This is the container path to store gluetun related configuration.

Target

/gluetun

Default

/mnt/cache/appdata/gluetun

HTTP Control Server port

Target

8000

Default

8000

HTTP Proxy port (when HTTPPROXY=on)

Target

8888

Default

8888

Shadowsocks port TCP (when SHADOWSOCKS=on)

Target

8388

Default

8388

Shadowsocks port UDP (when SHADOWSOCKS=on)

Target

8388

Default

8388

Specify a supported VPN provider to use

Target

VPN_SERVICE_PROVIDER

Default

private internet access|airvpn|cyberghost|expressvpn|fastestvpn|hidemyass|ipvanish|ivpn|mullvad|nordvpn|perfect privacy|privado|privatevpn|protonvpn|purevpn|slickvpn|surfshark|torguard|vpnsecure|vpn unlimited|vyprvpn|wevpn|windscribe|custom

VPN protocol to use. Not all providers support Wireguard.

Target

VPN_TYPE

Default

openvpn|wireguard

Specify a custom network interface name to use

Target

VPN_INTERFACE

Default

tun0|en0

Encryption preset, 'none' disables the cipher and auth OpenVPN options (not recommended).

Target

PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET

Default

normal|strong|none

OpenVPN username (required for OpenVPN)

Target

OPENVPN_USER

OpenVPN password (required for OpenVPN)

Target

OPENVPN_PASSWORD

Network protocol to use for OpenVPN

Target

OPENVPN_PROTOCOL

Default

udp|tcp

Set the OpenVPN version to run

Target

OPENVPN_VERSION

Default

2.6|2.5

Specify a target VPN server IP address to use

Target

OPENVPN_ENDPOINT_IP

Specify a target VPN server port number to use

Target

OPENVPN_ENDPOINT_PORT

OpenVPN verbosity level (1-6)

Target

OPENVPN_VERBOSITY

Default

1|2|3|4|5|6

Space delimited OpenVPN flags to pass to openvpn

Target

OPENVPN_FLAGS

Run OpenVPN as root

Target

OPENVPN_ROOT

Default

no|yes

Specify a custom cipher to use (e.g. aes-256-gcm)

Target

OPENVPN_CIPHERS

Specify a custom auth algorithm to use (e.g. sha256)

Target

OPENVPN_AUTH

Set the MSS fix parameter (0-9999, 0 to use defaults)

Target

OPENVPN_MSSFIX

Default

0

Path to custom OpenVPN configuration file for custom provider

Target

OPENVPN_CUSTOM_CONFIG

Wireguard client private key (required for Wireguard)

Target

WIREGUARD_PRIVATE_KEY

Wireguard IP network interface address (xx.xx.xx.xx/xx)

Target

WIREGUARD_ADDRESSES

Wireguard server public key

Target

WIREGUARD_PUBLIC_KEY

Wireguard server endpoint IP address

Target

WIREGUARD_ENDPOINT_IP

Wireguard server endpoint port number

Target

WIREGUARD_ENDPOINT_PORT

Wireguard pre-shared key

Target

WIREGUARD_PRESHARED_KEY

Wireguard peer allowed IPs (CSV format)

Target

WIREGUARD_ALLOWED_IPS

Default

0.0.0.0/0,::/0

Wireguard implementation to use

Target

WIREGUARD_IMPLEMENTATION

Default

auto|kernelspace|userspace

Wireguard MTU (1-65535)

Target

WIREGUARD_MTU

Default

1400

Wireguard persistent keepalive interval (e.g. 25s)

Target

WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL

Comma separated list of countries

Target

SERVER_COUNTRIES

Comma separated list of regions

Target

SERVER_REGIONS

Comma separated list of cities

Target

SERVER_CITIES

Comma separated list of server hostnames

Target

SERVER_HOSTNAMES

Comma separated list of server names

Target

SERVER_NAMES

Comma separated list of server categories (NordVPN)

Target

SERVER_CATEGORIES

Enable custom port forwarding code for supported providers

Target

VPN_PORT_FORWARDING

Default

off|on

Choose the custom port forwarding code to use

Target

VPN_PORT_FORWARDING_PROVIDER

File path to use for writing the forwarded port obtained

Target

VPN_PORT_FORWARDING_STATUS_FILE

Default

/gluetun/forwarded_port

Port redirection for the VPN server side port forwarded

Target

VPN_PORT_FORWARDING_LISTENING_PORT

Comma separated list of ports to allow from the VPN server side

Target

FIREWALL_VPN_INPUT_PORTS

Comma separated list of ports to allow through the default interface

Target

FIREWALL_INPUT_PORTS

Prints every firewall related command (debugging only)

Target

FIREWALL_DEBUG

Default

off|on

Comma separated subnets that Gluetun is allowed to access

Target

FIREWALL_OUTBOUND_SUBNETS

Activate DNS over TLS with Unbound

Target

DNS_SERVER

Default

on

How to connect to upstream DNS servers: dot (DNS over TLS), doh (DNS over HTTPS), plain (UDP DNS)

Target

DNS_UPSTREAM_RESOLVER_TYPE

Default

dot|doh|plain

Comma delimited list of DNS over TLS providers, valid values are: 'google', 'quad9', 'quadrant', 'cleanbrowsing', 'libredns', 'opendns'

Target

DNS_UPSTREAM_RESOLVERS

Default

google

Comma separated list of domain names to leave unblocked from the filtering

Target

DNS_UNBLOCK_HOSTNAMES

Unbound caching

Target

DNS_CACHING

Default

on|off

All private CIDRs ranges. Comma separated list of CIDRs or single IP addresses Unbound won't resolve to. Note that the default setting prevents DNS rebinding

Target

DNS_BLOCK_IP_PREFIXES

Default

127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff:7f00:1/104,::ffff:a00:0/104,::ffff:a9fe:0/112,::ffff:ac10:0/108,::ffff:c0a8:0/112

DNS IPv6 resolution

Target

DNS_UPSTREAM_IPV6

Default

off|on

Comma separated list of IP addresses to not resolve public domains to

Target

DNS_BLOCK_IPS

Comma separated list of public domain names to exclude from DNS rebinding protection

Target

DNS_REBINDING_PROTECTION_EXEMPT_HOSTNAMES

Period to update block lists and restart Unbound (e.g. 24h, 0 to disable)

Target

DNS_UPDATE_PERIOD

Default

24h

IP address to use as DNS resolver

Target

DNS_ADDRESS

Default

127.0.0.1

Keep /etc/resolv.conf untouched

Target

DNS_KEEP_NAMESERVER

Default

off|on

Block malicious hostnames and IPs with Unbound

Target

BLOCK_MALICIOUS

Default

on|off

Block surveillance hostnames and IPs with Unbound

Target

BLOCK_SURVEILLANCE

Default

off|on

Block ads hostnames and IPs with Unbound

Target

BLOCK_ADS

Default

off|on

Enable the internal HTTP proxy

Target

HTTPPROXY

Default

off|on

Logs every tunnel requests

Target

HTTPPROXY_LOG

Default

off|on

Internal listening address for the HTTP proxy

Target

HTTPPROXY_LISTENING_ADDRESS

Default

:8888

Username to use to connect to the HTTP proxy

Target

HTTPPROXY_USER

Password to use to connect to the HTTP proxy

Target

HTTPPROXY_PASSWORD

Stealth mode means HTTP proxy headers are not added

Target

HTTPPROXY_STEALTH

Default

off|on

Enable the internal Shadowsocks proxy

Target

SHADOWSOCKS

Default

off|on

Enable Shadowsocks logging

Target

SHADOWSOCKS_LOG

Default

off|on

Internal listening address for Shadowsocks

Target

SHADOWSOCKS_LISTENING_ADDRESS

Default

:8388

Password to use to connect to Shadowsocks

Target

SHADOWSOCKS_PASSWORD

AEAD Cipher to use for Shadowsocks

Target

SHADOWSOCKS_CIPHER

Default

chacha20-ietf-poly1305|aes-128-gcm|aes-256-gcm

Authentication configuration for the HTTP Control Server

Target

HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE

Default

{"auth":"basic","username":"controlserver","password":"controlserver"}

Listening address for the HTTP Control Server

Target

HTTP_CONTROL_SERVER_ADDRESS

Default

:8000

Enable logging of requests for the HTTP Control Server

Target

HTTP_CONTROL_SERVER_LOG

Default

on|off

Path to a TOML file containing authentication configuration for the HTTP Control Server

Target

HTTP_CONTROL_SERVER_AUTH_CONFIG_FILEPATH

Comma-separated addresses to ping on every internal health check (replaces HEALTH_TARGET_ADDRESS)

Target

HEALTH_TARGET_ADDRESSES

Default

google.com:443

Initial duration to wait for the VPN to be ready

Target

HEALTH_VPN_DURATION_INITIAL

Default

6s

Additional duration to add for each consecutive VPN failure

Target

HEALTH_VPN_DURATION_ADDITION

Default

5s

Duration to wait after a success check

Target

HEALTH_SUCCESS_WAIT_DURATION

Default

5s

Internal health check server listening address

Target

HEALTH_SERVER_ADDRESS

Default

127.0.0.1:9999

Period to update VPN servers data e.g. '24h' (0 to disable)

Target

UPDATER_PERIOD

Default

0

Ratio of servers to be found for update to succeed

Target

UPDATER_MIN_RATIO

Default

0.8

List of providers to update servers data for

Target

UPDATER_VPN_SERVICE_PROVIDERS

Path of servers.json file (empty to disable caching)

Target

STORAGE_FILEPATH

Default

/gluetun/servers.json

Specify a timezone to use to have correct log times. i.e. Europe/London

Target

TZ

User ID to run as non root

Target

PUID

Default

99

Group ID to run as non root

Target

PGID

Default

100

Check for public IP address information on VPN connection

Target

PUBLICIP_ENABLED

Default

true

Public IP echo service API to use

Target

PUBLICIP_API

Default

ipinfo

Optional API token for the public IP echo service

Target

PUBLICIP_API_TOKEN

Filepath to store the public IP address assigned

Target

PUBLICIP_FILE

Default

/gluetun/ip

Logs a message indicating if a newer version is available

Target

VERSION_INFORMATION

Default

on