Bug: Timeout on port forwarding with Proton VPN

[Roycinger]

Is this urgent?

None

Host OS

Debian Bookworm

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2025-12-29T05:33:29.822Z (commit 9b9b723)

What's the problem 🤔

Hello,

I'm trying to get port forwarding running for the last few days.
I also stumbled upon a similar issue from quite some time ago (#2435).

I tried various environment settings and both Wireguard and OpenVPN.
I also went through the gluetun Wiki and tried a minimal settings set, see here:
#3077

Nevertheless, whatever I try, I'm unable to obtain a forwarded port.
I also sent a mail to Proton Support (no reply yet).

Share your logs (at least 10 lines)

2026-01-05T17:43:50+01:00 INFO [routing] default route found: interface eth0, gateway 172.30.0.1, assigned IP 172.30.0.2 and family v4

2026-01-05T17:43:50+01:00 INFO [routing] adding route for 0.0.0.0/0

2026-01-05T17:43:50+01:00 INFO [firewall] setting allowed subnets...

2026-01-05T17:43:50+01:00 INFO [routing] default route found: interface eth0, gateway 172.30.0.1, assigned IP 172.30.0.2 and family v4

2026-01-05T17:43:50+01:00 INFO [routing] adding route for 192.168.178.0/24

2026-01-05T17:43:50+01:00 INFO [routing] adding route for 172.16.0.0/12

2026-01-05T17:43:50+01:00 INFO [routing] adding route for 10.0.0.0/8

2026-01-05T17:43:50+01:00 INFO [dns] using plaintext DNS at address 1.1.1.1

2026-01-05T17:43:50+01:00 INFO [healthcheck] listening on 127.0.0.1:9999

2026-01-05T17:43:50+01:00 INFO [http server] read 6 roles from authentication file

2026-01-05T17:43:50+01:00 INFO [http server] http server listening on [::]:8000

2026-01-05T17:43:50+01:00 INFO [firewall] allowing VPN connection...

2026-01-05T17:43:50+01:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]

2026-01-05T17:43:50+01:00 INFO [openvpn] library versions: OpenSSL 3.5.4 30 Sep 2025, LZO 2.10

2026-01-05T17:43:50+01:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]89.222.96.216:1194

2026-01-05T17:43:50+01:00 INFO [openvpn] UDPv4 link local: (not bound)

2026-01-05T17:43:50+01:00 INFO [openvpn] UDPv4 link remote: [AF_INET]89.222.96.216:1194

2026-01-05T17:43:50+01:00 INFO [openvpn] [node-ch-38.protonvpn.net] Peer Connection Initiated with [AF_INET]89.222.96.216:1194

2026-01-05T17:43:51+01:00 INFO [openvpn] setsockopt TCP_NODELAY=1 failed

2026-01-05T17:43:51+01:00 INFO [openvpn] TUN/TAP device tun0 opened

2026-01-05T17:43:51+01:00 INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500

2026-01-05T17:43:51+01:00 INFO [openvpn] /sbin/ip link set dev tun0 up

2026-01-05T17:43:51+01:00 INFO [openvpn] /sbin/ip addr add dev tun0 10.16.0.48/16 broadcast +

2026-01-05T17:43:51+01:00 INFO [openvpn] UID set to nonrootuser

2026-01-05T17:43:51+01:00 INFO [openvpn] Initialization Sequence Completed

2026-01-05T17:43:56+01:00 INFO [dns] downloading hostnames and IP block lists

2026-01-05T17:43:57+01:00 INFO [dns] DNS server listening on [::]:53

2026-01-05T17:43:58+01:00 INFO [dns] ready

2026-01-05T17:43:59+01:00 INFO [ip getter] Public IP address is 212.104.214.172 (Switzerland, Zurich, Zürich - source: ipinfo+ifconfig.co+ip2location+cloudflare)

2026-01-05T17:43:59+01:00 INFO [vpn] You are running on the bleeding edge of latest!

2026-01-05T17:43:59+01:00 INFO [port forwarding] starting

2026-01-05T17:44:22+01:00 INFO [openvpn] read UDPv4 [EMSGSIZE Path-MTU=1492]: Message too large (fd=3,code=90)

2026-01-05T17:44:22+01:00 INFO [openvpn] write UDPv4 [EMSGSIZE Path-MTU=1492]: Message too large (fd=3,code=90)

2026-01-05T17:44:23+01:00 INFO [openvpn] read UDPv4 [EMSGSIZE Path-MTU=1492]: Message too large (fd=3,code=90)

2026-01-05T17:45:24+01:00 INFO [http server] 200 GET /v1/publicip/ip wrote 210B to 172.30.0.1:40036 in 67.391µs

2026-01-05T17:46:06+01:00 ERROR [vpn] starting port forwarding service: port forwarding for the first time: getting external IPv4 address: executing remote procedure call: connection timeout: failed attempts: read udp 172.30.0.2:59948->10.16.0.1:5351: i/o timeout (tries 1, 2, 3, 4, 5, 6, 7, 8, 9)

Share your configuration

Wireguard:
environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=xxx
      - SERVER_COUNTRIES=Switzerland
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on
      - TZ=Europe/Berlin
      - FIREWALL_OUTBOUND_SUBNETS=192.168.178.0/24,172.16.0.0/12,10.0.0.0/8

OpenVPN:
environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=openvpn
      - OPENVPN_USER=xxxxxxx+pmp
      - OPENVPN_PASSWORD=xxxxxxxx
      - SERVER_COUNTRIES=Switzerland
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on
      - TZ=Europe/Berlin
      - FIREWALL_OUTBOUND_SUBNETS=192.168.178.0/24,172.16.0.0/12,10.0.0.0/8

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[sboger]

I'm just a gluetun user, but saw this come in. First, you're using ':latest' which is the development branch, not the stable branch. I'd try gluetun:v3. But you will need to create a completely new gluetun config directory for this - or erase the current gluetun directory. I say this, as the servers you are using may be incorrect.

I don't see a 'node-ch-38.protonvpn.net' in my servers list when I run 'docker run --rm -v eraseme:/gluetun qmcgaw/gluetun format-servers -protonvpn' or 'docker run --rm -v eraseme:/gluetun qmcgaw/gluetun:v3 format-servers -protonvpn'

I'd start there and see what happens. A fresh basic gluetun/qbit compose file, the gluetun config dir empty.

[Roycinger]

I'm just a gluetun user, but saw this come in. First, you're using ':latest' which is the development branch, not the stable branch. I'd try gluetun:v3. But you will need to create a completely new gluetun config directory for this - or erase the current gluetun directory. I say this, as the servers you are using may be incorrect.

I don't see a 'node-ch-38.protonvpn.net' in my servers list when I run 'docker run --rm -v eraseme:/gluetun qmcgaw/gluetun format-servers -protonvpn' or 'docker run --rm -v eraseme:/gluetun qmcgaw/gluetun:v3 format-servers -protonvpn'

I'd start there and see what happens. A fresh basic gluetun/qbit compose file, the gluetun config dir empty.

Thanks for checking in, every hint is appreciated.
the node you're refering to is automatically assigned by Proton VPN as I only provide "SERVER_COUNTRIES=Switzerland" in my config.
As regarding to the version, this is the other part of my compose file (except for the ports section):

services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun

This is exactly what the gluetun Wiki is stating.

[Matthew-Beckett]

I am also experiencing basically the same behaviour:

Environment Variables:

                LOG_LEVEL: debug
                FIREWALL: "on"
                FIREWALL_OUTBOUND_SUBNETS: "192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/16"
                VPN_SERVICE_PROVIDER: protonvpn
                VPN_TYPE: openvpn
                OPENVPN_USER: xxx+pmp
                OPENVPN_PASSWORD: xxx
                SERVER_COUNTRIES: france
                PORT_FORWARD_ONLY: "on"
                VPN_PORT_FORWARDING: "on"
                VPN_PORT_FORWARDING_PROVIDER: protonvpn
                OPENVPN_MSSFIX: 1280

Log output:

|   |   └── github.com:443
|   ├── Small health check type: ICMP echo request
|   |   └── ICMP target IPs:
|   |       ├── 1.1.1.1
|   |       └── 8.8.8.8
|   └── Restart VPN on healthcheck failure: yes
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 568
|   ├── Process GID: 568
|   └── Timezone: utc
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
└── Version settings:
    └── Enabled: yes
2026-01-05T20:56:52Z INFO [routing] default route found: interface eth0, gateway 10.245.3.101, assigned IP 10.245.3.30 and family v4
2026-01-05T20:56:52Z DEBUG [netlink] ip -4 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -6 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -f 0 rule add from 10.245.3.30/32 lookup 200 pref 100
2026-01-05T20:56:52Z INFO [routing] adding route for 0.0.0.0/0
2026-01-05T20:56:52Z DEBUG [routing] ip route replace 0.0.0.0/0 via 10.245.3.101 dev eth0 table 200
2026-01-05T20:56:52Z INFO [firewall] setting allowed subnets...
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o eth0 -s 10.245.3.30 -d 192.168.0.0/16 -j ACCEPT
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o eth0 -s 10.245.3.30 -d 10.0.0.0/8 -j ACCEPT
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o eth0 -s 10.245.3.30 -d 172.16.0.0/16 -j ACCEPT
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o eth0 -s 10.245.3.30 -d 172.17.0.0/16 -j ACCEPT
2026-01-05T20:56:52Z INFO [routing] default route found: interface eth0, gateway 10.245.3.101, assigned IP 10.245.3.30 and family v4
2026-01-05T20:56:52Z INFO [routing] adding route for 192.168.0.0/16
2026-01-05T20:56:52Z DEBUG [routing] ip route replace 192.168.0.0/16 via 10.245.3.101 dev eth0 table 199
2026-01-05T20:56:52Z DEBUG [netlink] ip -4 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -6 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -f 0 rule add to 192.168.0.0/16 lookup 199 pref 99
2026-01-05T20:56:52Z INFO [routing] adding route for 10.0.0.0/8
2026-01-05T20:56:52Z DEBUG [routing] ip route replace 10.0.0.0/8 via 10.245.3.101 dev eth0 table 199
2026-01-05T20:56:52Z DEBUG [netlink] ip -4 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -6 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -f 0 rule add to 10.0.0.0/8 lookup 199 pref 99
2026-01-05T20:56:52Z INFO [routing] adding route for 172.16.0.0/16
2026-01-05T20:56:52Z DEBUG [routing] ip route replace 172.16.0.0/16 via 10.245.3.101 dev eth0 table 199
2026-01-05T20:56:52Z DEBUG [netlink] ip -4 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -6 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -f 0 rule add to 172.16.0.0/16 lookup 199 pref 99
2026-01-05T20:56:52Z INFO [routing] adding route for 172.17.0.0/16
2026-01-05T20:56:52Z DEBUG [routing] ip route replace 172.17.0.0/16 via 10.245.3.101 dev eth0 table 199
2026-01-05T20:56:52Z DEBUG [netlink] ip -4 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -6 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -f 0 rule add to 172.17.0.0/16 lookup 199 pref 99
2026-01-05T20:56:52Z DEBUG [netlink] ip -4 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -6 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -f 0 rule add to 10.245.3.101/32 lookup 254 pref 98
2026-01-05T20:56:52Z DEBUG [netlink] ip -4 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -6 rule list
2026-01-05T20:56:52Z DEBUG [netlink] ip -f 0 rule add to fe80::/64 lookup 254 pref 98
2026-01-05T20:56:52Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2026-01-05T20:56:52Z INFO [firewall] setting allowed input port 10095 through interface eth0...
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/iptables --append INPUT -i eth0 -p tcp -m tcp --dport 10095 -j ACCEPT
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/ip6tables --append INPUT -i eth0 -p tcp -m tcp --dport 10095 -j ACCEPT
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/iptables --append INPUT -i eth0 -p udp -m udp --dport 10095 -j ACCEPT
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/ip6tables --append INPUT -i eth0 -p udp -m udp --dport 10095 -j ACCEPT
2026-01-05T20:56:52Z DEBUG [dns] filter updated: 0 hostnames, 0 IPs, 0 IP prefixes blocked
2026-01-05T20:56:52Z INFO [http server[] http server listening on [::]:8000
2026-01-05T20:56:52Z WARN [dns] ⚠️⚠️⚠️  keeping the default container nameservers, this will likely leak DNS traffic outside the VPN and go through your container network DNS outside the VPN tunnel!
2026-01-05T20:56:52Z INFO [healthcheck] listening on 127.0.0.1:9999
2026-01-05T20:56:52Z INFO [firewall] allowing VPN connection...
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -d 146.70.194.66 -o eth0 -p udp -m udp --dport 1194 -j ACCEPT
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o tun0 -j ACCEPT
2026-01-05T20:56:52Z DEBUG [firewall] /usr/sbin/ip6tables --append OUTPUT -o tun0 -j ACCEPT
2026-01-05T20:56:52Z INFO [openvpn[] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO[] [LZ4[] [EPOLL[] [MH/PKTINFO] [AEAD]
2026-01-05T20:56:52Z INFO [openvpn] library versions: OpenSSL 3.5.4 30 Sep 2025, LZO 2.10
2026-01-05T20:56:52Z INFO [openvpn[] TCP/UDP: Preserving recently used remote address: [AF_INET]146.70.194.66:1194
2026-01-05T20:56:52Z INFO [openvpn] UDPv4 link local: (not bound)
2026-01-05T20:56:52Z INFO [openvpn[] UDPv4 link remote: [AF_INET]146.70.194.66:1194
2026-01-05T20:56:53Z INFO [openvpn[] [node-fr-19.protonvpn.net[] Peer Connection Initiated with [AF_INET]146.70.194.66:1194
2026-01-05T20:56:54Z INFO [openvpn] setsockopt TCP_NODELAY=1 failed
2026-01-05T20:56:54Z INFO [openvpn] TUN/TAP device tun0 opened
2026-01-05T20:56:54Z INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2026-01-05T20:56:54Z INFO [openvpn] /sbin/ip link set dev tun0 up
2026-01-05T20:56:54Z INFO [openvpn] /sbin/ip addr add dev tun0 10.16.0.31/16 broadcast +
2026-01-05T20:56:54Z INFO [openvpn] UID set to nonrootuser
2026-01-05T20:56:54Z INFO [openvpn] Initialization Sequence Completed
2026-01-05T20:56:54Z DEBUG [healthcheck] startup check parallel attempt failed: running TLS handshake: EOF
2026-01-05T20:56:54Z DEBUG [healthcheck] startup check parallel attempt failed: running TLS handshake: EOF
2026-01-05T20:56:54Z WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: all check tries failed: parallel attempt 1/2 failed: running TLS handshake: EOF, parallel attempt 2/2 failed: running TLS handshake: EOF
2026-01-05T20:56:54Z INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2026-01-05T20:56:54Z INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION
2026-01-05T20:56:54Z INFO [vpn] stopping

I've ignore the healthcheck and it gets to this point:

|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 568
|   ├── Process GID: 568
|   └── Timezone: utc
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
└── Version settings:
    └── Enabled: yes
2026-01-05T21:20:07Z WARN DNS address is set to 192.168.0.81 so the local forwarding DNS server will not be used. The default value changed to 127.0.0.1 so it uses the internal DNS server. If this server fails to start, the IPv4 address of the first plaintext DNS server corresponding to the first DNS provider chosen is used.
2026-01-05T21:20:07Z INFO [routing] default route found: interface eth0, gateway 10.245.3.101, assigned IP 10.245.3.177 and family v4
2026-01-05T21:20:07Z DEBUG [netlink] ip -4 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -6 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -f 0 rule add from 10.245.3.177/32 lookup 200 pref 100
2026-01-05T21:20:07Z INFO [routing] adding route for 0.0.0.0/0
2026-01-05T21:20:07Z DEBUG [routing] ip route replace 0.0.0.0/0 via 10.245.3.101 dev eth0 table 200
2026-01-05T21:20:07Z INFO [firewall] setting allowed subnets...
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o eth0 -s 10.245.3.177 -d 192.168.0.0/16 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o eth0 -s 10.245.3.177 -d 10.0.0.0/8 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o eth0 -s 10.245.3.177 -d 172.16.0.0/16 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o eth0 -s 10.245.3.177 -d 172.17.0.0/16 -j ACCEPT
2026-01-05T21:20:07Z INFO [routing] default route found: interface eth0, gateway 10.245.3.101, assigned IP 10.245.3.177 and family v4
2026-01-05T21:20:07Z INFO [routing] adding route for 192.168.0.0/16
2026-01-05T21:20:07Z DEBUG [routing] ip route replace 192.168.0.0/16 via 10.245.3.101 dev eth0 table 199
2026-01-05T21:20:07Z DEBUG [netlink] ip -4 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -6 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -f 0 rule add to 192.168.0.0/16 lookup 199 pref 99
2026-01-05T21:20:07Z INFO [routing] adding route for 10.0.0.0/8
2026-01-05T21:20:07Z DEBUG [routing] ip route replace 10.0.0.0/8 via 10.245.3.101 dev eth0 table 199
2026-01-05T21:20:07Z DEBUG [netlink] ip -4 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -6 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -f 0 rule add to 10.0.0.0/8 lookup 199 pref 99
2026-01-05T21:20:07Z INFO [routing] adding route for 172.16.0.0/16
2026-01-05T21:20:07Z DEBUG [routing] ip route replace 172.16.0.0/16 via 10.245.3.101 dev eth0 table 199
2026-01-05T21:20:07Z DEBUG [netlink] ip -4 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -6 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -f 0 rule add to 172.16.0.0/16 lookup 199 pref 99
2026-01-05T21:20:07Z INFO [routing] adding route for 172.17.0.0/16
2026-01-05T21:20:07Z DEBUG [routing] ip route replace 172.17.0.0/16 via 10.245.3.101 dev eth0 table 199
2026-01-05T21:20:07Z DEBUG [netlink] ip -4 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -6 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -f 0 rule add to 172.17.0.0/16 lookup 199 pref 99
2026-01-05T21:20:07Z DEBUG [netlink] ip -4 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -6 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -f 0 rule add to 10.245.3.101/32 lookup 254 pref 98
2026-01-05T21:20:07Z DEBUG [netlink] ip -4 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -6 rule list
2026-01-05T21:20:07Z DEBUG [netlink] ip -f 0 rule add to fe80::/64 lookup 254 pref 98
2026-01-05T21:20:07Z INFO [firewall] setting allowed input port 8000 through interface eth0...
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append INPUT -i eth0 -p tcp -m tcp --dport 8000 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/ip6tables --append INPUT -i eth0 -p tcp -m tcp --dport 8000 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append INPUT -i eth0 -p udp -m udp --dport 8000 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/ip6tables --append INPUT -i eth0 -p udp -m udp --dport 8000 -j ACCEPT
2026-01-05T21:20:07Z INFO [firewall] setting allowed input port 10095 through interface eth0...
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append INPUT -i eth0 -p tcp -m tcp --dport 10095 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/ip6tables --append INPUT -i eth0 -p tcp -m tcp --dport 10095 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append INPUT -i eth0 -p udp -m udp --dport 10095 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/ip6tables --append INPUT -i eth0 -p udp -m udp --dport 10095 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [dns] filter updated: 0 hostnames, 0 IPs, 0 IP prefixes blocked
2026-01-05T21:20:07Z WARN [dns] ⚠️⚠️⚠️  keeping the default container nameservers, this will likely leak DNS traffic outside the VPN and go through your container network DNS outside the VPN tunnel!
2026-01-05T21:20:07Z INFO [healthcheck] listening on 127.0.0.1:9999
2026-01-05T21:20:07Z INFO [http server[] http server listening on [::]:8000
2026-01-05T21:20:07Z INFO [firewall] allowing VPN connection...
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -d 79.127.169.91 -o eth0 -p udp -m udp --dport 1194 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o tun0 -j ACCEPT
2026-01-05T21:20:07Z DEBUG [firewall] /usr/sbin/ip6tables --append OUTPUT -o tun0 -j ACCEPT
2026-01-05T21:20:07Z INFO [openvpn[] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO[] [LZ4[] [EPOLL[] [MH/PKTINFO] [AEAD]
2026-01-05T21:20:07Z INFO [openvpn] library versions: OpenSSL 3.5.4 30 Sep 2025, LZO 2.10
2026-01-05T21:20:07Z INFO [openvpn[] TCP/UDP: Preserving recently used remote address: [AF_INET]79.127.169.91:1194
2026-01-05T21:20:07Z INFO [openvpn] UDPv4 link local: (not bound)
2026-01-05T21:20:07Z INFO [openvpn[] UDPv4 link remote: [AF_INET]79.127.169.91:1194
2026-01-05T21:20:08Z INFO [openvpn[] [node-fr-41.protonvpn.net[] Peer Connection Initiated with [AF_INET]79.127.169.91:1194
2026-01-05T21:20:09Z INFO [openvpn] setsockopt TCP_NODELAY=1 failed
2026-01-05T21:20:09Z INFO [openvpn] TUN/TAP device tun0 opened
2026-01-05T21:20:09Z INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2026-01-05T21:20:09Z INFO [openvpn] /sbin/ip link set dev tun0 up
2026-01-05T21:20:09Z INFO [openvpn] /sbin/ip addr add dev tun0 10.16.0.10/16 broadcast +
2026-01-05T21:20:09Z INFO [openvpn] UID set to nonrootuser
2026-01-05T21:20:09Z INFO [openvpn] Initialization Sequence Completed
2026-01-05T21:20:09Z DEBUG [healthcheck] startup check parallel attempt failed: running TLS handshake: EOF
2026-01-05T21:20:09Z DEBUG [healthcheck] startup check parallel attempt failed: running TLS handshake: EOF
2026-01-05T21:20:09Z WARN [vpn] (ignored) healthchecker start failed: startup check: all check tries failed: parallel attempt 1/2 failed: running TLS handshake: EOF, parallel attempt 2/2 failed: running TLS handshake: EOF
2026-01-05T21:20:09Z INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
2026-01-05T21:20:09Z INFO [ip getter] Public IP address is 159.26.105.107 (France, Île-de-France, Paris - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-01-05T21:20:10Z INFO [vpn] You are running the latest release v3.41.0
2026-01-05T21:20:10Z INFO [port forwarding] starting

This log output was yielded from the following configuration:

                LOG_LEVEL: debug
                SERVER_COUNTRIES: france
                PORT_FORWARD_ONLY: "on"
                DNS_SERVER: "off"
                DNS_ADDRESS: 192.168.0.81
                FIREWALL: "on"
                FIREWALL_OUTBOUND_SUBNETS: "192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/16"
                FIREWALL_INPUT_PORTS: "8000"
                VPN_SERVICE_PROVIDER: protonvpn
                VPN_TYPE: openvpn
                VPN_PORT_FORWARDING: "on"
                VPN_PORT_FORWARDING_PROVIDER: protonvpn
                OPENVPN_USER: xxx+pmp
                OPENVPN_PASSWORD: xxx
                OPENVPN_MSSFIX: "1280"
                HEALTH_RESTART_VPN: "off"

[sboger]

Thanks for checking in, every hint is appreciated. the node you're refering to is automatically assigned by Proton VPN as I only provide "SERVER_COUNTRIES=Switzerland" in my config. As regarding to the version, this is the other part of my compose file (except for the ports section):

services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun

This is exactly what the gluetun Wiki is stating.

Let me make a few clarifying statements:

• Gluetun, when pulled as a fresh image, contains a servers.json file with a list of protonvpn servers.

• Gluetun uses an odd versioning system. The latest version of gluetun is v3.41.0. The container tagged 'v3.41.0' is the latest version of gluetun. However, gluetun auto-builds containers on every commit to main, and tags it ':latest'. Right now, the ':latest' container is 1 commit ahead of the 'v3.41.0' tagged container.

I mentioned the actual server your logs are indicating it's going to, 'node-ch-38.protonvpn.net', because when I ask gluetun to display the full list of protonvpn servers it is aware of in both fresh 'gluetun:latest' and 'gluetun:v3.41.0' containers, it does not show up. Your servers.json file in your config directory may have old data. Or only servers that are free, and don't offer port forwarding.

The newest gluetun releases now only update the paid protonvpn servers if you supply a username and password. You need paid proton servers for port forwarding. See here about updating and the username/password: https://github.com/qdm12/gluetun-wiki/blob/main/setup/options/updater.md

Once again, create a whole new compose, making sure it references an empty gluetun config directory. Use container "gluetun:v3". This will pull a clean servers.json file. You can also add the proton username/pass and UPDATER_PERIOD command to regularly update the paid proton servers list.

[Roycinger]

Thanks for checking in, every hint is appreciated. the node you're refering to is automatically assigned by Proton VPN as I only provide "SERVER_COUNTRIES=Switzerland" in my config. As regarding to the version, this is the other part of my compose file (except for the ports section):

services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun

This is exactly what the gluetun Wiki is stating.

Let me make a few clarifying statements:

* Gluetun, when pulled as a fresh image, contains a servers.json file with a list of protonvpn servers.

* Gluetun uses an odd versioning system. The latest version of gluetun is v3.41.0. The container tagged 'v3.41.0' is the latest version of gluetun. However, gluetun auto-builds containers on every commit to main, and tags it ':latest'. Right now, the ':latest' container is 1 commit ahead of the 'v3.41.0' tagged container.

I mentioned the actual server your logs are indicating it's going to, 'node-ch-38.protonvpn.net', because when I ask gluetun to display the full list of protonvpn servers it is aware of in both fresh 'gluetun:latest' and 'gluetun:v3.41.0' containers, it does not show up. Your servers.json file in your config directory may have old data. Or only servers that are free, and don't offer port forwarding.

The newest gluetun releases now only update the paid protonvpn servers if you supply a username and password. You need paid proton servers for port forwarding. See here about updating and the username/password: https://github.com/qdm12/gluetun-wiki/blob/main/setup/options/updater.md

Once again, create a whole new compose, making sure it references an empty gluetun config directory. Use container "gluetun:v3". This will pull a clean servers.json file. You can also add the proton username/pass and UPDATER_PERIOD command to regularly update the paid proton servers list.

Thank you very much for the detailed explanation!
I added the following to my existing gluetun compose:

- UPDATER_PERIOD=24h
- UPDATER_PROTONVPN_EMAIL=xxx@gmail.com
- UPDATER_PROTONVPN_PASSWORD=xxx

Let's see if this helps in any way.

I also set up a fresh stack with image: qmcgaw/gluetun:v3 as you recommended, which pulled a fresh servers.json file.
Unfortunately, I'm still getting the same error:

2026-01-06T00:20:12+01:00 INFO [routing] default route found: interface eth0, gateway 172.31.0.1, assigned IP 172.31.0.2 and family v4

2026-01-06T00:20:12+01:00 INFO [routing] adding route for 0.0.0.0/0

2026-01-06T00:20:12+01:00 INFO [firewall] setting allowed subnets...

2026-01-06T00:20:12+01:00 INFO [routing] default route found: interface eth0, gateway 172.31.0.1, assigned IP 172.31.0.2 and family v4

2026-01-06T00:20:12+01:00 INFO [routing] adding route for 192.168.178.0/24

2026-01-06T00:20:12+01:00 INFO [routing] adding route for 172.16.0.0/12

2026-01-06T00:20:12+01:00 INFO [routing] adding route for 10.0.0.0/8

2026-01-06T00:20:12+01:00 INFO [healthcheck] listening on 127.0.0.1:9999

2026-01-06T00:20:12+01:00 INFO [http server] http server listening on [::]:8000

2026-01-06T00:20:12+01:00 INFO [dns] using plaintext DNS at address 1.1.1.1

2026-01-06T00:20:12+01:00 INFO [firewall] allowing VPN connection...

2026-01-06T00:20:12+01:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]

2026-01-06T00:20:12+01:00 INFO [openvpn] library versions: OpenSSL 3.5.4 30 Sep 2025, LZO 2.10

2026-01-06T00:20:12+01:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]89.222.96.1:1194

2026-01-06T00:20:12+01:00 INFO [openvpn] UDPv4 link local: (not bound)

2026-01-06T00:20:12+01:00 INFO [openvpn] UDPv4 link remote: [AF_INET]89.222.96.1:1194

2026-01-06T00:20:14+01:00 INFO [openvpn] [node-ch-37.protonvpn.net] Peer Connection Initiated with [AF_INET]89.222.96.1:1194

2026-01-06T00:20:16+01:00 INFO [openvpn] setsockopt TCP_NODELAY=1 failed

2026-01-06T00:20:16+01:00 INFO [openvpn] TUN/TAP device tun0 opened

2026-01-06T00:20:16+01:00 INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500

2026-01-06T00:20:16+01:00 INFO [openvpn] /sbin/ip link set dev tun0 up

2026-01-06T00:20:16+01:00 INFO [openvpn] /sbin/ip addr add dev tun0 10.16.0.44/16 broadcast +

2026-01-06T00:20:16+01:00 INFO [openvpn] UID set to nonrootuser

2026-01-06T00:20:16+01:00 INFO [openvpn] Initialization Sequence Completed

2026-01-06T00:20:21+01:00 INFO [dns] downloading hostnames and IP block lists

2026-01-06T00:20:25+01:00 INFO [dns] DNS server listening on [::]:53

2026-01-06T00:20:27+01:00 INFO [dns] ready

2026-01-06T00:20:30+01:00 INFO [ip getter] Public IP address is 212.104.214.149 (Switzerland, Zurich, Zürich - source: ipinfo+ifconfig.co+ip2location+cloudflare)

2026-01-06T00:20:32+01:00 INFO [vpn] You are running the latest release v3.41.0

2026-01-06T00:20:32+01:00 INFO [port forwarding] starting

2026-01-06T00:22:40+01:00 ERROR [vpn] starting port forwarding service: port forwarding for the first time: getting external IPv4 address: executing remote procedure call: connection timeout: failed attempts: read udp 172.31.0.2:35039->10.16.0.1:5351: i/o timeout (tries 1, 2, 3, 4, 5, 6, 7, 8, 9)

[sboger]

Let's see if this helps in any way.

I also set up a fresh stack with image: qmcgaw/gluetun:v3 as you recommended, which pulled a fresh servers.json file.
Unfortunately, I'm still getting the same error:

Time to use a different country and see what happens with your fresh stack.

For the old stack that you added UPDATER_PERIOD=24h to, you can make that UPDATER_PERIOD=1h and watch the logs to see if you get an update message. This paid server updater is brand new with v3.41.0, so YMMV. If you see an update, stop the stack and restart it and see if it uses a new endpoint, and if forwarding works.

But you should try the different country test first. Add several countries -- just not the ones you've been using.

[Roycinger]

Let's see if this helps in any way.
I also set up a fresh stack with image: qmcgaw/gluetun:v3 as you recommended, which pulled a fresh servers.json file.
Unfortunately, I'm still getting the same error:

Time to use a different country and see what happens with your fresh stack.

For the old stack that you added UPDATER_PERIOD=24h to, you can make that UPDATER_PERIOD=1h and watch the logs to see if you get an update message. This paid server updater is brand new with v3.41.0, so YMMV. If you see an update, stop the stack and restart it and see if it uses a new endpoint, and if forwarding works.

But you should try the different country test first. Add several countries -- just not the ones you've been using.

Yep, good idea. I already tried pretty much exactly that (also added PORT_FORWARD_ONLY=on) with the same result.
Here's the log from the last attempt:

2026-01-06T00:57:42+01:00 INFO [ip getter] Public IP address is 79.127.186.206 (Poland, Mazovia, Warsaw - source: ipinfo+ifconfig.co+ip2location+cloudflare)

2026-01-06T00:57:43+01:00 INFO [vpn] You are running the latest release v3.41.0

2026-01-06T00:57:43+01:00 INFO [port forwarding] starting

2026-01-06T00:59:50+01:00 ERROR [vpn] starting port forwarding service: port forwarding for the first time: getting external IPv4 address: executing remote procedure call: connection timeout: failed attempts: read udp 172.31.0.2:39497->10.16.0.1:5351: i/o timeout (tries 1, 2, 3, 4, 5, 6, 7, 8, 9)

I'm somehow beginning to get the feeling that this might be a Proton VPN related issue

[Roycinger]

I just solved it.
For everyone who's interested:
I had the following set in my environment:
-FIREWALL_OUTBOUND_SUBNETS=192.168.178.0/24,172.16.0.0/12,10.0.0.0/8
10.0.0.0/8 also includes both OpenVPN and Wireguard gateways.
Meaning that any request and response to and from the gateways (for port forwarding) were going through interface eth0 and not through tun0 as needed.
Removing 10.0.0.0/8 from the outbound subnets solved it.

Thanks for your assistance!

[github-actions]

Closed issues are NOT monitored, so commenting here is likely to be not seen.
If you think this is still unresolved and have more information to bring, please create another issue.

This is an automated comment setup because @qdm12 is the sole maintainer of this project
which became too popular to monitor issues closed.