Bug: local ip specified in `DNS_UPSTREAM_PLAIN_ADDRESSES` incorrectly flagged as "not in local subnets"

[geonon436]

Is this urgent?

None

Host OS

Ubuntu 25.10

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-03-11T20:49:21.026Z (commit b5b0e01) on Linux 6.12.33-production+truenas (x86_64)

What's the problem 🤔

Local address/port specified via DNS_UPSTREAM_PLAIN_ADDRESSES incorrectly flagged as as "not in local subnets", preventing me from using a local DNS resolver. At first I simply had FIREWALL_OUTBOUND_SUBNETS: 192.168.50.0/24 specified, but I decided to try and explicitly specify 192.168.50.200/32 after reading the log output, but that didn't resolve the issue either.

#2779 is related. I've been busy with other stuff for the last few months, chance would have it that I got back into all of this right after you closed that issue. I'm pointing to a local DNS server so I can resolve traffic to local devices/services via domain names as opposed to IP addresses. I don't want to create public A records via whatever service and point to that through the tunneled DNS, then there would be a bunch of requests from the VPN server I'm using to a domain name I own.

The way I want this to work is gluetun points to DNSMasq, DNSMasq resolves specified domains to local IPs, all upstream traffic goes to another instance of gluetun to tunnel all remaining DNS queries. I have several stacks that will point to this DNSMasq, as I have several stacks behind gluetun that need to resolve domains to local IPs.

Share your logs (at least 10 lines)

2026-03-14 19:47:48.857013+00:00========================================
2026-03-14 19:47:48.857088+00:00========================================
2026-03-14 19:47:48.857102+00:00=============== gluetun ================
2026-03-14 19:47:48.857116+00:00========================================
2026-03-14 19:47:48.857128+00:00=========== Made with ❤️ by ============
2026-03-14 19:47:48.857151+00:00======= https://github.com/qdm12 =======
2026-03-14 19:47:48.857163+00:00========================================
2026-03-14 19:47:48.857176+00:00========================================
2026-03-14 19:47:48.857188+00:002026-03-14T19:47:48.857188011Z
2026-03-14 19:47:48.857200+00:00Running version latest built on 2026-03-11T20:49:21.026Z (commit b5b0e01) on Linux 6.12.33-production+truenas (x86_64)
2026-03-14 19:47:48.857220+00:002026-03-14T19:47:48.857220783Z
2026-03-14 19:47:48.857233+00:00📣 Set BORINGPOLL_GLUETUNCOM=on to help combat AI slop and shutdown that scam website
2026-03-14 19:47:48.857245+00:002026-03-14T19:47:48.857245159Z
2026-03-14 19:47:48.857256+00:00🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
2026-03-14 19:47:48.857276+00:00🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
2026-03-14 19:47:48.857288+00:00💻 Email? quentin.mcgaw@gmail.com
2026-03-14 19:47:48.857300+00:00💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2026-03-14 19:47:48.860382+00:002026-03-14T19:47:48Z INFO [routing] default route found: interface eth0, gateway 10.42.2.1, assigned IP 10.42.2.2 and family v4
2026-03-14 19:47:48.860589+00:002026-03-14T19:47:48Z INFO [routing] default route found: interface eth0, gateway fdd0:0:0:6::1, assigned IP fdd0:0:0:6::4 and family v6
2026-03-14 19:47:48.860784+00:002026-03-14T19:47:48Z INFO [routing] local ethernet link found: eth0
2026-03-14 19:47:48.860971+00:002026-03-14T19:47:48Z INFO [routing] local ipnet found: 10.42.2.0/24
2026-03-14 19:47:48.861187+00:002026-03-14T19:47:48Z INFO [routing] local ipnet found: fdd0:0:0:6::/64
2026-03-14 19:47:48.861450+00:002026-03-14T19:47:48Z INFO [routing] local ipnet found: fe80::/64
2026-03-14 19:47:49.047814+00:002026-03-14T19:47:49Z INFO [firewall] enabling...
2026-03-14 19:47:49.424278+00:002026-03-14T19:47:49Z INFO [firewall] enabled successfully
2026-03-14 19:47:49.825127+00:002026-03-14T19:47:49Z INFO [storage] creating /gluetun/servers.json with 20646 hardcoded servers
2026-03-14 19:47:49.979785+00:002026-03-14T19:47:49Z INFO Alpine version: 3.22.3
2026-03-14 19:47:49.985702+00:002026-03-14T19:47:49Z INFO OpenVPN version: 2.6.16
2026-03-14 19:47:49.988287+00:002026-03-14T19:47:49Z INFO Firewall version: iptables v1.8.11
2026-03-14 19:47:49.988489+00:002026-03-14T19:47:49Z INFO Settings summary:
2026-03-14 19:47:49.988523+00:00├── VPN settings:
2026-03-14 19:47:49.988542+00:00|   ├── VPN provider settings:
2026-03-14 19:47:49.988559+00:00|   |   ├── Name: protonvpn
2026-03-14 19:47:49.988591+00:00|   |   └── Server selection settings:
2026-03-14 19:47:49.988609+00:00|   |       ├── VPN type: wireguard
2026-03-14 19:47:49.988625+00:00|   |       ├── Countries: united states
2026-03-14 19:47:49.988642+00:00|   |       ├── Secure Core only servers: yes
2026-03-14 19:47:49.988674+00:00|   |       └── Wireguard selection settings:
2026-03-14 19:47:49.988691+00:00|   ├── Wireguard settings:
2026-03-14 19:47:49.988708+00:00|   |   ├── Private key: UJA...EY=
2026-03-14 19:47:49.988725+00:00|   |   ├── Interface addresses:
2026-03-14 19:47:49.988743+00:00|   |   |   └── 10.2.0.2/32
2026-03-14 19:47:49.988774+00:00|   |   ├── Allowed IPs:
2026-03-14 19:47:49.988795+00:00|   |   |   ├── 0.0.0.0/0
2026-03-14 19:47:49.988816+00:00|   |   |   └── ::/0
2026-03-14 19:47:49.988837+00:00|   |   └── Network interface: tun0
2026-03-14 19:47:49.988859+00:00|   |       └── MTU: use path MTU discovery
2026-03-14 19:47:49.988890+00:00|   └── Path MTU discovery:
2026-03-14 19:47:49.988911+00:00|       ├── ICMP addresses:
2026-03-14 19:47:49.988932+00:00|       |   ├── 1.1.1.1
2026-03-14 19:47:49.988953+00:00|       |   └── 8.8.8.8
2026-03-14 19:47:49.988973+00:00|       └── TCP addresses:
2026-03-14 19:47:49.989002+00:00|           ├── 1.1.1.1:443
2026-03-14 19:47:49.989021+00:00|           ├── 8.8.8.8:443
2026-03-14 19:47:49.989039+00:00|           ├── 1.1.1.1:53
2026-03-14 19:47:49.989058+00:00|           ├── 8.8.8.8:53
2026-03-14 19:47:49.989076+00:00|           ├── [2606:4700:4700::1111]:53
2026-03-14 19:47:49.989104+00:00|           ├── [2001:4860:4860::8888]:53
2026-03-14 19:47:49.989123+00:00|           ├── [2606:4700:4700::1111]:443
2026-03-14 19:47:49.989141+00:00|           └── [2001:4860:4860::8888]:443
2026-03-14 19:47:49.989160+00:00├── DNS settings:
2026-03-14 19:47:49.989187+00:00|   ├── Upstream resolver type: plain
2026-03-14 19:47:49.989206+00:00|   ├── Upstream resolvers:
2026-03-14 19:47:49.989224+00:00|   |   └── 192.168.50.200:5353
2026-03-14 19:47:49.989242+00:00|   ├── Caching: yes
2026-03-14 19:47:49.989260+00:00|   ├── IPv6: no
2026-03-14 19:47:49.989288+00:00|   ├── Update period: every 24h0m0s
2026-03-14 19:47:49.989306+00:00|   └── DNS filtering settings:
2026-03-14 19:47:49.989324+00:00|       ├── Block malicious: yes
2026-03-14 19:47:49.989343+00:00|       ├── Block ads: no
2026-03-14 19:47:49.989361+00:00|       └── Block surveillance: no
2026-03-14 19:47:49.989390+00:00├── Firewall settings:
2026-03-14 19:47:49.989408+00:00|   ├── Enabled: yes
2026-03-14 19:47:49.989427+00:00|   └── Outbound subnets:
2026-03-14 19:47:49.989445+00:00|       ├── 192.168.50.200/32
2026-03-14 19:47:49.989463+00:00|       └── 192.168.50.0/24
2026-03-14 19:47:49.989528+00:00├── Log settings:
2026-03-14 19:47:49.989546+00:00|   └── Log level: info
2026-03-14 19:47:49.989565+00:00├── Health settings:
2026-03-14 19:47:49.989593+00:00|   ├── Server listening address: 127.0.0.1:9999
2026-03-14 19:47:49.989611+00:00|   ├── Target addresses:
2026-03-14 19:47:49.989629+00:00|   |   ├── cloudflare.com:443
2026-03-14 19:47:49.989648+00:00|   |   └── github.com:443
2026-03-14 19:47:49.989667+00:00|   ├── Small health check type: ICMP echo request
2026-03-14 19:47:49.989695+00:00|   |   └── ICMP target IPs:
2026-03-14 19:47:49.989714+00:00|   |       ├── 1.1.1.1
2026-03-14 19:47:49.989734+00:00|   |       └── 8.8.8.8
2026-03-14 19:47:49.989754+00:00|   └── Restart VPN on healthcheck failure: yes
2026-03-14 19:47:49.989783+00:00├── Shadowsocks server settings:
2026-03-14 19:47:49.989803+00:00|   └── Enabled: no
2026-03-14 19:47:49.989822+00:00├── HTTP proxy settings:
2026-03-14 19:47:49.989842+00:00|   └── Enabled: no
2026-03-14 19:47:49.989860+00:00├── Control server settings:
2026-03-14 19:47:49.989876+00:00|   ├── Listening address: :8000
2026-03-14 19:47:49.989902+00:00|   ├── Logging: yes
2026-03-14 19:47:49.989919+00:00|   └── Authentication file path: /gluetun/auth/config.toml
2026-03-14 19:47:49.989936+00:00├── Storage settings:
2026-03-14 19:47:49.989952+00:00|   └── Filepath: /gluetun/servers.json
2026-03-14 19:47:49.989978+00:00├── OS Alpine settings:
2026-03-14 19:47:49.989994+00:00|   ├── Process UID: 1000
2026-03-14 19:47:49.990011+00:00|   └── Process GID: 1000
2026-03-14 19:47:49.990028+00:00├── Public IP settings:
2026-03-14 19:47:49.990044+00:00|   ├── IP file path: /tmp/gluetun/ip
2026-03-14 19:47:49.990070+00:00|   ├── Public IP data base API: ipinfo
2026-03-14 19:47:49.990087+00:00|   └── Public IP data backup APIs:
2026-03-14 19:47:49.990103+00:00|       ├── ifconfigco
2026-03-14 19:47:49.990120+00:00|       ├── ip2location
2026-03-14 19:47:49.990136+00:00|       └── cloudflare
2026-03-14 19:47:49.990164+00:00└── Version settings:
2026-03-14 19:47:49.990181+00:00└── Enabled: yes
2026-03-14 19:47:49.990197+00:002026-03-14T19:47:49Z WARN DNS upstream address 192.168.50.200:5353 is private: DNS traffic might leak out of the VPN tunnel to that address.
2026-03-14 19:47:50.075274+00:002026-03-14T19:47:50Z INFO [routing] default route found: interface eth0, gateway 10.42.2.1, assigned IP 10.42.2.2 and family v4
2026-03-14 19:47:50.075599+00:002026-03-14T19:47:50Z INFO [routing] default route found: interface eth0, gateway fdd0:0:0:6::1, assigned IP fdd0:0:0:6::4 and family v6
2026-03-14 19:47:50.076205+00:002026-03-14T19:47:50Z INFO [routing] adding route for 0.0.0.0/0
2026-03-14 19:47:50.076599+00:002026-03-14T19:47:50Z INFO [routing] adding route for ::/0
2026-03-14 19:47:50.077033+00:002026-03-14T19:47:50Z INFO [firewall] setting allowed subnets...
2026-03-14 19:47:50.100834+00:002026-03-14T19:47:50Z INFO [routing] default route found: interface eth0, gateway 10.42.2.1, assigned IP 10.42.2.2 and family v4
2026-03-14 19:47:50.101261+00:002026-03-14T19:47:50Z INFO [routing] default route found: interface eth0, gateway fdd0:0:0:6::1, assigned IP fdd0:0:0:6::4 and family v6
2026-03-14 19:47:50.101348+00:002026-03-14T19:47:50Z INFO [routing] adding route for 192.168.50.200/32
2026-03-14 19:47:50.101866+00:002026-03-14T19:47:50Z INFO [routing] adding route for 192.168.50.0/24
2026-03-14 19:47:50.104714+00:002026-03-14T19:47:50Z INFO [dns] using plaintext DNS at address 192.168.50.200
2026-03-14 19:47:50.104764+00:002026-03-14T19:47:50Z INFO [healthcheck] listening on 127.0.0.1:9999
2026-03-14 19:47:50.105176+00:002026-03-14T19:47:50Z INFO [http server] http server listening on [::]:8000
2026-03-14 19:47:50.105711+00:002026-03-14T19:47:50Z INFO [firewall] allowing VPN connection...
2026-03-14 19:47:50.127666+00:002026-03-14T19:47:50Z INFO [wireguard] Using available kernelspace implementation
2026-03-14 19:47:50.129238+00:002026-03-14T19:47:50Z INFO [wireguard] Connecting to 62.169.136.121:51820
2026-03-14 19:47:50.227990+00:002026-03-14T19:47:50Z INFO [vpn] wireguard setup is complete. Note wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the wireguard connection is not working.
2026-03-14 19:47:50.228081+00:002026-03-14T19:47:50Z INFO [MTU discovery] finding maximum MTU, this can take up to 6 seconds
2026-03-14 19:47:56.060179+00:002026-03-14T19:47:56Z INFO [MTU discovery] setting VPN interface tun0 MTU to maximum valid MTU 1400
2026-03-14 19:47:56.671570+00:002026-03-14T19:47:56Z WARN [dns] DNS server address 192.168.50.200 is not in local subnets, make sure to specify it in FIREWALL_OUTBOUND_SUBNETS as 192.168.50.200/32
2026-03-14 19:47:56.683214+00:002026-03-14T19:47:56Z INFO [dns] DNS server listening on [::]:53
2026-03-14 19:47:57.284578+00:002026-03-14T19:47:57Z INFO [dns] ready and using DNS server with plain upstream resolvers
2026-03-14 19:47:57.284774+00:002026-03-14T19:47:57Z INFO [dns] downloading hostnames and IP block lists
2026-03-14 19:48:04.347026+00:002026-03-14T19:48:04Z INFO [ip getter] Public IP address is 146.70.195.37 (United States, California, Los Angeles - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-03-14 19:48:06.626764+00:002026-03-14T19:48:06Z INFO [vpn] You are running 7 commits behind the most recent latest

Share your configuration

services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun-firefox
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    environment:
      VPN_SERVICE_PROVIDER: ${VPN_SERVICE_PROVIDER}
      VPN_TYPE: ${VPN_TYPE}
      WIREGUARD_PRIVATE_KEY: ${WIREGUARD_PRIVATE_KEY}
      SERVER_COUNTRIES: ${SERVER_COUNTRIES}
      SECURE_CORE_ONLY: ${SECURE_CORE_ONLY}
      FIREWALL_OUTBOUND_SUBNETS: 192.168.50.200/32,192.168.50.0/24
      DNS_UPSTREAM_RESOLVER_TYPE: plain
      DNS_UPSTREAM_PLAIN_ADDRESSES: 192.168.50.200:5353

  firefox:
    image: jlesage/firefox
    container_name: firefox
    restart: unless-stopped
    volumes:
      - ./firefox:/config
    environment:
      USER_ID: ${PUID}
      GROUP_ID: ${PGID}
      TZ: ${TZ}
    network_mode: service:gluetun

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[geonon436]

Sounds like the logging is intentional based on #3205 (see here). I assumed it was bugged because I can't get the traffic to actually go through the specified address, but there's already another issue for that (#3231).

Apologies for opening an issue without first checking to see if there was already one on the same topic.

[github-actions]

Closed issues are NOT monitored, so commenting here will likely NOT be seen.
If you think this is still unresolved and have more information to bring, please either
re-open this issue or create another issue.

❤️😠 temporarily help the Gluetun community and fight the AI slop scam website gluetun[dot]com by setting BORINGPOLL_GLUETUNCOM=on on the latest image.
See the option in the wiki for more information

This is an automated comment setup because @qdm12 is the sole maintainer of this project
which became too popular to monitor closed issues.