This is the container path to store gluetun related configuration.

Cible

/gluetun

Défaut

/mnt/cache/appdata/gluetun

HTTP Control Server port

Cible

8000

Défaut

8000

HTTP Proxy port (when HTTPPROXY=on)

Cible

8888

Défaut

8888

Shadowsocks port TCP (when SHADOWSOCKS=on)

Cible

8388

Défaut

8388

Shadowsocks port UDP (when SHADOWSOCKS=on)

Cible

8388

Défaut

8388

Specify a supported VPN provider to use

Cible

VPN_SERVICE_PROVIDER

Défaut

private internet access|airvpn|cyberghost|expressvpn|fastestvpn|hidemyass|ipvanish|ivpn|mullvad|nordvpn|perfect privacy|privado|privatevpn|protonvpn|purevpn|slickvpn|surfshark|torguard|vpnsecure|vpn unlimited|vyprvpn|wevpn|windscribe|custom

VPN protocol to use. Not all providers support Wireguard.

Cible

VPN_TYPE

Défaut

openvpn|wireguard

Specify a custom network interface name to use

Cible

VPN_INTERFACE

Défaut

tun0|en0

Encryption preset, 'none' disables the cipher and auth OpenVPN options (not recommended).

Cible

PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET

Défaut

normal|strong|none

OpenVPN username (required for OpenVPN)

Cible

OPENVPN_USER

OpenVPN password (required for OpenVPN)

Cible

OPENVPN_PASSWORD

Network protocol to use for OpenVPN

Cible

OPENVPN_PROTOCOL

Défaut

udp|tcp

Set the OpenVPN version to run

Cible

OPENVPN_VERSION

Défaut

2.6|2.5

Specify a target VPN server IP address to use

Cible

OPENVPN_ENDPOINT_IP

Specify a target VPN server port number to use

Cible

OPENVPN_ENDPOINT_PORT

OpenVPN verbosity level (1-6)

Cible

OPENVPN_VERBOSITY

Défaut

1|2|3|4|5|6

Space delimited OpenVPN flags to pass to openvpn

Cible

OPENVPN_FLAGS

Run OpenVPN as root

Cible

OPENVPN_ROOT

Défaut

no|yes

Specify a custom cipher to use (e.g. aes-256-gcm)

Cible

OPENVPN_CIPHERS

Specify a custom auth algorithm to use (e.g. sha256)

Cible

OPENVPN_AUTH

Set the MSS fix parameter (0-9999, 0 to use defaults)

Cible

OPENVPN_MSSFIX

Défaut

0

Path to custom OpenVPN configuration file for custom provider

Cible

OPENVPN_CUSTOM_CONFIG

Wireguard client private key (required for Wireguard)

Cible

WIREGUARD_PRIVATE_KEY

Wireguard IP network interface address (xx.xx.xx.xx/xx)

Cible

WIREGUARD_ADDRESSES

Wireguard server public key

Cible

WIREGUARD_PUBLIC_KEY

Wireguard server endpoint IP address

Cible

WIREGUARD_ENDPOINT_IP

Wireguard server endpoint port number

Cible

WIREGUARD_ENDPOINT_PORT

Wireguard pre-shared key

Cible

WIREGUARD_PRESHARED_KEY

Wireguard peer allowed IPs (CSV format)

Cible

WIREGUARD_ALLOWED_IPS

Défaut

0.0.0.0/0,::/0

Wireguard implementation to use

Cible

WIREGUARD_IMPLEMENTATION

Défaut

auto|kernelspace|userspace

Wireguard MTU (1-65535)

Cible

WIREGUARD_MTU

Défaut

1400

Wireguard persistent keepalive interval (e.g. 25s)

Cible

WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL

Comma separated list of countries

Cible

SERVER_COUNTRIES

Comma separated list of regions

Cible

SERVER_REGIONS

Comma separated list of cities

Cible

SERVER_CITIES

Comma separated list of server hostnames

Cible

SERVER_HOSTNAMES

Comma separated list of server names

Cible

SERVER_NAMES

Comma separated list of server categories (NordVPN)

Cible

SERVER_CATEGORIES

Enable custom port forwarding code for supported providers

Cible

VPN_PORT_FORWARDING

Défaut

off|on

Choose the custom port forwarding code to use

Cible

VPN_PORT_FORWARDING_PROVIDER

File path to use for writing the forwarded port obtained

Cible

VPN_PORT_FORWARDING_STATUS_FILE

Défaut

/gluetun/forwarded_port

Port redirection for the VPN server side port forwarded

Cible

VPN_PORT_FORWARDING_LISTENING_PORT

Comma separated list of ports to allow from the VPN server side

Cible

FIREWALL_VPN_INPUT_PORTS

Comma separated list of ports to allow through the default interface

Cible

FIREWALL_INPUT_PORTS

Prints every firewall related command (debugging only)

Cible

FIREWALL_DEBUG

Défaut

off|on

Comma separated subnets that Gluetun is allowed to access

Cible

FIREWALL_OUTBOUND_SUBNETS

Activate DNS over TLS with Unbound

Cible

DNS_SERVER

Défaut

on

How to connect to upstream DNS servers: dot (DNS over TLS), doh (DNS over HTTPS), plain (UDP DNS)

Cible

DNS_UPSTREAM_RESOLVER_TYPE

Défaut

dot|doh|plain

Comma delimited list of DNS over TLS providers, valid values are: 'google', 'quad9', 'quadrant', 'cleanbrowsing', 'libredns', 'opendns'

Cible

DNS_UPSTREAM_RESOLVERS

Défaut

google

Comma separated list of domain names to leave unblocked from the filtering

Cible

DNS_UNBLOCK_HOSTNAMES

Unbound caching

Cible

DNS_CACHING

Défaut

on|off

All private CIDRs ranges. Comma separated list of CIDRs or single IP addresses Unbound won't resolve to. Note that the default setting prevents DNS rebinding

Cible

DNS_BLOCK_IP_PREFIXES

Défaut

127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff:7f00:1/104,::ffff:a00:0/104,::ffff:a9fe:0/112,::ffff:ac10:0/108,::ffff:c0a8:0/112

DNS IPv6 resolution

Cible

DNS_UPSTREAM_IPV6

Défaut

off|on

Comma separated list of IP addresses to not resolve public domains to

Cible

DNS_BLOCK_IPS

Comma separated list of public domain names to exclude from DNS rebinding protection

Cible

DNS_REBINDING_PROTECTION_EXEMPT_HOSTNAMES

Period to update block lists and restart Unbound (e.g. 24h, 0 to disable)

Cible

DNS_UPDATE_PERIOD

Défaut

24h

IP address to use as DNS resolver

Cible

DNS_ADDRESS

Défaut

127.0.0.1

Keep /etc/resolv.conf untouched

Cible

DNS_KEEP_NAMESERVER

Défaut

off|on

Block malicious hostnames and IPs with Unbound

Cible

BLOCK_MALICIOUS

Défaut

on|off

Block surveillance hostnames and IPs with Unbound

Cible

BLOCK_SURVEILLANCE

Défaut

off|on

Block ads hostnames and IPs with Unbound

Cible

BLOCK_ADS

Défaut

off|on

Enable the internal HTTP proxy

Cible

HTTPPROXY

Défaut

off|on

Logs every tunnel requests

Cible

HTTPPROXY_LOG

Défaut

off|on

Internal listening address for the HTTP proxy

Cible

HTTPPROXY_LISTENING_ADDRESS

Défaut

:8888

Username to use to connect to the HTTP proxy

Cible

HTTPPROXY_USER

Password to use to connect to the HTTP proxy

Cible

HTTPPROXY_PASSWORD

Stealth mode means HTTP proxy headers are not added

Cible

HTTPPROXY_STEALTH

Défaut

off|on

Enable the internal Shadowsocks proxy

Cible

SHADOWSOCKS

Défaut

off|on

Enable Shadowsocks logging

Cible

SHADOWSOCKS_LOG

Défaut

off|on

Internal listening address for Shadowsocks

Cible

SHADOWSOCKS_LISTENING_ADDRESS

Défaut

:8388

Password to use to connect to Shadowsocks

Cible

SHADOWSOCKS_PASSWORD

AEAD Cipher to use for Shadowsocks

Cible

SHADOWSOCKS_CIPHER

Défaut

chacha20-ietf-poly1305|aes-128-gcm|aes-256-gcm

Authentication configuration for the HTTP Control Server

Cible

HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE

Défaut

{"auth":"basic","username":"controlserver","password":"controlserver"}

Listening address for the HTTP Control Server

Cible

HTTP_CONTROL_SERVER_ADDRESS

Défaut

:8000

Enable logging of requests for the HTTP Control Server

Cible

HTTP_CONTROL_SERVER_LOG

Défaut

on|off

Path to a TOML file containing authentication configuration for the HTTP Control Server

Cible

HTTP_CONTROL_SERVER_AUTH_CONFIG_FILEPATH

Comma-separated addresses to ping on every internal health check (replaces HEALTH_TARGET_ADDRESS)

Cible

HEALTH_TARGET_ADDRESSES

Défaut

google.com:443

Initial duration to wait for the VPN to be ready

Cible

HEALTH_VPN_DURATION_INITIAL

Défaut

6s

Additional duration to add for each consecutive VPN failure

Cible

HEALTH_VPN_DURATION_ADDITION

Défaut

5s

Duration to wait after a success check

Cible

HEALTH_SUCCESS_WAIT_DURATION

Défaut

5s

Internal health check server listening address

Cible

HEALTH_SERVER_ADDRESS

Défaut

127.0.0.1:9999

Period to update VPN servers data e.g. '24h' (0 to disable)

Cible

UPDATER_PERIOD

Défaut

0

Ratio of servers to be found for update to succeed

Cible

UPDATER_MIN_RATIO

Défaut

0.8

List of providers to update servers data for

Cible

UPDATER_VPN_SERVICE_PROVIDERS

Path of servers.json file (empty to disable caching)

Cible

STORAGE_FILEPATH

Défaut

/gluetun/servers.json

Specify a timezone to use to have correct log times. i.e. Europe/London

Cible

TZ

User ID to run as non root

Cible

PUID

Défaut

99

Group ID to run as non root

Cible

PGID

Défaut

100

Check for public IP address information on VPN connection

Cible

PUBLICIP_ENABLED

Défaut

true

Public IP echo service API to use

Cible

PUBLICIP_API

Défaut

ipinfo

Optional API token for the public IP echo service

Cible

PUBLICIP_API_TOKEN

Filepath to store the public IP address assigned

Cible

PUBLICIP_FILE

Défaut

/gluetun/ip

Logs a message indicating if a newer version is available

Cible

VERSION_INFORMATION

Défaut

on