gluetun

⚠️ there is a deadlock bug in the port forwarding if you use the up or down command, I will release v3.41.3 shortly

Fixes

• Wireguard:
  • support IPv6 address formatting from config files (#3273)
  • ignore empty address strings
  • skip tun device checks when using kernelspace
• OpenVPN:
  • bundle provider CA certificates in one block (#3258)
  • trim spaces in config lines before parsing (#3327)
  • fix support for tcp-client
    • always use proto tcp-client when using TCP
    • parses tcp-client (on top of tcp, tcp4, tcp6) as meaning TCP
• Custom openvpn: restrict custom openvpn config protocol to tcp or udp internally
• Firewall: shared mutex for both iptables and ip6tables to prevent race conditions
• Healthcheck:
  • correct behavior when HEALTH_RESTART_VPN=off and startup check fails
  • prevent race condition on the healthchecker (#3400)
• DNS:
  • skip blocking if block lists download fails
  • correct error wrapping for DNS listening address validation
  • DNS over TLS pool behavior fixed
    • handle timed out connections the same as closed connections
    • close connection on TLS handshake failure
    • improve mutex handling during connection renewal and retrieval
• VPN port forwarding:
  • no longer stuck after failed port forwarding
  • handle empty ports without panicing
• Updater: only uses DoH to cloudflare+google
  • prevent dns plaintext manipulation both the periodic update and when running in cli mode
  • possibly higher reliability on poor connections versus UDP
  • drop -dns flag in update command
  • for now no configuration allowed since it makes everything rather complex
• Control server:
  • use port and ports for both single port and multiple ports forwarded
  • authentication: return 404 or 405 depending on route
• Increase global http client timeout to 35s and precise lower timeouts where needed
  • Fix DNS blocklists slow downloads
  • Leave 35s timeout for updaters
  • Set timeouts to 1s for local calls
  • Set timeouts to 5s for LAN VPN calls and small external calls
  • Set timeouts to 10s external VPN API calls
• Kernel modules: probe searches for features built-in the kernel
• CI: set hash of PR commit instead of synthetic commit in docker build argument
• internal/command: fix rare race condition on log line stream at command completion

Provider specific fixes

• AirVPN: update servers data (#3186)
• ExpressVPN:
  • add new CA3 certificate to fix TLS handshake failure (#3184, #3192)
  • remove pakistan server
• Privado:
  • servers data updated using JSON API
  • allow OpenVPN TCP protocol
  • allow additional OpenVPN ports 443, 8080 and 8443 for both tcp and udp
• Private Internet Access:
  • remove none encryption preset
  • use AES-GCM for all presets
  • allow ports 501 and 502 as custom ports given they are the defaults
  • try x.y.128.1 and x.y.0.1 from the gateway IP to find the API IP address
  • fix servers data updater and update servers data
  • update default OpenVPN ports: 8080 for UDP, 8443 for TCP (according to https://github.com/pia-foss/manual-connections/commit/8a75e46be81583d17f9ab3570881419b35000969)
  • handle "port is busy" messages and retry port forwarding logic
• ProtonVPN: fix updater code
• Vyprvpn: update OpenVPN configs zip URL (#3264)

PS:

• No time to make a video or a rant section yet, but will do for v3.42.0 for sure!
• v3.42 probably coming end of August/early September!
• Sorry for the spam, first few v3.41.2 release attempts decided to give me a bunch of surprises in the CI, so here it is again

Fixes

• Healthcheck: prevent race condition making Gluetun hang completely (#3123)
• Wireguard kernelspace detection fixed in some cases
• OpenVPN 2.5 is not needed as long as it's not to be used, resolving some kernel incompatibilities
• HTTP proxy: remove info log when no Proxy-Authorization header is present
• ProtonVPN:
  • update OpenVPN settings (#3120)
  • support port 51820 for UDP OpenVPN connections

Video of me reading out this release

Thank you all for your patience for this release which took its sweet time 🙏⏲️

I have been rather absent in a good part of 2025 due to work and life getting in the way, and I would like to thank many of you for helping out around in issues and discussions, and for the few code contributors whilst I was away.

On this release, many of the features you see are the result of behind-the-scene work of the last few years (notably on dns) and I'm super glad they are finally in Gluetun! A lot more to come in v3.42.0, there is already a pile of pull requests waiting 🚀

Final note, introducing the RANTING SECTION at the bottom of this changelog. This section might also be in the future releases (unfortunately)!

Happy holidays! 🎄 🎅 ❄️ ⛄

Features

• DNS
  • (K8s users read this) Local network names resolution using private DNS resolvers found at container start (#2970)
  • DNS over HTTPS support (see DNS_UPSTREAM_RESOLVER_TYPE below)
  • DNS_UPSTREAM_RESOLVER_TYPE option which can be dot (DNS over TLS), doh (DNS over HTTPS) or plain (plaintext over UDP)
  • DNS over TLS re-uses TCP connections which should put less stress on TCP-connections-rate-limiting by the VPN server
  • DNS requests blocked are logged with a reason
  • DNS rebinding protection is always enabled, but hostnames can be excluded with DNS_REBINDING_PROTECTION_EXEMPT_HOSTNAMES
  • i/o timeout errors are now logged at the debug level instead of warn level
• healthcheck system reworked: more robust and less impact on other applications (#2923)
  • Three checks are performed:
    • startup full check: when the VPN connection is first established, perform a TCP+TLS dial to HEALTH_TARGET_ADDRESSES with a timeout of 6 seconds
    • periodic full check: every 5 minutes, perform a TCP+TLS dial to HEALTH_TARGET_ADDRESSES, with up to 3 tries of 10s, 15s, and 30s timeouts
    • periodic small check: every minute, perform ICMP pings to HEALTH_ICMP_TARGET_IPS, with a fallback to plain DNS (UDP) lookups of github.com to cloudflare+google, with up to 10 tries of 5s, 5s, 5s, 10s, 10s, 10s, 15s, 15s, 15s, and 30s timeouts
  • If any of these checks fail, the VPN connection is restarted
  • Reduced impact on TCP to allow for higher bandwidth in TCP torrenting
  • New option HEALTH_TARGET_ADDRESSES=cloudflare.com:443,github.com:443 to have a fallback address
  • New option HEALTH_ICMP_TARGET_IPS=1.1.1.1,8.8.8.8 to have 8.8.8.8 as a fallback address
  • New option HEALTH_SMALL_CHECK_TYPE which can be dns or icmp. By default it uses icmp and falls back to dns if icmp isn't permitted.
  • New option HEALTH_RESTART_VPN: you should really leave it to on, unless you have trust issues with the healthcheck.
• built-in servers data updates:
  • Cyberghost
  • ExpressVPN
  • Mullvad
  • Privado
  • Private Internet Access
  • SlickVPN (mere 29 hardcoded servers 🤷)
  • ProtonVPN
  • Surfshark
  • Torguard
• control server:
  • HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE option (JSON encoded). For example: {"auth":"basic","username":"me","password":"pass"} or {"auth":"apiKey","apikey":"xyz"} or {"auth":"none"}.
  • log number of roles read from auth file
• VPN server side port forwarding:
  • support {{PORT}} template variable on top of {{PORTS}}
  • support {{VPN_INTERFACE}} template variable which is by default tun0
• Public IP data fetcher queries all data sources in parallel and picks the most popular result
• bump Alpine from 3.20 to 3.22
• wireguard: on error parsing WIREGUARD_ENDPOINT_IP, mention it must be an IP address for the time being
• new ascii logo logged out at program exit... did any of you spot it? 👀

Fixes

• Wireguard:

Fixes

• DNS:
  • prevent restart crash if DOT=off and DNS_KEEP_NAMESERVER=off
  • retry on next period the blocklists update after a failed update
• WIREGUARD_ENDPOINT_IP overrides the IP address correctly (regression introduced in v3.39.0)
• ExpressVPN hardcoded servers data updated (#2888 - huge thanks to the manual work of @Lobstrosity)
• PureVPN OpenVPN configuration updated (from #2991, credits to @mlapaj)
• SlickVPN updater: only keep 11 servers hardcoded and drop website scraping code
• VPNSecure updater fixed, with region and city data allowed to be set to N / A
• VPN Unlimited updater: no longer valid hardcoded hosts removed