To route a Docker application through an OpenVPN tunnel, run qmcgaw/gluetun as a VPN gateway, give it NET_ADMIN and /dev/net/tun, select your provider with VPN_SERVICE_PROVIDER, set VPN_TYPE=openvpn, and supply the provider’s OpenVPN credentials. Add network_mode: "service:gluetun" to each application that must use the tunnel. Because that application shares Gluetun’s network namespace, publish its listening ports on the Gluetun service, not on the application service.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This arrangement also gives routed containers Gluetun’s firewall protection. If the VPN connection disappears, the firewall blocks their traffic instead of allowing a direct connection from the Docker host.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the Gluetun gateway design works
Gluetun is a VPN client packaged as a container. In this design it owns the network namespace, establishes the OpenVPN tunnel, applies the firewall, and exposes the ports that users need to reach from the host. An application such as qBittorrent runs in a second container but joins Gluetun’s namespace with network_mode: "service:gluetun". The application therefore uses the same outbound route, DNS path, firewall rules, and host-facing ports as Gluetun.
The important consequence is that the application is not a separately addressable Docker network endpoint. Its ports: section is ineffective or invalid for this purpose; mappings belong on Gluetun. The child container also cannot bypass Gluetun’s kill-switch firewall when the tunnel is down.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Component | Responsibility |
|---|---|
| Gluetun | Creates the OpenVPN tunnel, applies firewall rules, and publishes host ports. |
| Routed application | Runs the workload while sharing Gluetun’s network namespace. |
| Docker Compose | Supplies capabilities, the TUN device, environment variables, startup ordering, and port mappings. |
| VPN provider | Supplies the Gluetun provider identifier, OpenVPN credentials, server selectors, and any certificate or port-forwarding requirements. |
Requirements before you start
- A Docker Engine installation with the Docker Compose plugin (the command is
docker compose). - A VPN account that permits OpenVPN connections. Provider desktop-app credentials, WireGuard keys, or a separate API token may not work for OpenVPN.
- The provider’s current Gluetun configuration page, including its exact provider identifier, server or region variables, and certificate requirements.
- Permission to create a TUN device and grant the container the
NET_ADMINcapability. On a managed host, an administrator may need to enable this. - A free host port for every web interface, API, or listening service that you intend to reach.
Provider settings change over time. Confirm the provider’s current OpenVPN account requirements and Gluetun identifier immediately before deployment rather than copying values from a desktop client configuration.
Create the Compose project
1. Make a working directory and credential file
Create a directory for the stack and place a compose.yml file inside it. Keep credentials outside the Compose file by using a local .env file or a dedicated secret-management system. A minimal .env file looks like this:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →OPENVPN_USER=your_openvpn_username
OPENVPN_PASSWORD=your_openvpn_passwordRestrict the file so other host users cannot read it, and add it to your source-control ignore list. Do not commit credentials to a public repository. Compose substitutes these values when it reads the YAML.
2. Define the Gluetun service
Use this provider-neutral pattern as the starting point:
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
ports:
- "8080:8080"
environment:
- VPN_SERVICE_PROVIDER=your_provider
- VPN_TYPE=openvpn
- OPENVPN_USER=${OPENVPN_USER}
- OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
app:
image: your/app
network_mode: "service:gluetun"
depends_on:
- gluetunReplace your_provider with the identifier used by Gluetun for your VPN company. Add the provider’s required server, country, city, or certificate variables exactly as documented. Replace your/app with the application image and change 8080:8080 to the application’s actual listening port.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Understand each required setting
image: qmcgaw/gluetunselects the Gluetun container.cap_add: NET_ADMINpermits the container to configure interfaces and firewall rules./dev/net/tun:/dev/net/tunpasses the host’s TUN device into the container, which OpenVPN needs to create the tunnel.VPN_SERVICE_PROVIDERselects Gluetun’s provider-specific implementation.VPN_TYPE=openvpnexplicitly chooses OpenVPN rather than WireGuard.OPENVPN_USERandOPENVPN_PASSWORDprovide the provider’s OpenVPN authentication values.network_mode: "service:gluetun"puts the application in Gluetun’s network namespace.depends_onstarts Gluetun before the application, but it does not prove that the VPN handshake is complete. Use logs and health information before declaring the stack ready.
Start and validate the tunnel
- From the project directory, run
docker compose config. Check that the YAML is valid, the provider identifier is present, and variable substitution produced the values you expect. Treat the output as sensitive: expanded credentials can appear in the rendered configuration, so do not paste it into tickets or shared logs. - Start the stack with
docker compose up -d. - Read the gateway log with
docker compose logs -f gluetun. Look for the selected provider, OpenVPN mode, successful authentication, tunnel establishment, and a healthy firewall state. Authentication errors usually indicate the wrong credential type, a typo, or a provider account that has not enabled OpenVPN. - Check container state with
docker compose ps. An application may start before the tunnel is ready because Compose startup ordering is not the same as VPN readiness. - Test outbound connectivity from the routed application:
docker compose exec app sh, then use an IP or DNS diagnostic tool available in that image. The observed public address should be the VPN exit address, not the Docker host’s normal address. If the image has no diagnostic utility, run the test from a temporary troubleshooting container that uses the same network namespace. - Only after outbound traffic is correct, test the application through the host-published port.
Do not infer a working VPN solely from a running container. The decisive evidence is a completed OpenVPN connection in the Gluetun log and an outbound address that matches the VPN path.
Recommended Free Tools
Route qBittorrent or another application through Gluetun
For every service that must use the tunnel, remove its independent network configuration and add the service-mode setting:
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
ports:
- "8080:8080"
- "6881:6881"
- "6881:6881/udp"
environment:
- VPN_SERVICE_PROVIDER=your_provider
- VPN_TYPE=openvpn
- OPENVPN_USER=${OPENVPN_USER}
- OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
qbittorrent:
image: lscr.io/linuxserver/qbittorrent
network_mode: "service:gluetun"
depends_on:
- gluetunThe exact application image and internal ports vary. The example publishes the web interface and two common torrent-listening protocols on Gluetun solely to demonstrate where mappings go; use the ports your application actually listens on. Do not add a second, ordinary Docker network to the routed service unless you have deliberately designed the routing and understand how that could create a path around the VPN firewall.
Why the web UI disappears after adding service mode
With a normal Compose network, you might publish 8080:8080 under the application. With service mode, the application has no separate network namespace, so the mapping must be moved to Gluetun. Also check that the application is listening on the expected port and bind address. Some applications bind only to loopback or only to a specific interface; adjust their own listen-address setting so the interface exposed through the shared namespace can accept the connection.
If the mapping is correct but the page remains unreachable, verify Gluetun’s tunnel and firewall state, then inspect the host firewall. A host rule can block a port even when Docker has published it successfully.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
How Gluetun’s firewall protects the child container
Gluetun’s firewall allows the traffic required to establish and maintain the VPN and blocks other traffic when the tunnel is unavailable. The project describes this as effectively acting as a kill switch: if the VPN goes down, traffic is blocked. Because the application shares Gluetun’s network, that protection applies to the application as well.
This behavior is intentional. A failed VPN connection may make the application appear offline rather than silently falling back to the host’s normal Internet route. Do not disable the firewall merely to make a connectivity test pass; investigate the tunnel, credentials, provider settings, and allowed LAN or input rules instead.
LAN access and firewall allowances
Decide whether clients on your local network must reach the application. Gluetun permits only traffic that its firewall configuration allows, so a LAN web UI may require an explicit LAN or input allowance in addition to the Docker port mapping. Keep that allowance as narrow as practical: specify the required subnet or port rather than opening every interface. The exact variable names and accepted formats are provider- and Gluetun-version-specific, so use the current project documentation for the firewall option you need.
OpenVPN credentials and provider-specific settings
VPN_TYPE=openvpn selects the protocol, but it does not define a universal authentication format. Providers differ in whether they use a dedicated VPN username and password, a generated service credential, a certificate, or additional server selectors. A password that works in a provider’s desktop application may be rejected by its OpenVPN service.
Use the provider’s Gluetun page to fill in the following values:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
| Setting | What to enter | Important qualification |
|---|---|---|
VPN_SERVICE_PROVIDER |
The provider identifier recognized by Gluetun | Use Gluetun’s spelling, not necessarily the provider’s marketing name. |
VPN_TYPE |
openvpn |
Do not substitute a WireGuard key or configuration. |
OPENVPN_USER |
The provider’s OpenVPN username | May differ from the account email or desktop-app login. |
OPENVPN_PASSWORD |
The provider’s OpenVPN password or service credential | Some providers require a generated credential. |
| Server or region variables | Provider-specific country, city, server, or hostname selectors | Names and accepted values vary; add only those documented for your provider. |
| Certificate or key variables | Provider-specific certificate material, when required | Keep sensitive material in a secret store or protected environment file. |
Docker port mapping versus VPN port forwarding
These are two different mechanisms:
- Docker port mapping connects a host port to a port inside Gluetun’s shared namespace. It lets a browser or LAN client reach a web UI on the Docker host.
- VPN server-side port forwarding asks the VPN provider to send unsolicited inbound Internet traffic to your VPN connection. It can improve inbound reachability for applications that accept connections, but it is optional for ordinary outbound browsing.
Gluetun’s advanced documentation identifies native server-side forwarding for Private Internet Access and ProtonVPN. Where supported, enable it with VPN_PORT_FORWARDING=on. For providers that assign a port externally, Gluetun documents FIREWALL_VPN_INPUT_PORTS; the assigned port must be allowed through the VPN firewall and entered in the application’s listening-port setting.
The forwarded port can change when the tunnel reconnects. If the provider supplies a new value, update the application before testing inbound traffic. A Docker mapping such as 6881:6881 does not create provider-side forwarding and cannot compensate for a VPN service that does not offer the feature.
Troubleshoot in a fixed order
1. Validate Compose expansion
Run docker compose config and inspect the rendered service definitions. Confirm that the application has network_mode: "service:gluetun", that all required variables are present, and that ports are listed under Gluetun. Protect the output because it may include expanded credentials.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Read the Gluetun log before the application log
Use docker compose logs gluetun. Resolve provider-selection, authentication, certificate, or OpenVPN handshake errors first. An application cannot have reliable Internet access until the gateway has a healthy tunnel.
3. Confirm the network namespace
Inspect the Compose file for spelling and quoting. The required value is network_mode: "service:gluetun". Do not attach an unrelated independent network to the child unless you have a specific, tested routing plan.
4. Check port ownership and binding
Every application port that users need must appear under Gluetun. Check for host-port collisions, verify the application’s internal port, and confirm its bind address. A service bound only to an unexpected address can be healthy while its UI remains inaccessible.
5. Check host and LAN firewalls
Docker’s published port still passes through the host firewall. Permit only the required host port and source networks. If access is from another machine on the LAN, verify that Gluetun’s firewall allows the LAN subnet as well.
6. Test outbound IP and DNS from the child
Run diagnostics inside the routed container and compare the result with a direct host test. An unexpected host address indicates that the service is not using Gluetun’s namespace or that the test was run in the wrong container. DNS failures can indicate missing provider settings, a blocked resolver, or an application-specific resolver override.
7. Treat inbound failures separately
For incoming connections, verify that the provider supports forwarding, that the feature is enabled, that the current assigned port is allowed with the relevant Gluetun firewall setting, and that the application is using that same port. Do not troubleshoot an inbound problem by disabling the kill switch.
Choosing between network designs
| Design | Isolation | Port exposure | Failure behavior | When it fits |
|---|---|---|---|---|
| Shared namespace with Gluetun | All routed services use one VPN namespace and firewall. | Publish every child port on Gluetun. | Child traffic stops when Gluetun’s VPN is unavailable. | Applications that must never use the host’s direct route. |
| Independent application network | Application has its own network path. | Publish ports on the application service. | Unless separately controlled, the application may continue through a non-VPN route. | Services that do not require VPN routing or are intentionally split from it. |
Use the shared namespace when preventing leaks is more important than giving each service an independent network identity. If you need both VPN-routed and direct services, place only the VPN-dependent services behind Gluetun and test each path independently.
Operational practices after deployment
- Pin or review the Gluetun image version according to your update policy, then retest provider variables after upgrades.
- Keep the Compose file and credential store separate so configuration can be backed up without copying secrets.
- Record which host ports map to which application interfaces, especially when several services share Gluetun.
- Monitor Gluetun logs after host reboots and VPN reconnects. A container that is “running” is not proof that OpenVPN is authenticated.
- Document the provider’s port-forwarding behavior and the application’s current listening port if inbound connectivity matters.
- Limit LAN exposure to trusted source networks and avoid publishing administrative interfaces to every host interface unless required.
- When changing providers, replace the identifier and all provider-specific authentication or server variables together; do not assume settings are portable between providers.
Quick reference configuration
The smallest working pattern is:
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
ports:
- "HOST_PORT:APP_PORT"
environment:
- VPN_SERVICE_PROVIDER=PROVIDER_IDENTIFIER
- VPN_TYPE=openvpn
- OPENVPN_USER=${OPENVPN_USER}
- OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
app:
image: YOUR_APPLICATION_IMAGE
network_mode: "service:gluetun"
depends_on:
- gluetunReplace every uppercase placeholder with a real value, then add any provider-required variables. Keep the credentials in .env or another protected secret mechanism, publish ports only on Gluetun, and verify the tunnel before relying on the application.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
