This is the container path to store gluetun related configuration.

Ziel

/gluetun

Standard

/mnt/cache/appdata/gluetun

HTTP Control Server port

Ziel

8000

Standard

8000

HTTP Proxy port (when HTTPPROXY=on)

Ziel

8888

Standard

8888

Shadowsocks port TCP (when SHADOWSOCKS=on)

Ziel

8388

Standard

8388

Shadowsocks port UDP (when SHADOWSOCKS=on)

Ziel

8388

Standard

8388

Specify a supported VPN provider to use

Ziel

VPN_SERVICE_PROVIDER

Standard

private internet access|airvpn|cyberghost|expressvpn|fastestvpn|hidemyass|ipvanish|ivpn|mullvad|nordvpn|perfect privacy|privado|privatevpn|protonvpn|purevpn|slickvpn|surfshark|torguard|vpnsecure|vpn unlimited|vyprvpn|wevpn|windscribe|custom

VPN protocol to use. Not all providers support Wireguard.

Ziel

VPN_TYPE

Standard

openvpn|wireguard

Specify a custom network interface name to use

Ziel

VPN_INTERFACE

Standard

tun0|en0

Encryption preset, 'none' disables the cipher and auth OpenVPN options (not recommended).

Ziel

PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET

Standard

normal|strong|none

OpenVPN username (required for OpenVPN)

Ziel

OPENVPN_USER

OpenVPN password (required for OpenVPN)

Ziel

OPENVPN_PASSWORD

Network protocol to use for OpenVPN

Ziel

OPENVPN_PROTOCOL

Standard

udp|tcp

Set the OpenVPN version to run

Ziel

OPENVPN_VERSION

Standard

2.6|2.5

Specify a target VPN server IP address to use

Ziel

OPENVPN_ENDPOINT_IP

Specify a target VPN server port number to use

Ziel

OPENVPN_ENDPOINT_PORT

OpenVPN verbosity level (1-6)

Ziel

OPENVPN_VERBOSITY

Standard

1|2|3|4|5|6

Space delimited OpenVPN flags to pass to openvpn

Ziel

OPENVPN_FLAGS

Run OpenVPN as root

Ziel

OPENVPN_ROOT

Standard

no|yes

Specify a custom cipher to use (e.g. aes-256-gcm)

Ziel

OPENVPN_CIPHERS

Specify a custom auth algorithm to use (e.g. sha256)

Ziel

OPENVPN_AUTH

Set the MSS fix parameter (0-9999, 0 to use defaults)

Ziel

OPENVPN_MSSFIX

Standard

0

Path to custom OpenVPN configuration file for custom provider

Ziel

OPENVPN_CUSTOM_CONFIG

Wireguard client private key (required for Wireguard)

Ziel

WIREGUARD_PRIVATE_KEY

Wireguard IP network interface address (xx.xx.xx.xx/xx)

Ziel

WIREGUARD_ADDRESSES

Wireguard server public key

Ziel

WIREGUARD_PUBLIC_KEY

Wireguard server endpoint IP address

Ziel

WIREGUARD_ENDPOINT_IP

Wireguard server endpoint port number

Ziel

WIREGUARD_ENDPOINT_PORT

Wireguard pre-shared key

Ziel

WIREGUARD_PRESHARED_KEY

Wireguard peer allowed IPs (CSV format)

Ziel

WIREGUARD_ALLOWED_IPS

Standard

0.0.0.0/0,::/0

Wireguard implementation to use

Ziel

WIREGUARD_IMPLEMENTATION

Standard

auto|kernelspace|userspace

Wireguard MTU (1-65535)

Ziel

WIREGUARD_MTU

Standard

1400

Wireguard persistent keepalive interval (e.g. 25s)

Ziel

WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL

Comma separated list of countries

Ziel

SERVER_COUNTRIES

Comma separated list of regions

Ziel

SERVER_REGIONS

Comma separated list of cities

Ziel

SERVER_CITIES

Comma separated list of server hostnames

Ziel

SERVER_HOSTNAMES

Comma separated list of server names

Ziel

SERVER_NAMES

Comma separated list of server categories (NordVPN)

Ziel

SERVER_CATEGORIES

Enable custom port forwarding code for supported providers

Ziel

VPN_PORT_FORWARDING

Standard

off|on

Choose the custom port forwarding code to use

Ziel

VPN_PORT_FORWARDING_PROVIDER

File path to use for writing the forwarded port obtained

Ziel

VPN_PORT_FORWARDING_STATUS_FILE

Standard

/gluetun/forwarded_port

Port redirection for the VPN server side port forwarded

Ziel

VPN_PORT_FORWARDING_LISTENING_PORT

Comma separated list of ports to allow from the VPN server side

Ziel

FIREWALL_VPN_INPUT_PORTS

Comma separated list of ports to allow through the default interface

Ziel

FIREWALL_INPUT_PORTS

Prints every firewall related command (debugging only)

Ziel

FIREWALL_DEBUG

Standard

off|on

Comma separated subnets that Gluetun is allowed to access

Ziel

FIREWALL_OUTBOUND_SUBNETS

Activate DNS over TLS with Unbound

Ziel

DNS_SERVER

Standard

on

How to connect to upstream DNS servers: dot (DNS over TLS), doh (DNS over HTTPS), plain (UDP DNS)

Ziel

DNS_UPSTREAM_RESOLVER_TYPE

Standard

dot|doh|plain

Comma delimited list of DNS over TLS providers, valid values are: 'google', 'quad9', 'quadrant', 'cleanbrowsing', 'libredns', 'opendns'

Ziel

DNS_UPSTREAM_RESOLVERS

Standard

google

Comma separated list of domain names to leave unblocked from the filtering

Ziel

DNS_UNBLOCK_HOSTNAMES

Unbound caching

Ziel

DNS_CACHING

Standard

on|off

All private CIDRs ranges. Comma separated list of CIDRs or single IP addresses Unbound won't resolve to. Note that the default setting prevents DNS rebinding

Ziel

DNS_BLOCK_IP_PREFIXES

Standard

127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff:7f00:1/104,::ffff:a00:0/104,::ffff:a9fe:0/112,::ffff:ac10:0/108,::ffff:c0a8:0/112

DNS IPv6 resolution

Ziel

DNS_UPSTREAM_IPV6

Standard

off|on

Comma separated list of IP addresses to not resolve public domains to

Ziel

DNS_BLOCK_IPS

Comma separated list of public domain names to exclude from DNS rebinding protection

Ziel

DNS_REBINDING_PROTECTION_EXEMPT_HOSTNAMES

Period to update block lists and restart Unbound (e.g. 24h, 0 to disable)

Ziel

DNS_UPDATE_PERIOD

Standard

24h

IP address to use as DNS resolver

Ziel

DNS_ADDRESS

Standard

127.0.0.1

Keep /etc/resolv.conf untouched

Ziel

DNS_KEEP_NAMESERVER

Standard

off|on

Block malicious hostnames and IPs with Unbound

Ziel

BLOCK_MALICIOUS

Standard

on|off

Block surveillance hostnames and IPs with Unbound

Ziel

BLOCK_SURVEILLANCE

Standard

off|on

Block ads hostnames and IPs with Unbound

Ziel

BLOCK_ADS

Standard

off|on

Enable the internal HTTP proxy

Ziel

HTTPPROXY

Standard

off|on

Logs every tunnel requests

Ziel

HTTPPROXY_LOG

Standard

off|on

Internal listening address for the HTTP proxy

Ziel

HTTPPROXY_LISTENING_ADDRESS

Standard

:8888

Username to use to connect to the HTTP proxy

Ziel

HTTPPROXY_USER

Password to use to connect to the HTTP proxy

Ziel

HTTPPROXY_PASSWORD

Stealth mode means HTTP proxy headers are not added

Ziel

HTTPPROXY_STEALTH

Standard

off|on

Enable the internal Shadowsocks proxy

Ziel

SHADOWSOCKS

Standard

off|on

Enable Shadowsocks logging

Ziel

SHADOWSOCKS_LOG

Standard

off|on

Internal listening address for Shadowsocks

Ziel

SHADOWSOCKS_LISTENING_ADDRESS

Standard

:8388

Password to use to connect to Shadowsocks

Ziel

SHADOWSOCKS_PASSWORD

AEAD Cipher to use for Shadowsocks

Ziel

SHADOWSOCKS_CIPHER

Standard

chacha20-ietf-poly1305|aes-128-gcm|aes-256-gcm

Authentication configuration for the HTTP Control Server

Ziel

HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE

Standard

{"auth":"basic","username":"controlserver","password":"controlserver"}

Listening address for the HTTP Control Server

Ziel

HTTP_CONTROL_SERVER_ADDRESS

Standard

:8000

Enable logging of requests for the HTTP Control Server

Ziel

HTTP_CONTROL_SERVER_LOG

Standard

on|off

Path to a TOML file containing authentication configuration for the HTTP Control Server

Ziel

HTTP_CONTROL_SERVER_AUTH_CONFIG_FILEPATH

Comma-separated addresses to ping on every internal health check (replaces HEALTH_TARGET_ADDRESS)

Ziel

HEALTH_TARGET_ADDRESSES

Standard

google.com:443

Initial duration to wait for the VPN to be ready

Ziel

HEALTH_VPN_DURATION_INITIAL

Standard

6s

Additional duration to add for each consecutive VPN failure

Ziel

HEALTH_VPN_DURATION_ADDITION

Standard

5s

Duration to wait after a success check

Ziel

HEALTH_SUCCESS_WAIT_DURATION

Standard

5s

Internal health check server listening address

Ziel

HEALTH_SERVER_ADDRESS

Standard

127.0.0.1:9999

Period to update VPN servers data e.g. '24h' (0 to disable)

Ziel

UPDATER_PERIOD

Standard

0

Ratio of servers to be found for update to succeed

Ziel

UPDATER_MIN_RATIO

Standard

0.8

List of providers to update servers data for

Ziel

UPDATER_VPN_SERVICE_PROVIDERS

Path of servers.json file (empty to disable caching)

Ziel

STORAGE_FILEPATH

Standard

/gluetun/servers.json

Specify a timezone to use to have correct log times. i.e. Europe/London

Ziel

TZ

User ID to run as non root

Ziel

PUID

Standard

99

Group ID to run as non root

Ziel

PGID

Standard

100

Check for public IP address information on VPN connection

Ziel

PUBLICIP_ENABLED

Standard

true

Public IP echo service API to use

Ziel

PUBLICIP_API

Standard

ipinfo

Optional API token for the public IP echo service

Ziel

PUBLICIP_API_TOKEN

Filepath to store the public IP address assigned

Ziel

PUBLICIP_FILE

Standard

/gluetun/ip

Logs a message indicating if a newer version is available

Ziel

VERSION_INFORMATION

Standard

on