Bug: Gluetun Only Connects to First City in SERVER_CITIES List

[TomRobinsonIO]

Is this urgent?

None

Host OS

Ubuntu noble 24.04

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-05-09T14:50:17.073Z (commit 5b01324)

What's the problem 🤔

I am running Gluetun using Proton as the provider and WireGuard as the protocol. In my compose file, I have specified a SERVER_CITIES list for Gluetun to choose from. Gluetun appears to always choose the first city alphabetically in the list and then choose a random server from that city rather than choosing a random server from the entire SERVER_CITIES list. While connecting with a list containing Ashburn, Atlanta, etc., the selected city is always Ashburn. If Ashburn is then removed from the SERVER_CITIES, Atlanta will then always be chosen. Ashburn appears to always be chosen if SERVER_COUNTRIES="United States" is used instead of a SERVER_CITIES list as well.

Share your logs (at least 10 lines)

gluetun  | ========================================
gluetun  | ========================================
gluetun  | =============== gluetun ================
gluetun  | ========================================
gluetun  | =========== Made with ❤️ by ============
gluetun  | ======= https://github.com/qdm12 =======
gluetun  | ========================================
gluetun  | ========================================
gluetun  | 
gluetun  | Running version latest built on 2026-05-09T14:50:17.073Z (commit 5b01324) on Linux 6.8.0-111-generic (x86_64)
gluetun  | 
gluetun  | 🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
gluetun  | 🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
gluetun  | 💻 Email? quentin.mcgaw@gmail.com
gluetun  | 💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
gluetun  | 2026-05-11T14:35:45Z INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.5 and family v4
gluetun  | 2026-05-11T14:35:45Z INFO [routing] local ethernet link found: eth0
gluetun  | 2026-05-11T14:35:45Z INFO [routing] local ipnet found: 172.18.0.0/16
gluetun  | 2026-05-11T14:35:45Z INFO [firewall] enabling...
gluetun  | 2026-05-11T14:35:45Z INFO [firewall] enabled successfully
gluetun  | 2026-05-11T14:35:45Z INFO [storage] creating /gluetun/servers.json with 20660 hardcoded servers
gluetun  | 2026-05-11T14:35:45Z INFO Alpine version: 3.23.4
gluetun  | 2026-05-11T14:35:45Z INFO OpenVPN version: 2.6.20
gluetun  | 2026-05-11T14:35:45Z INFO Firewall version: iptables v1.8.11
gluetun  | 2026-05-11T14:35:45Z INFO Settings summary:
gluetun  | ├── VPN settings:
gluetun  | |   ├── VPN provider settings:
gluetun  | |   |   ├── Name: protonvpn
gluetun  | |   |   ├── Server selection settings:
gluetun  | |   |   |   ├── VPN type: wireguard
gluetun  | |   |   |   ├── Cities: atlanta, boston, chicago, columbus, dallas, houston, mcallen, memphis, miami, new york, philadelphia, secaucus, washington
gluetun  | |   |   |   ├── Port forwarding only servers: yes
gluetun  | |   |   |   └── Wireguard selection settings:
gluetun  | |   |   └── Automatic port forwarding settings:
gluetun  | |   |       ├── Number of ports to be forwarded: 1
gluetun  | |   |       ├── Use port forwarding code for current provider
gluetun  | |   |       ├── Forwarded port file path: /tmp/gluetun/forwarded_port
gluetun  | |   |       └── Forwarded port up command: /bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORTS}}}" http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'
gluetun  | |   ├── Wireguard settings:
gluetun  | |   |   ├── Private key:
gluetun  | |   |   ├── Interface addresses:
gluetun  | |   |   |   └── 10.2.0.2/32
gluetun  | |   |   ├── Allowed IPs:
gluetun  | |   |   |   ├── 0.0.0.0/0
gluetun  | |   |   |   └── ::/0
gluetun  | |   |   └── Network interface: tun0
gluetun  | |   |       └── MTU: use path MTU discovery
gluetun  | |   └── Path MTU discovery:
gluetun  | |       ├── ICMP addresses:
gluetun  | |       |   ├── 1.1.1.1
gluetun  | |       |   └── 8.8.8.8
gluetun  | |       └── TCP addresses:
gluetun  | |           ├── 1.1.1.1:443
gluetun  | |           ├── 8.8.8.8:443
gluetun  | |           ├── 1.1.1.1:53
gluetun  | |           ├── 8.8.8.8:53
gluetun  | |           ├── [2606:4700:4700::1111]:53
gluetun  | |           ├── [2001:4860:4860::8888]:53
gluetun  | |           ├── [2606:4700:4700::1111]:443
gluetun  | |           └── [2001:4860:4860::8888]:443
gluetun  | ├── DNS settings:
gluetun  | |   ├── Upstream resolver type: dot
gluetun  | |   ├── Upstream resolvers:
gluetun  | |   |   └── Cloudflare
gluetun  | |   ├── Caching: yes
gluetun  | |   ├── IPv6: no
gluetun  | |   ├── Update period: every 24h0m0s
gluetun  | |   └── DNS filtering settings:
gluetun  | |       ├── Block malicious: yes
gluetun  | |       ├── Block ads: no
gluetun  | |       └── Block surveillance: no
gluetun  | ├── Firewall settings:
gluetun  | |   ├── Enabled: yes
gluetun  | |   └── Iptables settings:
gluetun  | |       └── Log level: info
gluetun  | ├── Log settings:
gluetun  | |   └── Log level: info
gluetun  | ├── IPv6 settings:
gluetun  | |   └── Check addresses:
gluetun  | |       ├── [2001:4860:4860::8888]:53
gluetun  | |       └── [2606:4700:4700::1111]:53
gluetun  | ├── Health settings:
gluetun  | |   ├── Server listening address: 127.0.0.1:9999
gluetun  | |   ├── Target addresses:
gluetun  | |   |   ├── cloudflare.com:443
gluetun  | |   |   └── github.com:443
gluetun  | |   ├── Small health check type: ICMP echo request
gluetun  | |   |   └── ICMP target IPs:
gluetun  | |   |       ├── 1.1.1.1
gluetun  | |   |       └── 8.8.8.8
gluetun  | |   └── Restart VPN on healthcheck failure: yes
gluetun  | ├── Shadowsocks server settings:
gluetun  | |   └── Enabled: no
gluetun  | ├── HTTP proxy settings:
gluetun  | |   └── Enabled: no
gluetun  | ├── Control server settings:
gluetun  | |   ├── Listening address: :8000
gluetun  | |   ├── Logging: yes
gluetun  | |   └── Authentication file path: /gluetun/auth/config.toml
gluetun  | ├── Storage settings:
gluetun  | |   └── Filepath: /gluetun/servers.json
gluetun  | ├── OS Alpine settings:
gluetun  | |   ├── Process UID: 1000
gluetun  | |   └── Process GID: 1000
gluetun  | ├── Public IP settings:
gluetun  | |   ├── IP file path: /tmp/gluetun/ip
gluetun  | |   ├── Public IP data base API: ipinfo
gluetun  | |   └── Public IP data backup APIs:
gluetun  | |       ├── ifconfigco
gluetun  | |       ├── ip2location
gluetun  | |       └── cloudflare
gluetun  | └── Version settings:
gluetun  |     └── Enabled: yes
gluetun  | 2026-05-11T14:35:45Z INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.5 and family v4
gluetun  | 2026-05-11T14:35:45Z INFO [routing] adding route for 0.0.0.0/0
gluetun  | 2026-05-11T14:35:45Z INFO [firewall] setting allowed subnets...
gluetun  | 2026-05-11T14:35:45Z INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.5 and family v4
gluetun  | 2026-05-11T14:35:45Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
gluetun  | 2026-05-11T14:35:45Z INFO [healthcheck] listening on 127.0.0.1:9999
gluetun  | 2026-05-11T14:35:45Z INFO [http server] http server listening on [::]:8000
gluetun  | 2026-05-11T14:35:45Z INFO [firewall] allowing VPN connection...
gluetun  | 2026-05-11T14:35:45Z INFO [wireguard] Using available kernelspace implementation
gluetun  | 2026-05-11T14:35:45Z INFO [wireguard] Connecting to 89.187.170.135:51820
gluetun  | 2026-05-11T14:35:45Z INFO [vpn] wireguard setup is complete. Note wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the wireguard connection is not working.
gluetun  | 2026-05-11T14:35:45Z INFO [MTU discovery] finding maximum MTU, this can take up to 6 seconds
gluetun  | 2026-05-11T14:35:47Z INFO [MTU discovery] setting VPN interface tun0 MTU to maximum valid MTU 1400
gluetun  | 2026-05-11T14:35:47Z INFO [dns] DNS server listening on [::]:53
gluetun  | 2026-05-11T14:35:47Z INFO [dns] ready and using DNS server with dot upstream resolvers
gluetun  | 2026-05-11T14:35:47Z INFO [dns] downloading hostnames and IP block lists
gluetun  | 2026-05-11T14:35:49Z INFO [ip getter] Public IP address is 89.187.170.179 (United States, Georgia, Atlanta - source: ipinfo+ifconfig.co+ip2location+cloudflare)
gluetun  | 2026-05-11T14:35:49Z INFO [vpn] You are running on the bleeding edge of latest!

Share your configuration

services:
  gluetun:
    container_name: gluetun
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    ports:

    environment:
      - VPN_SERVICE_PROVIDER="protonvpn"
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=
      - PORTS=
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORTS}}}" http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'
      - SERVER_CITIES="Atlanta,Boston,Chicago,Columbus,Dallas,Houston,McAllen,Memphis,Miami,New York,Philadelphia,Secaucus,Washington"
    restart: always

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[nilnullzip]

I encountered this same problem. Issue #290 closed on 3 May 2026 implemented the behavior causing it.

"This feature broke our Kubernetes configuration. Since this change, every new container connects to the same server because ConnectionPicker initializes nextIndex to 0 on each new container. We are using NordVPN with the built in (periodically updated) server list. So now our app always connects to the first server on the list of thousands. I suspect the same is happening to others as that unfortunate server (in Atlanta GA USA) has been taken out of service. GlueTun currently falls back to the next one (still in Atlanta) but with a ~25s time penalty for health check and renegotiation.

Before this change, pickRandomConnection gave natural distribution across successive runs. Would it be possible to initialize nextIndex randomly so that the previous behavior is restored for those apps that depend on it? Then add an option to set the index to zero for those application that desire the round robin behavior?

Thank you to the entire GlueTun team for your great contribution!"

[qdm12]

whoops I did not foresee there would be an actual usecase for the randomness! I will change the pool of connections order to be random, so that it cycles through them but without starting at the same server always

[qdm12]

Fixed in 3ca4b48

[github-actions]

Closed issues are NOT monitored, so commenting here will likely NOT be seen.
If you think this is still unresolved and have more information to bring, please either
re-open this issue or create another issue.

❤️😠 temporarily help the Gluetun community and fight the AI slop scam website gluetun[dot]com by setting BORINGPOLL_GLUETUNCOM=on on the latest image.
See the option in the wiki for more information

This is an automated comment setup because @qdm12 is the sole maintainer of this project
which became too popular to monitor closed issues.