Use Gluetun as the VPN gateway container, configure it for OpenVPN, and place any application that must use the tunnel in Gluetun’s network namespace. In Docker Compose, that means granting Gluetun NET_ADMIN, exposing /dev/net/tun, setting VPN_TYPE=openvpn and your provider’s credentials, then adding network_mode: "service:gluetun" to the application. Publish the application’s ports on Gluetun—not on the application container.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This design gives the routed service Gluetun’s VPN connection and firewall. If the tunnel drops, Gluetun blocks traffic rather than allowing the application to fall back to the normal host connection. The sections below show a complete Compose pattern, explain port behavior, and provide a troubleshooting path for common failures.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the Compose design does
Gluetun is a VPN gateway that runs as one container. An application such as qBittorrent, a game-server utility, or another network client runs as a second container but shares Gluetun’s network namespace. The application therefore uses the VPN interface, DNS path, routes, and firewall created inside Gluetun.
The important relationship is:
- Gluetun: creates the tunnel, authenticates with the VPN provider, applies the firewall, and owns the network namespace.
- Routed application: uses
network_mode: "service:gluetun"and has no independent Docker network namespace. - Docker host: publishes Gluetun’s ports to your LAN or host, subject to the host firewall.
Gluetun’s firewall is also a kill switch. The project FAQ describes it as effectively blocking all traffic when the VPN connection goes down, and the Compose guide explains that a child container sharing Gluetun’s network is protected by the same behavior. This prevents an outage from silently exposing the application through the host’s ordinary internet connection.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prerequisites and information to collect
- A Docker Engine installation with Docker Compose support and permission to run containers with the
NET_ADMINcapability. - A host with the TUN device available at
/dev/net/tun. On a Linux host, verify it withls -l /dev/net/tun. If the device is missing, enable the host’s TUN support before starting the stack. - An account with a VPN provider that supports OpenVPN credentials and is listed in Gluetun’s current provider documentation.
- The provider’s Gluetun identifier, OpenVPN username, OpenVPN password, and any required server, country, region, certificate, or custom configuration values.
- The TCP or UDP ports your application listens on, plus the host ports you want to expose.
Do not assume that credentials from a provider’s desktop application, a WireGuard private key, or a general website password can be used for OpenVPN. Providers often issue separate service credentials or require an account setting to permit OpenVPN. Confirm the current provider page in Gluetun’s documentation before deployment.
Build the Gluetun service
1. Create a project directory
Create a directory for the Compose project and place both the Compose file and the credentials file there. Keeping the files together makes variable loading and backup easier, while keeping the credentials file out of source control prevents accidental publication.
mkdir vpn-stack
cd vpn-stack
touch compose.yml .envAdd .env to your repository’s ignore rules. Do not paste passwords into a public Compose file, issue tracker, or shared log. A Docker secret manager or an equivalent host secret facility is preferable when your deployment environment provides one.
2. Add OpenVPN variables to .env
VPN_SERVICE_PROVIDER=provider_id
OPENVPN_USER=openvpn_username
OPENVPN_PASSWORD=openvpn_passwordVPN_SERVICE_PROVIDER must be the identifier expected by Gluetun, not necessarily the provider’s marketing name. The username and password must be the provider’s OpenVPN credentials. If the provider requires a server group, country, city, certificate, or another selector, add the exact variable documented for that provider.
3. Write the Gluetun service
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
ports:
- "8080:8080"
environment:
- VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
- VPN_TYPE=openvpn
- OPENVPN_USER=${OPENVPN_USER}
- OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
app:
image: your/app
network_mode: "service:gluetun"
depends_on:
- gluetunThe NET_ADMIN capability lets Gluetun configure routes and firewall rules. The device mapping gives OpenVPN access to the kernel TUN interface. VPN_TYPE=openvpn selects OpenVPN rather than WireGuard. The depends_on entry controls startup order, but it is not a complete readiness check: the application may start before the tunnel is fully connected, so verify the application after Gluetun reports a healthy connection.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Replace your/app with the image you actually intend to route. The application image does not need its own VPN configuration; all tunnel settings belong to Gluetun.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Provider-specific OpenVPN settings
The four variables in the example are the common foundation, not a universal provider profile. A provider may require a particular server selection variable, a custom OpenVPN certificate, a region name, or a separate account option for port forwarding. Add those settings under Gluetun’s environment section exactly as documented by the provider and Gluetun.
Keep provider details separate from the application configuration. This makes it easier to change servers or providers without rebuilding the application container. It also avoids a common mistake: copying a WireGuard example and leaving a key variable in place while setting VPN_TYPE=openvpn. OpenVPN authentication and WireGuard key material are different systems.
Route qBittorrent or another container through Gluetun
Use the shared network namespace
Add the following two keys to every service that must use the VPN:
network_mode: "service:gluetun"
depends_on:
- gluetunThe value after service: is the Compose service name, so it must match gluetun exactly. The routed container must not also declare an independent networks: attachment. Giving it a second, separate network can create routing or leak behavior that is difficult to reason about and defeats the simple gateway design.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Example with a web interface
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
ports:
- "8080:8080"
- "6881:6881"
- "6881:6881/udp"
environment:
- VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER}
- VPN_TYPE=openvpn
- OPENVPN_USER=${OPENVPN_USER}
- OPENVPN_PASSWORD=${OPENVPN_PASSWORD}
qbittorrent:
image: lscr.io/linuxserver/qbittorrent:latest
network_mode: "service:gluetun"
depends_on:
- gluetun
volumes:
- ./qbittorrent-config:/config
- ./downloads:/downloadsIn this example, qBittorrent’s web interface listens on port 8080 inside the shared namespace. The host mapping 8080:8080 therefore belongs on Gluetun. The same rule applies to every TCP or UDP port the application needs.
Why the web UI disappears after adding network_mode
A routed container has no separate network namespace, so its ports: section is not the place to publish its interface. Put the mapping on Gluetun instead. If the application listens on a different internal port, map that port explicitly; for example, 9090:8080 exposes the application’s port 8080 on host port 9090.
Check these items in order:
- Confirm the mapping is under
gluetun, not under the routed service. - Confirm the application is listening on the expected internal port and bind address. A service bound only to an unexpected interface may not answer through the shared namespace.
- Check Gluetun’s logs for a failed tunnel, authentication error, or firewall initialization problem.
- Check the host firewall and any cloud or router firewall that controls access to the published host port.
- Connect using the Docker host’s address and published port, such as
http://host-address:8080, rather than assuming the application has a separate container IP.
Publish all required ports on Gluetun, including separate UDP mappings when the application uses UDP. A TCP mapping does not automatically expose the corresponding UDP port.
Understand Gluetun’s firewall and kill-switch behavior
Gluetun permits the traffic needed to establish and maintain the VPN and blocks traffic that does not meet its firewall rules. When the tunnel is unavailable, the routed application’s traffic stops instead of falling back to the host’s normal route. This is the central safety property of the shared-namespace design.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The firewall does not automatically make every LAN service reachable. LAN access, inbound connections, and published host ports still depend on the firewall rules, application bind address, and host networking policy. If you intentionally need access from a local subnet, configure the appropriate Gluetun LAN or input settings and limit them to the required addresses and ports.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
NET_ADMIN is a powerful capability. Treat the Gluetun container and the Compose file as privileged infrastructure: use trusted images, restrict access to the Docker host, protect the credentials file, and avoid adding unrelated capabilities.
Docker port mapping versus VPN port forwarding
These are different mechanisms:
| Mechanism | What it controls | Where it is configured |
|---|---|---|
| Docker port mapping | Whether a host port reaches a service inside the shared container namespace | The ports: section on Gluetun |
| VPN server-side port forwarding | Whether unsolicited traffic from the VPN provider’s network can reach your tunnel | The provider’s supported feature and Gluetun’s forwarding settings |
Ordinary outbound browsing and many client applications do not require server-side forwarding. It becomes relevant when an application needs inbound reachability through the VPN, such as accepting peer connections.
Gluetun’s advanced documentation states that native server-side forwarding is implemented for Private Internet Access and ProtonVPN and can be enabled with:
VPN_PORT_FORWARDING=onSupport and behavior depend on the provider and plan. For providers that assign a forwarded port externally, Gluetun documents FIREWALL_VPN_INPUT_PORTS; allow the assigned port through the VPN firewall and configure the same current port in the application. A forwarded port may change when the VPN session changes, so an application configured with yesterday’s value can stop accepting inbound connections even though the tunnel itself is healthy.
When inbound access fails, verify provider support, account eligibility, the forwarding feature, Gluetun’s assigned port, the firewall input setting, and the application’s listening port. Do not confuse a successful Docker mapping with successful provider-side forwarding.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Validate the stack before using the application
1. Render the Compose configuration
docker compose configThis catches YAML errors and shows whether Compose expanded the variables. Run it carefully: rendered output can contain credentials, so do not paste the result into shared logs or public tickets.
2. Start Gluetun and inspect its logs
docker compose up -d gluetun
docker compose logs -f gluetunLook for the selected provider, OpenVPN mode, successful authentication, tunnel establishment, and a healthy state. An authentication failure usually means the credentials or provider identifier is wrong. A device or permission error usually points to /dev/net/tun or missing NET_ADMIN.
3. Start the routed application
docker compose up -d app
docker compose psConfirm that both services remain running. If the application repeatedly restarts, inspect its own logs as well as Gluetun’s; a VPN connection can be healthy while the application has an unrelated configuration error.
4. Test egress from the shared namespace
docker compose exec app shFrom the shell, use the diagnostic tools available in the image to check the public IP and DNS behavior. Minimal images may not include curl, wget, or a DNS utility; install diagnostics only temporarily or run a separate trusted diagnostic container that shares Gluetun’s network namespace. The observed public IP should correspond to the VPN exit, not the host’s ordinary internet address.
5. Test the application UI
After egress is confirmed, connect to the host-published port. Testing in this order separates VPN problems from an application bind or port-publishing problem.
Troubleshooting by symptom
Gluetun exits immediately
- Run
docker compose logs gluetunand read the first configuration error, not only the final shutdown line. - Check that
VPN_SERVICE_PROVIDERis a current Gluetun identifier. - Check that
VPN_TYPE=openvpnis present and that the provider accepts the supplied OpenVPN credentials. - Verify the TUN device mapping and the
NET_ADMINcapability. - Review provider-specific certificate, server, or region variables.
The application has internet access through the wrong IP
- Confirm the application uses
network_mode: "service:gluetun"exactly. - Remove an accidental independent network attachment from the routed service.
- Check Gluetun’s health and logs for a tunnel that has not yet connected.
- Test from inside the routed container rather than from the host, because the host’s public IP is expected to be different.
The web interface is unreachable
- Move every required
ports:mapping to Gluetun. - Verify the internal application port and bind address.
- Check host and upstream firewall rules.
- Use the host address and published port; do not rely on a separate IP for the routed container.
Outbound traffic works but inbound connections do not
- Determine whether the provider supports server-side forwarding for your account and location.
- Enable the relevant Gluetun forwarding option.
- Allow the assigned port with
FIREWALL_VPN_INPUT_PORTSwhen required by the provider’s model. - Enter the current assigned port in the application and update it whenever the provider changes it.
- Keep Docker’s host mapping separate from this provider-side requirement.
DNS lookups fail while the tunnel appears connected
Inspect Gluetun’s DNS and firewall log messages, then test name resolution from the routed namespace. A connected OpenVPN interface does not prove that the application is using a working DNS path. Avoid adding a second network as a quick fix; that can create a leak or route around the firewall.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOperational practices
- Pin and update the Gluetun image deliberately rather than changing production images without a rollback plan.
- Review the provider’s current Gluetun instructions whenever credentials, server names, or forwarding behavior change.
- Back up application configuration and downloads independently of the container lifecycle.
- After a provider change, repeat configuration rendering, log inspection, public-IP testing, and UI testing.
- Keep only the ports you need published and restrict host-firewall access to trusted networks.
- Monitor the application’s reported listening port if the provider assigns forwarding dynamically.
Choosing between network designs
| Design | Isolation | Port exposure | Typical failure behavior | Best fit |
|---|---|---|---|---|
| Shared namespace with Gluetun | Application traffic follows Gluetun’s tunnel and firewall | Publish on Gluetun; one place to audit mappings | VPN loss blocks routed traffic | Applications that must never use the host route |
| Application on its own ordinary Docker network | Application keeps its normal Docker networking | Publish directly on the application | Application can continue through the normal route if no separate kill switch exists | Services that do not require VPN routing |
| Mixed or multi-network attachment | Depends on routing and firewall details | Can be more flexible but harder to audit | Potential leaks or asymmetric routing if misconfigured | Advanced setups with a documented LAN-access requirement |
The shared-namespace pattern is usually the clearest choice when the requirement is “all traffic from this container must use OpenVPN.” Use a more complex topology only when you understand exactly which interfaces, routes, and firewall rules are involved.
Quick Recap
Security and maintenance checklist
- Credentials: keep OpenVPN variables in
.envor a secret manager, and protect file permissions. - Capabilities: grant
NET_ADMINonly to Gluetun, not to every application. - Device access: expose
/dev/net/tunonly where the VPN gateway needs it. - Ports: publish required TCP and UDP ports on Gluetun and restrict them with the host firewall.
- Routing: verify every VPN-dependent service uses
network_mode: "service:gluetun". - Fail-safe behavior: test by stopping Gluetun and confirming the routed service cannot reach the internet through another route.
- Forwarding: treat a provider-assigned port as temporary and update the application when it changes.
- Updates: read current provider and Gluetun documentation before changing identifiers or OpenVPN variables.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
