All apps · 0 apps

gluetun

Overview

VPN swiss-knife like client to tunnel to multiple VPN servers. VPN client in a thin Docker container for multiple VPN providers, written in Go, and using OpenVPN or Wireguard, DNS over TLS, with a few proxy servers built-in.

Readme

View on GitHub

Gluetun VPN client

Lightweight swiss-army-knife-like VPN client to multiple VPN service providers

⚠️ This and gluetun-wiki are the only websites for Gluetun, other websites claiming to be official are scams ⚠️

🗯️ this repository will be migrated to github.com/passteque/gluetun on 2026-05-21, which is a Github organization under my sole control, so don't get alarmed if you get redirected in the coming days 😉 Reason being migrating Github sponsors to the Open source collective due to my personal situation, basically annoying paperwork. On the plus side, it will be more transparent and funds donated will only be used for the project. The Docker image names will remain the same.

Title image

Last release Last Docker tag GitHub last release date Commits since release

Code size GitHub repo size Go version

Quick links

Setup
Features
Problem?
- Check the Wiki common errors and faq
- Start a discussion
- Fix the Unraid template
Suggestion?
- Create an issue
Happy?
- Sponsor me on github.com/sponsors/qdm12
- Donate to paypal.me/qmcgaw
- Drop me an email
Want to add a VPN provider? check the development page and add a provider page
Video:
Substack Console interview

Features

Based on Alpine 3.23 for a small Docker image of 43.1MB
Supports: AirVPN, Cyberghost, ExpressVPN, FastestVPN, Giganews, HideMyAss, IPVanish, IVPN, Mullvad (Wireguard only), NordVPN, Privado, Private Internet Access, PrivateVPN, ProtonVPN, PureVPN, SlickVPN, Surfshark, TorGuard, VPNSecure.me, VPNUnlimited, Vyprvpn, Windscribe servers
Supports OpenVPN for all providers listed
Supports Wireguard both kernelspace and userspace
- For AirVPN, FastestVPN, Ivpn, Mullvad, NordVPN, ProtonVPN, Surfshark and Windscribe
- For Cyberghost, Private Internet Access, PrivateVPN, PureVPN, Torguard, VPN Unlimited and VyprVPN using the custom provider
- For custom Wireguard configurations using the custom provider
- More in progress, see #134
Supports AmneziaWG only with the custom provider for now
DNS over TLS baked in with service provider(s) of your choice
DNS fine blocking of malicious/ads hostnames and IP addresses, with live update every 24 hours
Choose the vpn network protocol, udp or tcp
Built in firewall kill switch that only allows traffic through the VPN, to the VPN server, and to allowed LAN devices
Built in Shadowsocks proxy server (protocol based on SOCKS5 with an encryption layer, tunnels TCP+UDP)
Built in Socks5 proxy server (tunnels TCP+UDP) - partial credits to @angelakis and @adjscent
Built in HTTP proxy (tunnels HTTP and HTTPS through TCP)
Connect other containers to it
Connect LAN devices to it
Compatible with amd64, i686 (32 bit), ARM 64 bit, ARM 32 bit v6 and v7, and even ppc64le 🎆
Custom VPN server side port forwarding for Private Internet Access, PrivateVPN and ProtonVPN
Possibility of split horizon DNS by selecting multiple DNS over TLS providers
Can work as a Kubernetes sidecar container, thanks @rorph

Setup

🎉 There are now instructions specific to each VPN provider with examples to help you get started as quickly as possible!

Go to the Wiki!

🐛 Found a bug in the Wiki?!

Here's a docker-compose.yml for the laziest:

---
services:
  gluetun:
    image: qmcgaw/gluetun
    # container_name: gluetun
    # line above must be uncommented to allow external containers to connect.
    # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/connect-a-container-to-gluetun.md#external-container-to-gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
    volumes:
      - /yourpath:/gluetun
    environment:
      # See https://github.com/qdm12/gluetun-wiki/tree/main/setup#setup
      - VPN_SERVICE_PROVIDER=ivpn
      - VPN_TYPE=openvpn
      # OpenVPN:
      - OPENVPN_USER=
      - OPENVPN_PASSWORD=
      # Wireguard:
      # - WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU=
      # - WIREGUARD_ADDRESSES=10.64.222.21/32
      # Timezone for accurate log times
      - TZ=
      # Server list updater
      # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
      - UPDATER_PERIOD=

🆕 Image also available as ghcr.io/qdm12/gluetun

Fun graphs

License

Install Gluetun on Unraid in a few clicks.

Find Gluetun in Community Apps on your Unraid server, review the template, and click Install. Unraid handles the Docker app or plugin setup from the published template.

Open the Apps tab on your Unraid server Search Community Apps for Gluetun Review the template variables and paths Click Install

Explore Unraid OS

Related apps

Explore more like this

Explore all

Security VPN apps

Links

Projectgithub.com Supportgithub.com Docker Hubhub.docker.com Templateraw.githubusercontent.com

Details

Repository

qmcgaw/gluetun:latest

Registry

https://hub.docker.com/r/qmcgaw/gluetun

Last Updated2026-08-24

First Seen2021-07-24

Runtime arguments

Web UI: http://[IP]:[PORT:8000]
Network: bridge
Shell: sh
Privileged: false
Extra Params: --cap-add=NET_ADMIN --device /dev/net/tun:/dev/net/tun

Template configuration

Appdata DirectoryPathrw

Where Gluetun stores its configuration.

Target: /gluetun
Default: /mnt/user/appdata/gluetun
Value: /mnt/user/appdata/gluetun

Control Server PortPorttcp

WebUI / Control Server

Target: 8000
Default: 8000
Value: 8015

HTTP Proxy PortPorttcp

HTTP proxy

Target: 8888
Default: 8888
Value: 8885

Shadowsocks Port (TCP)Porttcp

Shadowsocks TCP

Target: 8388
Default: 8388
Value: 8388

Shadowsocks Port (UDP)Portudp

Shadowsocks UDP

Target: 8388
Default: 8388
Value: 8388

Socks5 Port (TCP)Porttcp

Socks5 TCP

Target: 1080
Default: 1080
Value: 1085

Socks5 Port (UDP)Portudp

Socks5 UDP

Target: 1080
Default: 1080
Value: 1085

VPN_SERVICE_PROVIDERVariable

Default: airvpn|custom|cyberghost|expressvpn|fastestvpn|hide.me|ipvanish|ivpn|mullvad|nordvpn|perfectprivacy|privado|pia|privatevpn|protonvpn|purevpn|surfshark|torguard|vpnsecure|vpnunlimited|vyprvpn|wevpn|windscribe
Value: nordvpn

VPN_TYPEVariable

Default: openvpn|wireguard
Value: wireguard

SERVER_COUNTRIESVariable

Value: United States

TimezoneVariable

Timezone

Target: TZ
Value: America/New_York

Transmission WebUIPorttcp

Transmission WebUI

Target: 9091
Default: 9091
Value: 9091

Transmission Port TCPPorttcp

Transmission Port TCP

Target: 51413
Default: 51413
Value: 51413

Transmission Port UDPPortudp

Transmission Port UDP

Target: 51413
Default: 51413
Value: 51413

Brave HTTPPorttcp

Brave desktop GUI HTTP must be proxied.

Target: 3000
Default: 3000
Value: 6000

Brave HTTPSPorttcp

Brave HTTPS.

Target: 3001
Default: 3001
Value: 6001

Firefox HTTPPorttcp

Firefox desktop GUI HTTP must be proxied.

Target: 4000
Value: 6002

Firefox HTTPSPorttcp

Firefox HTTPS.

Target: 4001
Value: 6003

Chrome HTTPPorttcp

Firefox desktop GUI HTTP must be proxied.

Target: 5000
Value: 6004

Chrome HTTPSPorttcp

Chrome HTTPS.

Target: 5001
Value: 6005

PATHVariable

Value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

VPN_INTERFACEVariable

Value: tun0

OPENVPN_ENDPOINT_IPVariable

OPENVPN_ENDPOINT_PORTVariable

OPENVPN_PROTOCOLVariable

Default: udp|tcp
Value: udp

OPENVPN_USERVariable

OPENVPN_PASSWORDVariable

OPENVPN_USER_SECRETFILEVariable

Value: /run/secrets/openvpn_user

OPENVPN_PASSWORD_SECRETFILEVariable

Value: /run/secrets/openvpn_password

OPENVPN_VERSIONVariable

Default: 2.6|2.5
Value: 2.6

OPENVPN_VERBOSITYVariable

Default: 0|1|2|3|4|5|6
Value: 1

OPENVPN_FLAGSVariable

OPENVPN_CIPHERSVariable

OPENVPN_AUTHVariable

OPENVPN_PROCESS_USERVariable

Value: root

OPENVPN_MSSFIXVariable

OPENVPN_CUSTOM_CONFIGVariable

WIREGUARD_ENDPOINT_IPVariable

WIREGUARD_PRIVATE_KEYVariable

WIREGUARD_ENDPOINT_PORTVariable

WIREGUARD_CONF_SECRETFILEVariable

Value: /run/secrets/wg0.conf

WIREGUARD_PRIVATE_KEY_SECRETFILEVariable

Value: /run/secrets/wireguard_private_key

WIREGUARD_PRESHARED_KEYVariable

WIREGUARD_PRESHARED_KEY_SECRETFILEVariable

Value: /run/secrets/wireguard_preshared_key

WIREGUARD_PUBLIC_KEYVariable

WIREGUARD_ALLOWED_IPSVariable

WIREGUARD_PERSISTENT_KEEPALIVE_INTERVALVariable

Value: 0

WIREGUARD_ADDRESSESVariable

WIREGUARD_ADDRESSES_SECRETFILEVariable

Value: /run/secrets/wireguard_addresses

WIREGUARD_MTUVariable

Value: 1320

WIREGUARD_IMPLEMENTATIONVariable

Default: auto|kernelspace|userspace
Value: auto

AMNEZIAWG_ENDPOINT_IPVariable

AMNEZIAWG_ENDPOINT_PORTVariable

AMNEZIAWG_CONF_SECRETFILEVariable

Value: /run/secrets/wg0.conf

AMNEZIAWG_PRIVATE_KEYVariable

AMNEZIAWG_PRIVATE_KEY_SECRETFILEVariable

Value: /run/secrets/wireguard_private_key

AMNEZIAWG_PRESHARED_KEYVariable

AMNEZIAWG_PRESHARED_KEY_SECRETFILEVariable

Value: /run/secrets/wireguard_preshared_key

AMNEZIAWG_PUBLIC_KEYVariable

AMNEZIAWG_ALLOWED_IPSVariable

AMNEZIAWG_PERSISTENT_KEEPALIVE_INTERVALVariable

Value: 0

AMNEZIAWG_ADDRESSESVariable

AMNEZIAWG_ADDRESSES_SECRETFILEVariable

Value: /run/secrets/wireguard_addresses

AMNEZIAWG_MTUVariable

AMNEZIAWG_JCVariable

Value: 0

AMNEZIAWG_JMINVariable

Value: 0

AMNEZIAWG_JMAXVariable

Value: 0

AMNEZIAWG_S1Variable

Value: 0

AMNEZIAWG_S2Variable

Value: 0

AMNEZIAWG_S3Variable

Value: 0

AMNEZIAWG_S4Variable

Value: 0

AMNEZIAWG_H1Variable

AMNEZIAWG_H2Variable

AMNEZIAWG_H3Variable

AMNEZIAWG_H4Variable

AMNEZIAWG_I1Variable

AMNEZIAWG_I2Variable

AMNEZIAWG_I3Variable

AMNEZIAWG_I4Variable

AMNEZIAWG_I5Variable

VPN_PORT_FORWARDINGVariable

Default: off|on
Value: off

VPN_PORT_FORWARDING_PROVIDERVariable

Default: private internet access|perfect privacy|privatevpn|protonvpn
Value: private internet access

VPN_PORT_FORWARDING_UP_COMMANDVariable

VPN_PORT_FORWARDING_DOWN_COMMANDVariable

VPN_PORT_FORWARDING_LISTENING_PORTSVariable

Value: 0

VPN_PORT_FORWARDING_PORTS_COUNTVariable

Default: 1|2|3|4|5
Value: 1

VPN_PORT_FORWARDING_STATUS_FILEVariable

Value: /tmp/gluetun/forwarded_port

PMTUD_ICMP_ADDRESSESVariable

Value: 1.1.1.1,8.8.8.8

PMTUD_TCP_ADDRESSESVariable

Value: 1.1.1.1:443,8.8.8.8:443,1.1.1.1:53,8.8.8.8:53,[2606:4700:4700::1111]:53,[2001:4860:4860::8888]:53,[2606:4700:4700::1111]:443,[2001:4860:4860::8888]:443

SERVER_REGIONSVariable

SERVER_CITIESVariable

SERVER_HOSTNAMESVariable

SERVER_CATEGORIESVariable

ISPVariable

OWNED_ONLYVariable

Default: no|yes
Value: no

PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESETVariable

Default: strong|normal
Value: strong

VPN_PORT_FORWARDING_USERNAMEVariable

VPN_PORT_FORWARDING_PASSWORDVariable

OPENVPN_CERTVariable

OPENVPN_KEYVariable

OPENVPN_CLIENTCRT_SECRETFILEVariable

Value: /run/secrets/openvpn_clientcrt

OPENVPN_CLIENTKEY_SECRETFILEVariable

Value: /run/secrets/openvpn_clientkey

OPENVPN_ENCRYPTED_KEYVariable

OPENVPN_ENCRYPTED_KEY_SECRETFILEVariable

Value: /run/secrets/openvpn_encrypted_key

OPENVPN_KEY_PASSPHRASEVariable

OPENVPN_KEY_PASSPHRASE_SECRETFILEVariable

Value: /run/secrets/openvpn_key_passphrase

SERVER_NUMBERVariable

SERVER_NAMESVariable

STREAM_ONLYVariable

Default: off|on
Value: off

FREE_ONLYVariable

Default: off|on
Value: off

SECURE_CORE_ONLYVariable

Default: off|on
Value: off

TOR_ONLYVariable

Default: off|on
Value: off

MULTIHOP_ONLYVariable

Default: off|on
Value: off

PREMIUM_ONLYVariable

Default: no|yes
Value: no

PORT_FORWARD_ONLYVariable

Default: off|on|true|false
Value: off

FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOTVariable

Default: on|off
Value: on

FIREWALL_VPN_INPUT_PORTSVariable

FIREWALL_INPUT_PORTSVariable

FIREWALL_OUTBOUND_SUBNETSVariable

Value: 192.168.10.0/24

FIREWALL_IPTABLES_LOG_LEVELVariable

Default: debug|info|warn|error
Value: info

IPV6_CHECK_ADDRESSESVariable

Value: [2001:4860:4860::8888]:53,[2606:4700:4700::1111]:53

LOG_LEVELVariable

Default: debug|info|warn|error
Value: info

HEALTH_SERVER_ADDRESSVariable

Value: 127.0.0.1:9999

HEALTH_TARGET_ADDRESSESVariable

Value: cloudflare.com:443,github.com:443

HEALTH_ICMP_TARGET_IPSVariable

Value: 1.1.1.1,8.8.8.8

HEALTH_SMALL_CHECK_TYPEVariable

Value: icmp

HEALTH_RESTART_VPNVariable

Default: on|off
Value: on

DNS_SERVERVariable

Default: on|off
Value: on

DNS_UPSTREAM_RESOLVER_TYPEVariable

Default: dot|doh|plain
Value: dot

DOTVariable

DNS over TLS Configuration

Default: on|off
Value: on

DNS_UPSTREAM_RESOLVERSVariable

Default: cloudflare|google|quad9|quad9 secured|quad9 unsecured|cloudflare family|cloudflare security|cleanbrowsing adult|cleanbrowsing family|cleanbrowsing security|cira family|cira private|cira protected|libredns|opendns|quadrant
Value: cloudflare

DNS_BLOCK_IPSVariable

DNS_BLOCK_IP_PREFIXESVariable

DNS_CACHINGVariable

Default: on|off
Value: on

DNS_UPSTREAM_IPV6Variable

Default: off|on
Value: off

BLOCK_MALICIOUSVariable

Default: on|off
Value: on

BLOCK_SURVEILLANCEVariable

Default: off|on
Value: on

BLOCK_ADSVariable

Default: off|on
Value: on

DNS_UNBLOCK_HOSTNAMESVariable

DNS_REBINDING_PROTECTION_EXEMPT_HOSTNAMESVariable

DNS_UPDATE_PERIODVariable

Value: 24h

DNS_UPSTREAM_PLAIN_ADDRESSESVariable

HTTPPROXYVariable

Default: off|on
Value: off

HTTPPROXY_LOGVariable

Default: off|on
Value: off

HTTPPROXY_LISTENING_ADDRESSVariable

Value: :8888

HTTPPROXY_STEALTHVariable

Default: off|on
Value: off

HTTPPROXY_USERVariable

HTTPPROXY_PASSWORDVariable

HTTPPROXY_USER_SECRETFILEVariable

Value: /run/secrets/httpproxy_user

HTTPPROXY_PASSWORD_SECRETFILEVariable

Value: /run/secrets/httpproxy_password

SHADOWSOCKSVariable

Default: off|on
Value: off

SHADOWSOCKS_LOGVariable

Default: off|on
Value: off

SHADOWSOCKS_LISTENING_ADDRESSVariable

Value: :8388

SHADOWSOCKS_PASSWORDVariable

SHADOWSOCKS_PASSWORD_SECRETFILEVariable

Value: /run/secrets/shadowsocks_password

SHADOWSOCKS_CIPHERVariable

Default: chacha20-ietf-poly1305|aes-128-gcm|aes-256-gcm
Value: chacha20-ietf-poly1305

SOCKS5_ENABLEDVariable

Default: off|on
Value: off

SOCKS5_LISTENING_ADDRESSVariable

Value: :1080

SOCKS5_USERVariable

SOCKS5_PASSWORDVariable

HTTP_CONTROL_SERVER_LOGVariable

Default: on|off
Value: on

HTTP_CONTROL_SERVER_ADDRESSVariable

Value: :8000

HTTP_CONTROL_SERVER_AUTH_CONFIG_FILEPATHVariable

Value: /gluetun/auth/config.toml

HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLEVariable

Value: {}

UPDATER_PERIODVariable

Value: 0

UPDATER_MIN_RATIOVariable

Value: 0.8

UPDATER_VPN_SERVICE_PROVIDERSVariable

UPDATER_PREFER_DIRECT_DOWNLOADVariable

Default: no|yes
Value: no

UPDATER_PROTONVPN_EMAILVariable

UPDATER_PROTONVPN_PASSWORDVariable

PUBLICIP_FILEVariable

Value: /tmp/gluetun/ip

PUBLICIP_ENABLEDVariable

Default: on|off
Value: on

PUBLICIP_APIVariable

Value: ipinfo,ifconfigco,ip2location,cloudflare

PUBLICIP_API_TOKENVariable

STORAGE_SERVERS_ENABLEDVariable

Default: on|off
Value: on

STORAGE_SERVERS_DIRECTORY_PATHVariable

Value: /gluetun/servers/

PPROF_ENABLEDVariable

Default: no|yes
Value: no

PPROF_BLOCK_PROFILE_RATEVariable

Value: 0

PPROF_MUTEX_PROFILE_RATEVariable

Value: 0

PPROF_HTTP_SERVER_ADDRESSVariable

Value: :6060

VERSION_INFORMATIONVariable

Default: on|off
Value: on

PUIDVariable

Value: 1000

PGIDVariable

Value: 1000

Library

Curated

Categories