What is this?
Gluetun is a lightweight, swiss-army-knife-like VPN client packaged as a single small Docker container. It tunnels through 20+ commercial VPN providers via OpenVPN or Wireguard and lets other containers or LAN devices share that connection.
Gluetun is a lightweight, swiss-army-knife-like VPN client packaged as a single small Docker container. It tunnels through 20+ commercial VPN providers via OpenVPN or Wireguard and lets other containers or LAN devices share that connection.So it's not a desktop VPN app — how does it fit into my setup?It runs as a Docker container next to your other services. Other containers can route their traffic through it, LAN devices can connect to it, and it can even run as a Kubernetes sidecar.
It runs as a Docker container next to your other services. Other containers can route their traffic through it, LAN devices can connect to it, and it can even run as a Kubernetes sidecar.How do I get it running?The Wiki has setup instructions specific to each VPN provider, with examples — start there. The README also ships a ready-made docker-compose.yml, and the image is available at ghcr.io/qdm12/gluetun.
The Wiki has setup instructions specific to each VPN provider, with examples — start there. The README also ships a ready-made docker-compose.yml, and the image is available at ghcr.io/qdm12/gluetun.Do I need my own VPN subscription to use it?Yes — Gluetun is a client, not a VPN service itself. You need an account with one of the supported providers, and Gluetun then handles the connection inside the container.
Yes — Gluetun is a client, not a VPN service itself. You need an account with one of the supported providers, and Gluetun then handles the connection inside the container.Does Wireguard work with every provider?No — OpenVPN is supported for all listed providers, but Wireguard only for a subset (AirVPN, IVPN, NordVPN, ProtonVPN, Surfshark, Windscribe and a few others), plus custom Wireguard configs via the custom provider. Mullvad works with Wireguard only.
No — OpenVPN is supported for all listed providers, but Wireguard only for a subset (AirVPN, IVPN, NordVPN, ProtonVPN, Surfshark, Windscribe and a few others), plus custom Wireguard configs via the custom provider. Mullvad works with Wireguard only.Will it run on small ARM boards, or only x86 servers?It's built for amd64, i686 (32 bit), ARM 64 bit, ARM 32 bit v6 and v7, and ppc64le, so it runs on servers, NAS boxes and small ARM boards alike. The image is just 43.1MB, based on Alpine 3.23.
It's built for amd64, i686 (32 bit), ARM 64 bit, ARM 32 bit v6 and v7, and ppc64le, so it runs on servers, NAS boxes and small ARM boards alike. The image is just 43.1MB, based on Alpine 3.23.What happens if the VPN connection drops?A built-in firewall kill switch kicks in: traffic is only allowed to the needed VPN servers and LAN devices, so nothing leaks outside the tunnel while it's down.
A built-in firewall kill switch kicks in: traffic is only allowed to the needed VPN servers and LAN devices, so nothing leaks outside the tunnel while it's down.Which VPN providers does it support?Over 20, including AirVPN, Cyberghost, ExpressVPN, HideMyAss, IPVanish, IVPN, Mullvad, NordVPN, Private Internet Access, ProtonVPN, PureVPN, Surfshark, TorGuard, VyprVPN and Windscribe. A custom provider lets you use your own OpenVPN or Wireguard config, and AmneziaWG is supported there too.
Over 20, including AirVPN, Cyberghost, ExpressVPN, HideMyAss, IPVanish, IVPN, Mullvad, NordVPN, Private Internet Access, ProtonVPN, PureVPN, Surfshark, TorGuard, VyprVPN and Windscribe. A custom provider lets you use your own OpenVPN or Wireguard config, and AmneziaWG is supported there too.What are the built-in proxies for?Gluetun ships a Shadowsocks proxy (SOCKS5-based with an encryption layer, tunnels TCP+UDP), a Socks5 proxy (TCP+UDP) and an HTTP proxy for HTTP and HTTPS. Point other apps or containers at them to route their traffic through the VPN tunnel.
Gluetun ships a Shadowsocks proxy (SOCKS5-based with an encryption layer, tunnels TCP+UDP), a Socks5 proxy (TCP+UDP) and an HTTP proxy for HTTP and HTTPS. Point other apps or containers at them to route their traffic through the VPN tunnel.Does it do anything besides tunneling?Yes — DNS over TLS is baked in with service providers of your choice, and it can block malicious and ads hostnames and IP addresses, with live updates every 24 hours. Selecting multiple DNS providers gives you split horizon DNS.
Yes — DNS over TLS is baked in with service providers of your choice, and it can block malicious and ads hostnames and IP addresses, with live updates every 24 hours. Selecting multiple DNS providers gives you split horizon DNS.Can I do port forwarding through it?Yes, for three providers: Private Internet Access, PrivateVPN and ProtonVPN support custom VPN server side port forwarding through Gluetun.
Yes, for three providers: Private Internet Access, PrivateVPN and ProtonVPN support custom VPN server side port forwarding through Gluetun.What are similar projects?v2ray-core, smartdns, mtproto.zig, algo, Open-Box, nyx, hysteria, amnezia-client
v2ray-core, smartdns, mtproto.zig, algo, Open-Box, nyx, hysteria, amnezia-clientWhich topics is it in?alpine, dns-over-tls, port-forwarding, openvpn, http-proxy, vpn-client, arm, wireguard, firewall, socks5, shadowsocks, arm64
alpine, dns-over-tls, port-forwarding, openvpn, http-proxy, vpn-client, arm, wireguard, firewall, socks5, shadowsocks, arm64