup/Connect a container to gluetun.md
+19
@@ -0,0 +1,19 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.connect-to-gluetun)
There are various ways to connect a container to Gluetun.
💡 If you are connecting containers to Gluetun's network stack, you might want to also check the [Port mapping page](Port-mapping) to know how to access ports of containers connected to Gluetun.
## Container in the same docker-compose.yml
Add `network_mode: "service:gluetun"` to your second container so that it uses the `gluetun` network stack.
There is no need for `depends_on`.
## External container to Gluetun
Add `--network=container:gluetun` when launching the container, provided Gluetun is already running.
## Container in another docker-compose.yml
Add `network_mode: "container:gluetun"` to your *docker-compose.yml*, provided Gluetun is already running.
FAQ/Docker image tags.md → Setup/Docker image tags.md
+8 -8
@@ -7,10 +7,16 @@ If it happens to be **broken**, this page is for you.
ℹ️ [Live list of image tags **after v3.9.0**](https://hub.docker.com/r/qmcgaw/gluetun/tags?page=1&ordering=last_updated)
[Multiple releases](https://github.com/qdm12/gluetun/releases) are made through time when the image is considered stable.
Each time a Github release is made, an associated Docker image tag is made, for example a `v3.1.0` release produces the image `qmcgaw/gluetun:v3.1.0`.
You can thus use one of these image tags if `:latest` doesn't work for you. Also, don't forget to [create an issue](https://github.com/qdm12/gluetun/issues/new/choose) for it 😉
The following is for release tags before `v3.10.0`:
| Image | Github release | CPU architectures |
| --- | --- | --- |
| `qmcgaw/gluetun:v3.11.1` | [v3.11.1](https://github.com/qdm12/gluetun/releases/tag/v3.11.1) | 386, amd64, armv6, armv7, arm64, s390x, ppc64le |
| `qmcgaw/gluetun:v3.10.3` | [v3.10.3](https://github.com/qdm12/gluetun/releases/tag/v3.10.3) | 386, amd64, armv6, armv7, arm64 |
| `qmcgaw/private-internet-access:v3.9.0` | [v3.9.0](https://github.com/qdm12/gluetun/releases/tag/v3.9.0) | 386, amd64, armv6, armv7, arm64 |
| `qmcgaw/private-internet-access:v3.8.1` | [v3.8.1](https://github.com/qdm12/gluetun/releases/tag/v3.8.1) | 386, amd64, armv6, armv7, arm64 |
| `qmcgaw/private-internet-access:v3.7.0` | [v3.7.0](https://github.com/qdm12/gluetun/releases/tag/v3.7.0) | 386, amd64, armv6, armv7, arm64 |
@@ -24,9 +30,3 @@ If it happens to be **broken**, this page is for you.
| `qmcgaw/private-internet-access:v2` | [v2.0.0](https://github.com/qdm12/gluetun/releases/tag/v2.0.0) | 386, amd64, armv6, armv7, arm64, ppc64le, s390x |
| `qmcgaw/private-internet-access:v1` | [v1](https://github.com/qdm12/gluetun/releases/tag/v1.0) | 386, amd64, armv6, armv7, arm64, ppc64le, s390x |
| `qmcgaw/private-internet-access:old` | *Too old to know* | amd64 |
[Multiple releases](https://github.com/qdm12/gluetun/releases) are made through time when the image is considered stable.
Each time a Github release is made, an associated Docker image tag is made, for example a `v3.1.0` release produces the image `qmcgaw/gluetun:v3.1.0`.
You can thus use one of these image tags if `:latest` doesn't work for you. Also, don't forget to [create an issue](https://github.com/qdm12/gluetun/issues/new/choose) for it 😉
Setup/Environment variables.md
-350
@@ -1,350 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.environment-variables)
**TLDR**; only set the 🏁 marked environment variables to get started.
## VPN
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `VPNSP` | `private internet access` | [`custom`](#Custom), `cyberghost`, `fastestvpn`, `hidemyass`, `ivpn`, `mullvad`, `nordvpn`, `privado`, `private internet access`, `privatevpn`, `protonvpn`, `purevpn`, `surfshark`, `torguard`, `"vpn unlimited"`, `vyprvpn`, `wevpn`, `windscribe` | VPN Service Provider. 💁 Note this is more restricted if you use Wireguard |
| `VPN_TYPE` | `openvpn` | `openvpn` or `wireguard` | VPN type to connect to the VPN server |
| `PUBLICIP_FILE` | `/tmp/gluetun/ip` | Any filepath | Filepath to store the public IP address assigned |
### OpenVPN
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `PROTOCOL` | `udp` | `udp` or `tcp` | Network protocol to use, only valid for OpenVPN |
| `OPENVPN_VERSION` | `2.5` | `2.4` or `2.5` | Set the OpenVPN version to run |
| `OPENVPN_VERBOSITY` | `1` | `0` to `6` | Openvpn verbosity level |
| `OPENVPN_FLAGS` | | Openvpn flags | Space delimited openvpn flags to pass to `openvpn` |
| `OPENVPN_ROOT` | `no` | `yes` or `no` | Run OpenVPN as root |
| `OPENVPN_TARGET_IP` | | Valid IP address | Specify a target VPN IP address to use |
| `OPENVPN_CIPHER` | | i.e. `aes-256-gcm` | Specify a custom cipher to use. It will also set `ncp-disable` if using AES GCM for PIA |
| `OPENVPN_AUTH` | | i.e. `sha256` | Specify a custom auth algorithm to use |
| `OPENVPN_IPV6` | `off` | `on`, `off` | Enable tunneling of IPv6 (only for Mullvad) |
| `OPENVPN_MSSFIX` | `0` | `0` to `9999` | Set the MSS fix parameter. Set to `0` to use the defaults. |
| `OPENVPN_INTERFACE` | `tun0` | Any interface name | Specify a custom network interface name to use |
### Wireguard
Note Wireguard is only supported for some VPN service providers.
More Wireguard variables are available depending on the VPN service provider.
The common Wireguard variables are described below.
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `WIREGUARD_PRESHARED_KEY` | | 32 bytes key in base64 format | Optional Wireguard pre-shared key |
| `WIREGUARD_ENDPOINT_PORT` | | `1` to `65535` | Optional Wireguard custom server endpoint port |
| `WIREGUARD_INTERFACE` | `wg0` | Any interface name | Specify a custom network interface name to use |
## VPN service providers
*For all providers below, server location parameters are all optional. By default a random server is picked using the filter settings provided.*
### Mullvad
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your user ID, only required if `VPN_TYPE=openvpn` |
| `COUNTRY` | | Comma separated list of [countries](Mullvad-Servers) | VPN server country |
| `CITY` | | Comma separated list of [cities](Mullvad-Servers) | VPN server city |
| `SERVER_HOSTNAME` | | Comma separated list of [server hostnames](Mullvad-Servers) | Server hostname(s) |
| `ISP` | | Comma separated list of [ISPs](Mullvad-Servers) | VPN server ISP |
| `OPENVPN_PORT` | | `80`, `443` or `1401` for TCP; `53`, `1194`, `1195`, `1196`, `1197`, `1300`, `1301`, `1302`, `1303` or `1400` for UDP. Defaults to TCP `443` and UDP `1194` | Custom VPN port to use |
| `OWNED` | `no` | `yes` or `no` | If the VPN server is owned by Mullvad. Note that `no` includes all servers |
| 🏁 `WIREGUARD_PRIVATE_KEY` | | 32 bytes key in base64 format | Wireguard private key, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. |
| 🏁 `WIREGUARD_ADDRESS` | | IP network in the format `xx.xx.xx.xx/xx` | Wireguard interface address, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. |
| `WIREGUARD_ENDPOINT_PORT` | | Any port between `1` and `65535` | Wireguard server endpoint port to use |
💡 [Mullvad IPv6 Wiki page](Mullvad)
For **port forwarding**, obtain a port from [here](https://mullvad.net/en/account/#/ports) and add it to `FIREWALL_VPN_INPUT_PORTS`
### Cyberghost
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| 🏁 | | | **See additional setup steps below** |
| `REGION` | | Comma separated list of [Cyberghost regions](Cyberghost-Servers) | VPN server region(s) |
| `CYBERGHOST_GROUP` | | Comma separated list of [server groups](Cyberghost-Servers) | Server group(s) |
| `SERVER_HOSTNAME` | | Comma separated list of [server hostnames](Cyberghost-Servers) | Server hostname(s) |
You need to have your Openvpn private key file accessible to Gluetun, see [Client key](Client-key); and your Openvpn client certificate, see [Client certificate](Client-certificate)
### FastestVPN
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `COUNTRY` | | Comma separated list of [FastestVPN countries](Fastestvpn-Servers) | VPN server country |
| `SERVER_HOSTNAME` | | Comma separated list of [FastestVPN hostnames](Fastestvpn-Servers) | VPN server hostname |
### HideMyAss
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `COUNTRY` | | Comma separated list of [HideMyAss countries](HideMyAss-Servers) | VPN server country |
| `REGION` | | Comma separated list of [HideMyAss regions](HideMyAss-Servers) | VPN server region |
| `CITY` | | Comma separated list of [HideMyAss cities](HideMyAss-Servers) | VPN server city |
| `SERVER_HOSTNAME` | | Comma separated list of [HideMyAss hostnames](HideMyAss-Servers) | VPN server hostname |
### Ivpn
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username, only required if `VPN_TYPE=openvpn` |
| 🏁 `OPENVPN_PASSWORD` | | | Your password, only required if `VPN_TYPE=openvpn` |
| `COUNTRY` | | Comma separated list of [Ivpn countries](Ivpn-Servers) | VPN server country |
| `CITY` | | Comma separated list of [Ivpn cities](Ivpn-Servers) | VPN server city |
| `ISP` | | Comma separated list of [Ivpn ISPs](Ivpn-Servers) | VPN server ISP |
| `SERVER_HOSTNAME` | | Comma separated list of [Ivpn hostnames](Ivpn-Servers) | VPN server hostname |
| 🏁 `WIREGUARD_PRIVATE_KEY` | | 32 bytes key in base64 format | Wireguard private key, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. |
| 🏁 `WIREGUARD_ADDRESS` | | IP network in the format `xx.xx.xx.xx/xx` | Wireguard interface address, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. |
| `WIREGUARD_ENDPOINT_PORT` | | `2049`, `2050`, `53`, `30587`, `41893`, `48574`, `58237` | Wireguard server endpoint port to use |
### NordVPN
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `REGION` | | Comma separated list of [NordVPN server countries](Nordvpn-servers) | VPN server country |
| `SERVER_NAME` | | | Comma separated list of [server names](Nordvpn-Servers) to choose the VPN server |
| `SERVER_HOSTNAME` | | | Comma separated list of [hostnames](Nordvpn-Servers) to choose the VPN server |
| `SERVER_NUMBER` | | Comma separated list of [server numbers](Nordvpn-servers) | Optional server number. For example `251` for `Italy #251` |
### Privado
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `REGION` | | Comma separated list of [Privado regions](Privado-Servers) | VPN server region |
| `COUNTRY` | | Comma separated list of [Privado countries](Privado-Servers) | VPN server country |
| `CITY` | | Comma separated list of [Privado cities](Privado-Servers) | VPN server city |
| `SERVER_HOSTNAME` | | Comma separated list of [hostnames](Privado-servers) | VPN server hostname |
### Private Internet Access
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `REGION` | | Comma separated list of [regions](Private-Internet-Access-Servers) | VPN server regions |
| `SERVER_HOSTNAME` | | Comma separated list of [server hostnames](Private-Internet-Access-Servers) | Server hostname(s) |
| `SERVER_NAME` | | Comma separated list of [server names](Private-Internet-Access-Servers) | Server name(s) |
| `PIA_ENCRYPTION` | `strong` | `normal`, `strong` or `none` | Encryption preset. ⚠️ `none` disables the `cipher` and `auth` openvpn instructions |
| `OPENVPN_PORT` | | An acceptable port for PIA | Custom VPN port to use |
| `PORT_FORWARDING` | `off` | `on`, `off` | Enable port forwarding on the VPN server |
| `PORT_FORWARDING_STATUS_FILE` | `/tmp/gluetun/forwarded_port` | Any filepath | Filepath to store the forwarded port number |
### Privatevpn
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `COUNTRY` | | Comma separated list of [Privatevpn countries](Privatevpn-Servers) | VPN server country |
| `CITY` | | Comma separated list of [Privatevpn cities](Privatevpn-Servers) | VPN server city |
| `SERVER_HOSTNAME` | | Comma separated list of [Privatevpn hostnames](Privatevpn-Servers) | VPN server hostname |
### Protonvpn
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `COUNTRY` | | | Comma separated list of [countries](Protonvpn-Servers) to choose the VPN server |
| `REGION` | | | Comma separated list of [regions](Protonvpn-Servers) to choose the VPN server |
| `CITY` | | | Comma separated list of [cities](Protonvpn-Servers) to choose the VPN server |
| `SERVER_NAME` | | | Comma separated list of [server names](Protonvpn-Servers) to choose the VPN server |
| `SERVER_HOSTNAME` | | | Comma separated list of [hostnames](Protonvpn-Servers) to choose the VPN server |
| `OPENVPN_PORT` | `1194` for UDP and `443` for TCP | For TCP: `443`, `5995` or `8443`; for UDP: `80`, `443`, `1194`, `4569`, `5060` | Custom VPN port to use |
| `FREE_ONLY` | `off` | `on` or `off` | Only use free tier servers |
### PureVPN
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `REGION` | | Comma separated list of [PureVPN regions](Purevpn-Servers) | VPN server region |
| `COUNTRY` | | Comma separated list of [PureVPN countries](Purevpn-Servers) | VPN server country |
| `CITY` | | Comma separated list of [PureVPN cities](Purevpn-Servers) | VPN server city |
| `SERVER_HOSTNAME` | | Comma separated list of [hostnames](Purevpn-servers) | VPN server hostname |
### Surfshark
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your **service** username, found at the bottom of the [manual setup page](https://account.surfshark.com/setup/manual) |
| 🏁 `OPENVPN_PASSWORD` | | | Your **service** password |
| `REGION` | | Comma separated list of [Surfshark regions](Surfshark-Servers) | VPN server region |
| `SERVER_HOSTNAME` | | Comma separated list of [Surfshark hostnames](Surfshark-Servers) to choose the VPN server | VPN server hostname |
### Torguard
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `COUNTRY` | | Comma separated list of [Torguard countries](Torguard-Servers) | VPN server country |
| `CITY` | | Comma separated list of [Torguard cities](Torguard-Servers) | VPN server city, if any |
| `SERVER_HOSTNAME` | | Comma separated list of [Torguard hostnames](Torguard-Servers) | VPN server hostname |
- 💁 To use Wireguard, use the [Custom provider](#Custom)
### VPN Unlimited (KeepSolid)
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 | | | **See additional setup steps below** |
| `COUNTRY` | | | Comma separated list of [countries](VPN-Unlimited-Servers) to choose the VPN server |
| `REGION` | | | Comma separated list of [regions](VPN-Unlimited-Servers) to choose the VPN server |
| `CITY` | | | Comma separated list of [cities](VPN-Unlimited-Servers) to choose the VPN server |
| `SERVER_HOSTNAME` | | | Comma separated list of [hostnames](VPN-Unlimited-Servers) to choose the VPN server |
- ⚠️ You need to have your Openvpn private key file accessible to Gluetun, see [Client key](Client-key); and your Openvpn client certificate, see [Client certificate](Client-certificate)
- 💁 To use Wireguard, use the [Custom provider](#Custom)
### Vyprvpn
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| `REGION` | | Comma separated list of [VyprVPN regions](Vyprvpn-Servers) | VPN server region(s) |
| `SERVER_HOSTNAME` | | Comma separated list of [VyprVPN hostnames](Vyprvpn-Servers) | VPN server hostname(s) |
💡 [VPN port forwarding](Port-forwarding#VyprVPN)
### WeVPN
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username |
| 🏁 `OPENVPN_PASSWORD` | | | Your password |
| 🏁 | | | **See additional setup steps below** |
| `CITY` | | Comma separated list of [WeVPN cities](WeVPN-Servers) | VPN server city(ies) |
| `SERVER_HOSTNAME` | | Comma separated list of [server hostnames](WeVPN-Servers) | Server hostname(s) |
| `PORT` | | For `tcp`: `53`, `1195`, `1199`, `2018`; for `udp`: `80`, `1194`, `1198` | Custom VPN port to use |
- ⚠️ You need to have your Openvpn private key file accessible to Gluetun, see [Client key](Client-key).
- 💁 To use Wireguard, use the [Custom provider](#Custom)
### Windscribe
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_USER` | | | Your username (get it from a generated config file from [fra.windscribe.com/getconfig/openvpn](https://fra.windscribe.com/getconfig/openvpn)), only required if `VPN_TYPE=openvpn` |
| 🏁 `OPENVPN_PASSWORD` | | | Your password (get it from a generated config file from [fra.windscribe.com/getconfig/openvpn](https://fra.windscribe.com/getconfig/openvpn)), only required if `VPN_TYPE=openvpn` |
| `REGION` | | | Comma separated list of [regions](Windscribe-Servers) to choose the VPN server |
| `CITY` | | | Comma separated list of [cities](Windscribe-Servers) to choose the VPN server |
| `SERVER_HOSTNAME` | | | Comma separated list of [hostnames](Windscribe-Servers) to choose the VPN server |
| `OPENVPN_PORT` | | One from the [this list of ports](https://windscribe.com/getconfig/openvpn) | Custom VPN port to use |
| 🏁 `WIREGUARD_PRIVATE_KEY` | | 32 bytes key in base64 format | Wireguard private key, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. |
| 🏁 `WIREGUARD_ADDRESS` | | IP network in the format `xx.xx.xx.xx/xx` | Wireguard interface address, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. |
| `WIREGUARD_ENDPOINT_PORT` | | `53`, `80`, `123`, `443`, `1194`, `65142` | Wireguard server endpoint port to use |
### Custom
The `custom` VPN 'service provider' is to support [custom configuration files for OpenVPN](Openvpn-file) and
custom configurations for Wireguard.
The following variables are available for OpenVPN (only if `VPNTYPE=openvpn`):
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `OPENVPN_CUSTOM_CONFIG` | | File path | The path to your OpenVPN configuration file |
On top of the existing [Wireguard variables](#Wireguard), the following variables are available for Wireguard (only if `VPNTYPE=wireguard`):
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| 🏁 `WIREGUARD_ENDPOINT_IP` | | Endpoint IP address | The server endpoint IP address |
| 🏁 `WIREGUARD_ENDPOINT_PORT` | | Endpoint port | The server endpoint port, usually `51820` |
| 🏁 `WIREGUARD_PUBLIC_KEY` | | Wireguard public key | The server public key |
| 🏁 `WIREGUARD_PRIVATE_KEY` | | 32 bytes key in base64 format | Wireguard private key |
| 🏁 `WIREGUARD_ADDRESS` | | IP network in the format `xx.xx.xx.xx/xx` | Wireguard interface address |
## DNS over TLS
None of the following values are required.
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `DOT` | `on` | `on`, `off` | Activate DNS over TLS with Unbound |
| `DOT_PROVIDERS` | `cloudflare` | `cloudflare`, `google`, `quad9`, `quadrant`, `cleanbrowsing` | Comma delimited list of DNS over TLS providers |
| `DOT_CACHING` | `on` | `on`, `off` | Unbound caching |
| `DOT_IPV6` | `off` | `on`, `off` | DNS IPv6 resolution |
| `DOT_PRIVATE_ADDRESS` | All private CIDRs ranges | | Comma separated list of CIDRs or single IP addresses Unbound won't resolve to. Note that the default setting prevents DNS rebinding |
| `DOT_VERBOSITY` | `1` | `0` to `5` | Unbound verbosity level |
| `DOT_VERBOSITY_DETAILS` | `0` | `0` to `4` | Unbound details verbosity level |
| `DOT_VALIDATION_LOGLEVEL` | `0` | `0` to `2` | Unbound validation log level |
| `DNS_UPDATE_PERIOD` | `24h` | i.e. `0`, `30s`, `5m`, `24h` | Period to update block lists and cryptographic files and restart Unbound. Set to `0` to deactivate updates |
| `BLOCK_MALICIOUS` | `on` | `on`, `off` | Block malicious hostnames and IPs with Unbound |
| `BLOCK_SURVEILLANCE` | `off` | `on`, `off` | Block surveillance hostnames and IPs with Unbound |
| `BLOCK_ADS` | `off` | `on`, `off` | Block ads hostnames and IPs with Unbound |
| `UNBLOCK` | |i.e. `domain1.com,x.domain2.co.uk` | Comma separated list of domain names to leave unblocked with Unbound |
| `DNS_PLAINTEXT_ADDRESS` | `1.1.1.1` | Any IP address | IP address to use as DNS resolver if `DOT` is `off` |
| `DNS_KEEP_NAMESERVER` | `off` | `on` or `off` | Keep the nameservers in /etc/resolv.conf untouched, but disabled DNS blocking features |
## Firewall and routing
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `FIREWALL` | `on` | `on` or `off` | Turn on or off the container built-in firewall. You should use it for **debugging purposes** only. |
| `FIREWALL_VPN_INPUT_PORTS` | | i.e. `1000,8080` | Comma separated list of ports to allow from the VPN server side (useful for **vyprvpn** port forwarding) |
| `FIREWALL_INPUT_PORTS` | | i.e. `1000,8000` | Comma separated list of ports to allow through the default interface. This seems needed for Kubernetes sidecars. |
| `FIREWALL_DEBUG` | `off` | `on` or `off` | Prints every firewall related command. You should use it for **debugging purposes** only. |
| `FIREWALL_OUTBOUND_SUBNETS` | | i.e. `192.168.1.0/24,192.168.10.121,10.0.0.5/28` | Comma separated subnets that Gluetun and the containers sharing its network stack are allowed to access. This involves firewall and routing modifications. |
## Shadowsocks
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `SHADOWSOCKS` | `off` | `on`, `off` | Enable the internal Shadowsocks proxy |
| `SHADOWSOCKS_LOG` | `off` | `on`, `off` | Enable logging |
| `SHADOWSOCKS_ADDRESS` | `:8388` | Listening address | Internal listening address for Shadowsocks |
| `SHADOWSOCKS_PASSWORD` | | | Password to use to connect to Shadowsocks |
| `SHADOWSOCKS_CIPHER` | `chacha20-ietf-poly1305` | `chacha20-ietf-poly1305`, `aes-128-gcm`, `aes-256-gcm` | AEAD Cipher to use for Shadowsocks |
## HTTP proxy
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `HTTPPROXY` | `off` | `on`, `off` | Enable the internal HTTP proxy |
| `HTTPPROXY_LOG` | `off` | `on` or `off` | Logs every tunnel requests |
| `HTTPPROXY_PORT` | `8888` | `1024` to `65535` | Internal port number for the HTTP proxy to listen on |
| `HTTPPROXY_USER` | | | Username to use to connect to the HTTP proxy |
| `HTTPPROXY_PASSWORD` | | | Password to use to connect to the HTTP proxy |
| `HTTPPROXY_STEALTH` | `off` | `on` or `off` | Stealth mode means HTTP proxy headers are not added to your requests |
## System
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `TZ` | | i.e. `Europe/London` | Specify a timezone to use to have correct log times |
| `PUID` | `1000` | | User ID to run as non root and for ownership of files written |
| `PGID` | `1000` | | Group ID to run as non root and for ownership of files written |
## HTTP Control server
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `HTTP_CONTROL_SERVER_PORT` | `8000` | `1` to `65535` | Listening port for the HTTP control server |
| `HTTP_CONTROL_SERVER_LOG` | `on` | `on` or `off` | Enable logging of HTTP requests |
## Other
| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `PUBLICIP_PERIOD` | `12h` | Valid duration | Period to check for public IP address. Set to `0` to disable. |
| `VERSION_INFORMATION` | `on` | `on`, `off` | Logs a message indicating if a newer version is available once the VPN is connected |
| `UPDATER_PERIOD` | `0` | Valid duration string such as `24h` | Period to update all VPN servers information in memory and to /gluetun/servers.json. Set to `0` to disable. This does a burst of DNS over TLS requests, which may be blocked if you set `BLOCK_MALICIOUS=on` for example. |
Setup/OpenVPN client certificate.md
+21
@@ -0,0 +1,21 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.client-certificate)
🛑 These instructions are only for specific VPN providers, such as Cyberghost. You should not read this if it not mentioned.
Your client certificate is usually of the form:
```pem
-----BEGIN CERTIFICATE-----
...
...
-----END CERTIFICATE-----
```
It may be given to you as a separate file or inlined in your Openvpn configuration file by your VPN service provider.
First, you need to take your client certificat (from its start line `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`) and place it in a file on your host that we name `client.crt`
The easiest path is to bind mount it in gluetun in the `/gluetun` directory, so you can:
1. Move `client.crt` to `/yourpath/gluetun/client.crt` on your host
1. Run gluetun bind mounting `-v /yourpath/gluetun:/gluetun`
Setup/OpenVPN client key.md
+21
@@ -0,0 +1,21 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.client-key)
🛑 These instructions are only for specific VPN providers, such as Cyberghost and VPN Unlimited. You should not read this if it not mentioned.
Your client key is usually of the form:
```pem
-----BEGIN PRIVATE KEY-----
...
...
-----END PRIVATE KEY-----
```
It may be given to you as a separate file or inlined in your Openvpn configuration file by your VPN service provider.
First, you need to take your key (from its start line `-----BEGIN PRIVATE KEY-----` to `-----END PRIVATE KEY-----`) and place it in a file on your host that we name `client.key`.
The easiest path is to bind mount it in gluetun in the `/gluetun` directory, so you can:
1. Move `client.key` to `/yourpath/gluetun/client.key` on your host
1. Run gluetun bind mounting `-v /yourpath/gluetun:/gluetun`
Setup/Port forwarding.md
-77
@@ -1,77 +0,0 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.port-forwarding)
⚠️ This is about VPN server side port forwarding and not port publishing for your Gluetun setup using Docker. If you are looking for port publishing, check [this page](Port-mapping) out.
## Providers
⚠️ not all VPN providers support VPN server side port forwarding.
### Private Internet Access
⚠️ port forwarding with PIA is not really working for some reason. This is not a gluetun issue, but a PIA one. It seems to only work for port forwarding for torrenting applications, not sure why, maybe they run deep packet inspection on the forwarded port.
When `PORT_FORWARDING=on`, a port will be forwarded on the VPN server side and written to the file specified by `PORT_FORWARDING_STATUS_FILE=/tmp/gluetun/forwarded_port`.
It can be useful to mount this file as a volume to read it from other containers, for example to configure a torrenting client.
You will keep the same forwarded port for 60 days as long as you bind mount the `/gluetun` directory.
You can also use the [HTTP control server](HTTP-Control-server#OpenVPN) to get the port forwarded.
### VyprVPN
By default, VyprVPN does not forward any port.
You need to disable the NAT firewall in the Manage services section of your account at [account.vyprvpn.com](https://account.vyprvpn.com/) ([source](https://support.vyprvpn.com/hc/en-us/articles/360039668472-Does-VyprVPN-support-Port-Forwarding-)).
All the ports will then be forwarded to you, so it's like you are running alone on the VPN server.
Therefore, you only need to allow these ports through the gluetun firewall by setting the ports you need in `FIREWALL_VPN_INPUT_PORTS`.
For example `FIREWALL_VPN_INPUT_PORTS=8000,9000`.
### Windscribe
1. Follow the [Windscribe instructions](https://windscribe.com/support/article/37/what-is-ephemeral-port-forwarding-and-how-to-use-it)
1. In your container configuration, set `FIREWALL_VPN_INPUT_PORTS` to the port you have been assigned, e.g. `FIREWALL_VPN_INPUT_PORTS=8099`
1. Start/Restart the container and it should be ready
### Mullvad
1. Assign a port to be forwarded through their web user interface
1. In your container configuration, set `FIREWALL_VPN_INPUT_PORTS` to the port you have been assigned, e.g. `FIREWALL_VPN_INPUT_PORTS=8099`
1. Start/Restart the container and it should be ready
### Other
I am not aware, feel free to create a Github issue or discussion so I can document it here!
## Deluge
[@jawilson](https://github.com/jawilson) developed a plugin to automagically update the forwarded port in Deluge: [**deluge-piaportplugin**](https://github.com/jawilson/deluge-piaportplugin)
Feel free to thank him on his repository 👍
## Test it
Assuming:
- your gluetun container name is `gluetun`
- your VPN public IP address is `99.99.99.99`
- your VPN port forwarded is `8888`
You can test it with:
```sh
docker exec -it gluetun /bin/sh
# Change amd64 to your CPU architecture
wget -qO port-checker https://github.com/qdm12/port-checker/releases/download/v0.3.0/port-checker_0.3.0_linux_amd64
chmod +x port-checker
./port-checker -port 8888
```
Then in your browser, access [http://99.99.99.99:8888](http://99.99.99.99:8888).
It should show you your browser IP address and user agent.
You should also see the request logged in the port-checker output.
Finally, back to the terminal, press `CTRL+C` to stop port-checker and enter `exit` to quit the interactive shell in `gluetun`.
Setup/32 bit setup.md → Setup/Prerequisites/32 bit prerequisites.md
Setup/Synology setup.md → Setup/Prerequisites/Synology prerequisites.md
Setup/Providers/Custom provider.md
+66
@@ -0,0 +1,66 @@
## TLDR
```sh
# OpenVPN
docker run -it --rm --cap-add=NET_ADMIN \
-e VPNSP=custom -e VPN_TYPE=openvpn \
-v /yourpath/yourconfig.conf:/gluetun/config.conf \
-e OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf:ro \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc qmcgaw/gluetun
```
💁 See the [Openvpn configuration file page]((Openvpn-configuration-file)) for information on how to set this up.
```sh
# Wireguard
docker run -it --rm --cap-add=NET_ADMIN \
-e VPNSP=custom -e VPN_TYPE=wireguard \
-e WIREGUARD_ENDPOINT_IP=1.2.3.4 \
-e WIREGUARD_ENDPOINT_PORT=51820 \
-e WIREGUARD_PUBLIC_KEY=wAUaJMhAq3NFutLHIdF8AN0B5WG8RndfQKLPTEDHal0= \
-e WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \
-e WIREGUARD_PRESHARED_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \
-e WIREGUARD_ADDRESS="10.64.222.21/32" \
qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
volumes:
- ./yourovpnconfig.conf:/gluetun/config.conf:ro
environment:
- VPNSP=custom
- VPN_TYPE=wireguard
# For OpenVPN
#- OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
# For Wireguard
- WIREGUARD_ENDPOINT_IP=1.2.3.4
- WIREGUARD_ENDPOINT_PORT=51820
- WIREGUARD_PUBLIC_KEY=wAUaJMhAq3NFutLHIdF8AN0B5WG8RndfQKLPTEDHal0=
- WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU=
- WIREGUARD_PRESHARED_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU=
- WIREGUARD_ADDRESS=10.64.222.21/32
```
## Required environment variables
- `VPNSP=custom`
### OpenVPN only
- `OPENVPN_CUSTOM_CONFIG`: Path to your custom configuration file.
### Wireguard only
- `WIREGUARD_ENDPOINT_IP`: the server endpoint IP address
- `WIREGUARD_ENDPOINT_PORT`: the server endpoint port
- `WIREGUARD_PUBLIC_KEY` is the server 32 bytes public key in base64 format.
- `WIREGUARD_PRIVATE_KEY` is your 32 bytes private key in base64 format.
- `WIREGUARD_ADDRESS` is your IP network interface address in the format `xx.xx.xx.xx/xx`.
Servers/Cyberghost Servers.md → Setup/Providers/Cyberghost.md
+41 -3
@@ -1,8 +1,46 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.cyberghost)
## TLDR
## Servers available
1. Follow the steps here: [Client key](Client-key)
1. Follow the steps here: [Client certificate](Client-certificate)
The list of servers for Cyberghost is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=cyberghost \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-v /yourpath:/gluetun \
-e COUNTRY=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=cyberghost
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- REGION=Netherlands
volumes:
./gluetun:/gluetun
```
## Required environment variables
- `VPNSP=cyberghost`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `REGION`: Comma separated list of [regions](#Servers)
- `CYBERGHOST_GROUP`: Comma separated list of [groups](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | Group | Hostname |
| --- | --- | --- |
Servers/Fastestvpn Servers.md → Setup/Providers/FastestVPN.md
+36 -3
@@ -1,6 +1,39 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.fastestvpn)
## TLDR
The list of servers for FastestVPN is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=fastestvpn \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e COUNTRY=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=fastestvpn
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- COUNTRY=Netherlands
```
## Required environment variables
- `VPNSP=fastestvpn`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | Hostname | UDP | TCP |
| --- | --- | --- | --- |
@@ -82,4 +115,4 @@ The list of servers for FastestVPN is shown below:
| US-St.Louis | us-st3.jumptoserver.com | [x] | [x] |
| US-St.Louis | us-st4.jumptoserver.com | [x] | [x] |
| US-St.Louis | us-st5.jumptoserver.com | [x] | [x] |
| US-Washington | us-wt.jumptoserver.com | [x] | [x] |
| US-Washington | us-wt.jumptoserver.com | [x] | [x] |
Servers/HideMyAss Servers.md → Setup/Providers/Hidemyass.md
+37 -2
@@ -1,6 +1,41 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.hidemyass)
## TLDR
The list of servers for Mullvad is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=hidemyass \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e COUNTRY=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=hidemyass
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- COUNTRY=Netherlands
```
## Required environment variables
- `VPNSP=hidemyass`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `REGION`: Comma separated list of [regions](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | Region | City | Hostname | TCP | UDP |
| --- | --- | --- | --- | --- | --- |
Setup/Providers/IVPN.md
+135
@@ -0,0 +1,135 @@
## TLDR
```sh
# OpenVPN
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=ivpn \
-e VPN_TYPE=openvpn -e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e CITY=amsterdam qmcgaw/gluetun
```
```sh
# Wireguard
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=ivpn \
-e VPN_TYPE=wireguard \
-e WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \
-e WIREGUARD_ADDRESS="10.64.222.21/32" \
-e CITY=amsterdam qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=ivpn
- VPN_TYPE=wireguard
- WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU=
- WIREGUARD_ADDRESS=10.64.222.21/32
- CITY=Amsterdam
```
## Required environment variables
- `VPNSP=ivpn`
### OpenVPN only
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
### Wireguard only
- `WIREGUARD_PRIVATE_KEY` is your 32 bytes key in base64 format. Note this is specific by user and the same for all servers.
- `WIREGUARD_ADDRESS` is your IP network interface address in the format `xx.xx.xx.xx/xx`. Note this is specific by user and the same for all servers.
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
- `ISP`: Comma separated list of [ISPs](#Servers)
- `WIREGUARD_ENDPOINT_PORT`: Custom Wireguard server endpoint port to use, which can be one of: `2049`, `2050`, `53`, `30587`, `41893`, `48574`, `58237`
## VPN Port forwarding
1. Log in your Mullvad account at [https://ivpn.net/en/account](https://ivpn.net/en/account)
1. Obtain a port from [https://ivpn.net/en/account/#/ports](https://ivpn.net/en/account/#/ports)
1. Add the port to the environment variable `FIREWALL_VPN_INPUT_PORTS`
## IPv6 tunneling with OpenVPN
By default, IPv6 is just blocked by the firewall in gluetun.
If you want to tunnel IPv6 with Mullvad using OpenVPN:
1. Ensure your Kernel has IPv6
```sh
lsmod | grep ipv6
```
Should show something.
1. Set the environment variable `OPENVPN_IPV6` to `on`
1. Enable IPv6 in Docker for this container:
- For a Docker run command, add the flag `--sysctl net.ipv6.conf.all.disable_ipv6=0` (or `--sysctl net.ipv6.conf.all.disable=0` on some systems)
- For docker-compose.yml files, add this to your `gluetun` config block:
```yml
sysctls:
- net.ipv6.conf.all.disable_ipv6=0
```
1. Start the container
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | City | Hostname |
| --- | --- | --- |
| Australia | | `au-nsw.gw.ivpn.net` |
| Austria | | `at.gw.ivpn.net` |
| Belgium | | `be.gw.ivpn.net` |
| Brazil | | `br.gw.ivpn.net` |
| Canada | Montreal | `ca-qc.gw.ivpn.net` |
| Canada | Toronto | `ca.gw.ivpn.net` |
| Czech Republic | | `cz.gw.ivpn.net` |
| Denmark | | `dk.gw.ivpn.net` |
| Finland | | `fi.gw.ivpn.net` |
| France | | `fr.gw.ivpn.net` |
| Germany | | `de.gw.ivpn.net` |
| Hong Kong | | `hk.gw.ivpn.net` |
| Hungary | | `hu.gw.ivpn.net` |
| Iceland | | `is.gw.ivpn.net` |
| Israel | | `il.gw.ivpn.net` |
| Italy | | `it.gw.ivpn.net` |
| Japan | | `jp.gw.ivpn.net` |
| Luxembourg | | `lu.gw.ivpn.net` |
| Netherlands | | `nl.gw.ivpn.net` |
| Norway | | `no.gw.ivpn.net` |
| Poland | | `pl.gw.ivpn.net` |
| Portugal | | `pt.gw.ivpn.net` |
| Romania | | `ro.gw.ivpn.net` |
| Serbia | | `rs.gw.ivpn.net` |
| Singapore | | `sg.gw.ivpn.net` |
| Slovakia | | `sk.gw.ivpn.net` |
| Sweden | | `se.gw.ivpn.net` |
| Switzerland | | `ch.gw.ivpn.net` |
| USA | Atlanta | `us-ga.gw.ivpn.net` |
| USA | Chicago | `us-il.gw.ivpn.net` |
| USA | Dallas | `us-tx.gw.ivpn.net` |
| USA | Las Vegas | `us-nv.gw.ivpn.net` |
| USA | Los Angeles | `us-ca.gw.ivpn.net` |
| USA | Miami | `us-fl.gw.ivpn.net` |
| USA | New Jersey | `us-nj.gw.ivpn.net` |
| USA | New York | `us-ny.gw.ivpn.net` |
| USA | Phoenix | `us-az.gw.ivpn.net` |
| USA | Salt Lake City | `us-ut.gw.ivpn.net` |
| USA | Seattle | `us-wa.gw.ivpn.net` |
| USA | Washington | `us-dc.gw.ivpn.net` |
| Ukraine | | `ua.gw.ivpn.net` |
| United Kingdom | London | `gb.gw.ivpn.net` |
| United Kingdom | Manchester | `gb-man.gw.ivpn.net` |
Servers/Mullvad Servers.md → Setup/Providers/Mullvad.md
+92 -2
@@ -1,6 +1,96 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.mullvad)
## TLDR
The list of servers for Mullvad is shown below:
```sh
# OpenVPN
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=mullvad \
-e VPN_TYPE=openvpn -e OPENVPN_USER=1355131650462193 \
-e CITY=amsterdam qmcgaw/gluetun
```
```sh
# Wireguard
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=mullvad \
-e VPN_TYPE=wireguard \
-e WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \
-e WIREGUARD_ADDRESS="10.64.222.21/32" \
-e CITY=amsterdam qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=mullvad
- VPN_TYPE=wireguard
- WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU=
- WIREGUARD_ADDRESS=10.64.222.21/32
- CITY=Amsterdam
```
## Required environment variables
- `VPNSP=mullvad`
### OpenVPN only
- `OPENVPN_USER` which is your Mullvad user ID.
### Wireguard only
- `WIREGUARD_PRIVATE_KEY` is your 32 bytes key in base64 format. Note this is specific by user and the same for all servers.
- `WIREGUARD_ADDRESS` is your IP network interface address in the format `xx.xx.xx.xx/xx`. Note this is specific by user and the same for all servers.
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
- `ISP`: Comma separated list of [ISPs](#Servers)
- `OWNED`: If the VPN server is owned by Mullvad. It defaults to `no`, meaning it includes all servers. It can be set to `yes`. |
- `OPENVPN_PORT`: Custom OpenVPN server endpoint port to use
- For TCP: `80`, `443` or `1401`
- For UDP: `53`, `1194`, `1195`, `1196`, `1197`, `1300`, `1301`, `1302`, `1303` or `1400`
- It defaults to `443` for TCP and `1194` for UDP
- `WIREGUARD_ENDPOINT_PORT`: Custom Wireguard server endpoint port to use
## VPN Port forwarding
1. Log in your Mullvad account at [https://mullvad.net/en/account](https://mullvad.net/en/account)
1. Obtain a port from [https://mullvad.net/en/account/#/ports](https://mullvad.net/en/account/#/ports)
1. Add the port to the environment variable `FIREWALL_VPN_INPUT_PORTS`
## IPv6 tunneling with OpenVPN
By default, IPv6 is just blocked by the firewall in gluetun.
If you want to tunnel IPv6 with Mullvad using OpenVPN:
1. Ensure your Kernel has IPv6
```sh
lsmod | grep ipv6
```
Should show something.
1. Set the environment variable `OPENVPN_IPV6` to `on`
1. Enable IPv6 in Docker for this container:
- For a Docker run command, add the flag `--sysctl net.ipv6.conf.all.disable_ipv6=0` (or `--sysctl net.ipv6.conf.all.disable=0` on some systems)
- For docker-compose.yml files, add this to your `gluetun` config block:
```yml
sysctls:
- net.ipv6.conf.all.disable_ipv6=0
```
1. Start the container
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | City | Hostname | ISP | Owned |
| --- | --- | --- | --- | --- |
Setup/Providers/NordVPN.md
+40
@@ -0,0 +1,40 @@
## TLDR
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=nordvpn \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e REGION=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=nordvpn
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- REGION=Netherlands
```
## Required environment variables
- `VPNSP=nordvpn`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `REGION`: Comma separated list of [regions](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
- `SERVER_NAME`: Comma separated list of [server names](#Servers)
- `SERVER_NUMBER`: Comma separated list of [server numbers](#Servers). For example `251` for `Italy #251` |
## Servers
The list of servers for NordVPN is available in the [source code](https://github.com/qdm12/gluetun/blob/master/internal/storage/servers.json).
The table of servers cannot be put here unfortunately as there are too many servers and the Github markdown engine then fails.
Servers/Privado Servers.md → Setup/Providers/Privado.md
+37 -2
@@ -1,6 +1,41 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.privado)
## TLDR
The list of servers for Privado is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=privado \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e COUNTRY=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=privado
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- COUNTRY=Netherlands
```
## Required environment variables
- `VPNSP=privado`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `REGION`: Comma separated list of [regions](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | Region | City | Hostname |
| --- | --- | --- | --- |
Servers/Private Internet Access Servers.md → Setup/Providers/Private internet access.md
+55 -2
@@ -1,6 +1,59 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.pia)
## TLDR
The list of servers for Private Internet Access is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP="private internet access" \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-v gluetun:/gluetun \
-e REGION=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
volumes:
- gluetun:/gluetun
environment:
- VPNSP=private internet access
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- REGION=Netherlands
```
## Required environment variables
- `VPNSP=private internet access`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `REGION`: Comma separated list of [regions](#Servers)
- `SERVER_NAME`: Comma separated list of [server names](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
- `PIA_ENCRYPTION`: Encryption preset, defaulting to `strong`, which can be set to `normal`, `strong` or `none`. ⚠️ `none` disables the `cipher` and `auth` OpenVPN options.
- `OPENVPN_PORT`: Custom OpenVPN server endpoint port
- `PORT_FORWARDING`: defaults to `off` and can be set to `on`to enable port forwarding on the VPN server
- `PORT_FORWARDING_STATUS_FILE`: File path to write the forwarded port number to. It defaults to `/tmp/gluetun/forwarded_port`.
## VPN server port forwarding
⚠️ port forwarding with PIA is not really working for some reason. This is not a gluetun issue, but a PIA one. It seems to only work for port forwarding for torrenting applications, not sure why, maybe they run deep packet inspection on the forwarded port.
When `PORT_FORWARDING=on`, a port will be forwarded on the VPN server side and written to the file specified by `PORT_FORWARDING_STATUS_FILE=/tmp/gluetun/forwarded_port`.
It can be useful to mount this file as a volume to read it from other containers, for example to configure a torrenting client.
You will keep the same forwarded port for 60 days as long as you bind mount the `/gluetun` directory.
You can also use the [HTTP control server](HTTP-Control-server#OpenVPN) to get the port forwarded.
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Region | Hostname | Server name | TCP | UDP | Port forwarding available |
| --- | --- | --- | --- | --- | --- |
Servers/Privatevpn Servers.md → Setup/Providers/PrivateVPN.md
+36 -2
@@ -1,6 +1,40 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.privatevpn)
## TLDR
The list of servers for PrivateVPN is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=privatevpn \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e COUNTRY=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=privatevpn
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- COUNTRY=Netherlands
```
## Required environment variables
- `VPNSP=privatevpn`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | City | Hostname |
| --- | --- | --- |
Servers/Protonvpn Servers.md → Setup/Providers/ProtonVPN.md
+47 -11
@@ -1,11 +1,53 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.protonvpn)
## TLDR
## Regions available
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=protonvpn \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e COUNTRY=Netherlands qmcgaw/gluetun
```
Note 1: the container uses information extracted from [ProtonVPN's API](https://api.protonmail.ch/vpn/logicals) which may change over time, making this table outdated.
Note 2: Every country, region and city are **exit** locations and not entry
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=protonvpn
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- COUNTRY=Netherlands
```
The list of servers for Protonvpn is shown below:
## Required environment variables
- `VPNSP=protonvpn`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `REGION`: Comma separated list of [regions](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_NAME`: Comma separated list of [server names](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
- `FREE_ONLY`: Filter only free tier servers by setting it to `on`. It defaults to `off`.
- `OPENVPN_PORT`: Custom OpenVPN server endpoint port to use
- For TCP: `443`, `5995` or `8443`
- For UDP: `80`, `443`, `1194`, `4569`, `5060`
- Defaults are `1194` for UDP and `443` for TCP
## Multi hop regions
Simply set the `SERVER_NAME` or `SERVER_HOSTNAME` environment variable to a hostname corresponding to a multi hop region (see [Servers](#Servers)).
For example setting `SERVER_NAME=CH-US#1` or setting `SERVER_HOSTNAME=ch-us-01a.protonvpn.com` would set a multi hop with entry in Switzerland and exit in the US.
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | Region | City | Server name | Server hostname |
| --- | --- | --- | --- | --- |
@@ -1579,9 +1621,3 @@ The list of servers for Protonvpn is shown below:
| United States | West | San Jose | US-CA#2 | us-ca-02.protonvpn.com |
| United States | West | San Jose | US-CA#3 | us-ca-03.protonvpn.com |
| United States | West | San Jose | US-CA#4 | us-ca-04.protonvpn.com |
## Multi hop regions
Simply set the `SERVER_NAME` or `SERVER_HOSTNAME` environment variable to a hostname corresponding to a multi hop region.
For example setting `SERVER_NAME=CH-US#1` or setting `SERVER_HOSTNAME=ch-us-01a.protonvpn.com` would set a multi hop with entry in Switzerland and exit in the US.
Servers/Purevpn Servers.md → Setup/Providers/PureVPN.md
+37 -2
@@ -1,6 +1,41 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.purevpn)
## TLDR
The list of servers for PureVPN is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=purevpn \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e COUNTRY=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=purevpn
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- COUNTRY=Netherlands
```
## Required environment variables
- `VPNSP=purevpn`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `REGION`: Comma separated list of [regions](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | Region | City | Hostname | TCP | UDP |
| --- | --- | --- | --- | --- | --- |
Servers/Surfshark Servers.md → Setup/Providers/Surfshark.md
+52 -22
@@ -1,6 +1,56 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.surfshark)
## TLDR
The list of servers for Surfshark is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=surfshark \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e REGION=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=surfshark
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- REGION=Netherlands
```
## Required environment variables
- `VPNSP=surfshark`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `REGION`: Comma separated list of [regions](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## Multi hop regions
Simply set the `REGION` environment variable using one of the following:
- Australia US
- Canada US
- Germany Singapour
- Germany UK
- France Sweden
- India UK
- Netherlands US
- Singapore Hong Kong
- UK Germany
- UK France
- US Netherlands
- US Portugal
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Region | Hostname |
| --- | --- |
@@ -163,23 +213,3 @@ The list of servers for Surfshark is shown below:
| Ukraine | `ua-iev.prod.surfshark.com` |
| United Arab Emirates | `ae-dub.prod.surfshark.com` |
| Vietnam | `vn-hcm.prod.surfshark.com` |
Note 1: the container uses information extracted from [openvpn files downloaded from Surfshark](https://account.surfshark.com/api/v1/server/configurations), so there is more regions available than from the website.
Note 2: Regions with `st00x` suffixes means they have a corresponding single static IP address. You might want to use these if you want to always have the same IP address.
## Multi hop regions
Simply set the `REGION` environment variable using one of the following:
- Australia US
- Canada US
- Germany Singapour
- Germany UK
- France Sweden
- India UK
- Netherlands US
- Singapore Hong Kong
- UK Germany
- UK France
- US Netherlands
- US Portugal
Servers/Torguard Servers.md → Setup/Providers/Torguard.md
+38 -2
@@ -1,6 +1,42 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.torguard)
## TLDR
The list of servers for Torguard is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=torguard \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e COUNTRY=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=torguard
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- COUNTRY=Netherlands
```
💁 To use with Wireguard, see [Wireguard#Custom-setup](Wireguard#Custom-setup).
## Required environment variables
- `VPNSP=torguard`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | City | Hostname |
| --- | --- | --- |
Setup/Providers/VPN Unlimited.md
+102
@@ -0,0 +1,102 @@
## TLDR
💁 To use with Wireguard, see [Wireguard#Custom-setup](Wireguard#Custom-setup).
For OpenVPN:
1. Follow the steps here: [Client key](Client-key)
1. Follow the steps here: [Client certificate](Client-certificate)
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP="vpn unlimited" \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e COUNTRY=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=vpn unlimited
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- COUNTRY=Netherlands
```
## Required environment variables
- `VPNSP=vpn unlimited`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `COUNTRY`: Comma separated list of [countries](#Servers)
- `REGION`: Comma separated list of [regions](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | City | Hostname |
| --- | --- | --- |
| Australia | Sydney | au.vpn unlimitedvpnaccess.com |
| Austria | | aus.vpn unlimitedvpnaccess.com |
| Belarus | | bl.vpn unlimitedvpnaccess.com |
| Belgium | | bg.vpn unlimitedvpnaccess.com |
| Brazil | | br.vpn unlimitedvpnaccess.com |
| Bulgaria | | bul.vpn unlimitedvpnaccess.com |
| Canada | Toronto | ca.vpn unlimitedvpnaccess.com |
| Canada | Vancouver | vanc.ca.west.vpn unlimitedvpnaccess.com |
| Chile | | chil.vpn unlimitedvpnaccess.com |
| Cyprus | | cp.vpn unlimitedvpnaccess.com |
| Czech | | czech.vpn unlimitedvpnaccess.com |
| Denmark | | den.vpn unlimitedvpnaccess.com |
| Finland | | fin.vpn unlimitedvpnaccess.com |
| France | | fr.vpn unlimitedvpnaccess.com |
| Germany | | gr.vpn unlimitedvpnaccess.com |
| Greece | | gre.vpn unlimitedvpnaccess.com |
| Hong | Kong | hk.vpn unlimitedvpnaccess.com |
| Hungary | | hg.vpn unlimitedvpnaccess.com |
| Iceland | | ice.vpn unlimitedvpnaccess.com |
| India | Bangalore | in.vpn unlimitedvpnaccess.com |
| Ireland | | ire.vpn unlimitedvpnaccess.com |
| Israel | | isr.vpn unlimitedvpnaccess.com |
| Italy | | it.vpn unlimitedvpnaccess.com |
| Japan | | jp.vpn unlimitedvpnaccess.com |
| Latvia | | lv.vpn unlimitedvpnaccess.com |
| Luxembourg | | lux.vpn unlimitedvpnaccess.com |
| Mexico | | mx.vpn unlimitedvpnaccess.com |
| Moldova | | md.vpn unlimitedvpnaccess.com |
| Netherlands | | nl.vpn unlimitedvpnaccess.com |
| New | Zealand | nz.vpn unlimitedvpnaccess.com |
| Norway | | no.vpn unlimitedvpnaccess.com |
| Poland | | pl.vpn unlimitedvpnaccess.com |
| Portugal | | por.vpn unlimitedvpnaccess.com |
| Romania | | ro.vpn unlimitedvpnaccess.com |
| Singapore | | singp.vpn unlimitedvpnaccess.com |
| Slovakia | | slk.vpn unlimitedvpnaccess.com |
| South | Korea | sk.vpn unlimitedvpnaccess.com |
| Spain | | sp.vpn unlimitedvpnaccess.com |
| Sweden | | swe.vpn unlimitedvpnaccess.com |
| Switzerland | | swiss.vpn unlimitedvpnaccess.com |
| Taiwan | | tw.vpn unlimitedvpnaccess.com |
| Thailand | | thai.vpn unlimitedvpnaccess.com |
| UAE | | uae.secureconnect.me |
| UK | London | uk.vpn unlimitedvpnaccess.com |
| USA | Atlanta | atl.east.usa.vpn unlimitedvpnaccess.com |
| USA | Chicago | chi.central.usa.vpn unlimitedvpnaccess.com |
| USA | Dallas | dal.central.usa.vpn unlimitedvpnaccess.com |
| USA | Las Vegas | lv.west.usa.vpn unlimitedvpnaccess.com |
| USA | Los Angeles | la.west.usa.vpn unlimitedvpnaccess.com |
| USA | Miami | fl.east.usa.vpn unlimitedvpnaccess.com |
| USA | New Jersey | nj.east.usa.vpn unlimitedvpnaccess.com |
| USA | New York | ny.east.usa.vpn unlimitedvpnaccess.com |
| USA | San Francisco | sf.west.usa.vpn unlimitedvpnaccess.com |
| USA | Seattle | sa.west.usa.vpn unlimitedvpnaccess.com |
Servers/Vyprvpn Servers.md → Setup/Providers/VyprVPN.md
+46 -2
@@ -1,6 +1,50 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.vyprvpn)
## TLDR
The list of servers for VyprVPN is shown below:
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=vyprvpn \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e REGION=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=vyprvpn
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- REGION=Netherlands
```
## Required environment variables
- `VPNSP=vyprvpn`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `REGION`: Comma separated list of [regions](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
## VPN server port forwarding
By default, VyprVPN does not forward any port.
You need to disable the NAT firewall in the Manage services section of your account at [account.vyprvpn.com](https://account.vyprvpn.com/) ([source](https://support.vyprvpn.com/hc/en-us/articles/360039668472-Does-VyprVPN-support-Port-Forwarding-)).
All the ports will then be forwarded to you, so it's like you are running alone on the VPN server.
Therefore, you only need to allow these ports through the gluetun firewall by setting the ports you need in `FIREWALL_VPN_INPUT_PORTS`.
For example `FIREWALL_VPN_INPUT_PORTS=8000,9000`.
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Country | Hostname |
| --- | --- |
Setup/Providers/WeVPN.md
+45
@@ -0,0 +1,45 @@
## TLDR
💁 To use with Wireguard, see [Wireguard#Custom-setup](Wireguard#Custom-setup).
1. Follow the steps here: [Client key](Client-key)
```sh
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=wevpn \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e CITY=Amsterdam qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=wevpn
- OPENVPN_USER=abc
- OPENVPN_PASSWORD=abc
- CITY=Amsterdam
```
## Required environment variables
- `VPNSP=wevpn`
- `OPENVPN_USER`
- `OPENVPN_PASSWORD`
## Optional environment variables
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
- `OPENVPN_PORT`: Custom OpenVPN server endpoint port
- For TCP: `53`, `1195`, `1199` or `2018`
- For UDP: `80`, `1194` or `1198`
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
TODO
Servers/Windscribe Servers.md → Setup/Providers/Windscribe.md
+64 -3
@@ -1,6 +1,67 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.windscribe)
## TLDR
The list of servers for Windscribe is shown below:
```sh
# OpenVPN
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=windscribe \
-e VPN_TYPE=openvpn \
-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e REGION=Netherlands qmcgaw/gluetun
```
```sh
# Wireguard
docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=windscribe \
-e VPN_TYPE=wireguard \
-e WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \
-e WIREGUARD_ADDRESS="10.64.222.21/32" \
-e REGION=Netherlands qmcgaw/gluetun
```
```yml
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPNSP=windscribe
- VPN_TYPE=wireguard
- WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU=
- WIREGUARD_ADDRESS=10.64.222.21/32
- REGION=Netherlands
```
## Required environment variables
- `VPNSP=windscribe`
### OpenVPN only
- `OPENVPN_USER`: Your username (get it from a generated config file from [fra.windscribe.com/getconfig/openvpn](https://fra.windscribe.com/getconfig/openvpn))
- `OPENVPN_PASSWORD`: Your password (get it from a generated config file from [fra.windscribe.com/getconfig/openvpn](https://fra.windscribe.com/getconfig/openvpn))
### Wireguard only
- `WIREGUARD_PRIVATE_KEY` is your 32 bytes key in base64 format. Note this is specific by user and the same for all servers.
- `WIREGUARD_ADDRESS` is your IP network interface address in the format `xx.xx.xx.xx/xx`. Note this is specific by user and the same for all servers.
## Optional environment variables
- `REGION`: Comma separated list of [regions](#Servers)
- `CITY`: Comma separated list of [cities](#Servers)
- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers)
- `OPENVPN_PORT`: Custom OpenVPN server endpoint port to use, see [this list of ports](https://windscribe.com/getconfig/openvpn)
- `WIREGUARD_ENDPOINT_PORT`: Custom Wireguard server endpoint port to use, which can be one of: `53`, `80`, `123`, `443`, `1194`, `65142`
### VPN server port forwarding
1. Follow the [Windscribe instructions](https://windscribe.com/support/article/37/what-is-ephemeral-port-forwarding-and-how-to-use-it)
1. In your container configuration, set `FIREWALL_VPN_INPUT_PORTS` to the port you have been assigned, for example: `FIREWALL_VPN_INPUT_PORTS=8099`
## Servers
⚠️ this information may become outdated, see [Outdated servers](Outdated-servers)
| Region | City | Hostname |
| --- | --- | --- |
@@ -296,4 +357,4 @@ The list of servers for Windscribe is shown below:
| WINDFLIX US | New York | wf-us-012.whiskergalaxy.com |
| WINDFLIX US | New York | wf-us-013.whiskergalaxy.com |
| WINDFLIX US | New York | wf-us-014.whiskergalaxy.com |
| WINDFLIX US | New York | wf-us-015.whiskergalaxy.com |
| WINDFLIX US | New York | wf-us-015.whiskergalaxy.com |
Setup/Test your setup.md
+1 -1
@@ -1,6 +1,6 @@
![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.testing)
Once your container is up and running, you may want to test your connection is correct and secured.
Once your container is up and running, you can test your connection is correct and secured (purely optional).
## Check your IP address
FAQ/Wireguard.md → Setup/Wireguard.md
+31 -2
@@ -1,10 +1,39 @@
# Wireguard
## Setup
### Tight integrations
Gluetun supports Wireguard with tight integrations with the following providers:
- [Mullvad](Mullvad)
- [Ivpn](Ivpn)
- [Windscribe](Windscribe)
And you should refer to their respective page to set up easily Wireguard with them.
### Custom setup
Gluetun supports custom Wireguard client configurations.
This is especially useful with providers such as Torguard and VPN Unlimited.
See the [setup for the *Custom* provider](Custom-provider) page for this.
### Optional environment variables
On top of provider specific Wireguard environment variables, the following are always available and optional:
- `WIREGUARD_PRESHARED_KEY` is your 32 bytes pre shared key in base64 format
- `WIREGUARD_INTERFACE`: Wireguard network interface name to create and use. It defaults to `wg0`.
## FAQ
### Implementation
Wireguard is implemented using imported packages from [git.zx2c4.com/wireguard-go](https://git.zx2c4.com/wireguard-go).
It should be using the Kernel wireguard module if it is present and fallback to a Go user space Wireguard implementation otherwise, to maximize compatibility and performance.
## Performance
### Performance
Wireguard is often known as *so much faster* than OpenVPN. Let's find out!
_Sidebar.md
+65 -46
@@ -1,49 +1,68 @@
# Table of content
- [Home](https://github.com/qdm12/gluetun/wiki)
- Setup
- [Environment variables](Environment-variables)
- [32 bit setup](32-bit-setup)
- [Synology setup](Synology-setup)
- [Test your setup](Test-your-setup)
- [Connect to gluetun](Connect-to-gluetun)
- [Port mapping](Port-mapping)
- [Port forwarding](Port-forwarding)
- [Advanced setup](Advanced-setup)
- [Openvpn file](Openvpn-file)
- [Client key](Client-key)
- [Client certificate](Client-certificate)
- [Docker secrets](Docker-secrets)
- FAQ
- [Explanations](Explanations)
- [Docker image tags](Docker-image-tags)
- [Openvpn](Openvpn)
- [Wireguard](Wireguard)
- [Portainer](Portainer)
🐛 [Found a bug in the Wiki?!](https://github.com/qdm12/gluetun/issues/new?assignees=&labels=%F0%9F%93%84+Wiki+issue&template=wiki+issue.md&title=Wiki+issue%3A+)
## [Home](https://github.com/qdm12/gluetun/wiki)
## Setup
- Prerequisites
- [32 bit prerequisites](32-bit-prerequisites)
- [Synology prerequisites](Synology-prerequisites)
- Providers
- [Custom provider](Custom-provider)
- [Cyberghost](Cyberghost)
- [FastestVPN](FastestVPN)
- [Hidemyass](Hidemyass)
- [IVPN](IVPN)
- [Mullvad](Mullvad)
- [Raspberry Pi](Raspberry-Pi)
- [Bandwidth speeds](Bandwidth-speeds)
- [HTTP Control server](HTTP-Control-server)
- [Servers](Servers-Readme)
- [Servers Readme](Servers-Readme)
- [Cyberghost Servers](Cyberghost-Servers)
- [Fastestvpn Servers](Fastestvpn-Servers)
- [HideMyAss Servers](HideMyAss-Servers)
- [Ivpn Servers](Ivpn-Servers)
- [Mullvad Servers](Mullvad-Servers)
- [Nordvpn Servers](Nordvpn-Servers)
- [Privado Servers](Privado-Servers)
- [Private Internet Access Servers](Private-Internet-Access-Servers)
- [PrivateVPN Servers](Privatevpn-Servers)
- [Protonvpn Servers](Protonvpn-Servers)
- [PureVPN Servers](Purevpn-Servers)
- [Surfshark Servers](Surfshark-Servers)
- [Torguard Servers](Torguard-Servers)
- [VPN Unlimited Servers](VPN-Unlimited-Servers)
- [VyprVPN Servers](Vyprvpn-Servers)
- [Windscribe Servers](Windscribe-Servers)
- [Updating Servers](Updating-Servers)
- Contributing
- [Contribute](Contribute)
- [Development](Development)
- [More information](More-information)
- [NordVPN](NordVPN)
- [Privado](Privado)
- [Private internet access](Private-internet-access)
- [PrivateVPN](PrivateVPN)
- [ProtonVPN](ProtonVPN)
- [PureVPN](PureVPN)
- [Surfshark](Surfshark)
- [Torguard](Torguard)
- [VPN Unlimited](VPN-Unlimited)
- [VyprVPN](VyprVPN)
- [WeVPN](WeVPN)
- [Windscribe](Windscribe)
- [Connect a container to gluetun](Connect-a-container-to-gluetun)
- [Connect a LAN device to gluetun](Connect-a-LAN-device-to-gluetun)
- [Port mapping](Port-mapping)
- [Wireguard](Wireguard)
- [Test your setup (optional)](Test-your-setup)
- [Docker image tags](Docker-image-tags)
## Advanced setup
- [OpenVPN options](OpenVPN-options)
- [VPN server port forwarding](VPN-server-port-forwarding)
- [Shadowsocks options](Shadowsocks-options)
- [HTTP proxy options](HTTP-proxy-options)
- [Firewall options](Firewall-options)
- [DNS options](DNS-options)
- [HTTP control server options](HTTP-control-server-options)
- [Outdated servers](Outdated-servers)
- [Updating servers](Updating-servers)
- [Docker secrets](Docker-secrets)
- [OpenVPN configuration file](OpenVPN-configuration-file)
- [Other options](Other-options)
## FAQ
- [Iptables errors](Iptables)
- [OpenVPN errors](OpenVPN)
- [Bandwidth speeds](Bandwidth-speeds)
- [Explanations](Explanations)
## Contributing
- [Contribute](Contribute)
- [Development](Development)
## Other pages referenced
- [Setup: OpenVPN client certificate](OpenVPN-client-certificate)
- [Setup: OpenVPN client key](OpenVPN-client-key)