Issues with custom wireguard VPN on Hetzner

[bl4zee1g]

Hey so I wanted to set up gluetun to use my custom Wireguard server that I run on a cheap VPS I'm renting. It won't really start tho, the container immediately becomes unhealthy upon startup. Here's the logs and my config:

gluetun-1 | 2026-03-23T15:13:57Z INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.17 and family v4
gluetun-1 | 2026-03-23T15:13:57Z INFO [routing] adding route for 0.0.0.0/0
gluetun-1 | 2026-03-23T15:13:57Z INFO [firewall] setting allowed subnets...
gluetun-1 | 2026-03-23T15:13:57Z INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.17 and family v4
gluetun-1 | 2026-03-23T15:13:57Z INFO [dns] using plaintext DNS at address 1.1.1.1
gluetun-1 | 2026-03-23T15:13:57Z INFO [healthcheck] listening on 127.0.0.1:9999
gluetun-1 | 2026-03-23T15:13:57Z INFO [http server] http server listening on [::]:8000
gluetun-1 | 2026-03-23T15:13:57Z INFO [firewall] allowing VPN connection...
gluetun-1 | 2026-03-23T15:13:57Z INFO [wireguard] Using available kernelspace implementation
gluetun-1 | 2026-03-23T15:13:57Z INFO [wireguard] Connecting to [redacted].190:55042
gluetun-1 | 2026-03-23T15:13:57Z INFO [vpn] wireguard setup is complete. Note wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the wireguard connection is not working.
gluetun-1 | 2026-03-23T15:13:57Z INFO [MTU discovery] finding maximum MTU, this can take up to 6 seconds
gluetun-1 | 2026-03-23T15:14:02Z INFO [MTU discovery] reverting VPN interface tun0 MTU to 1320 (due to: PMTUD failed with both ICMP and TCP)
gluetun-1 | 2026-03-23T15:14:08Z WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: all check tries failed: parallel attempt 1/2 failed: dialing: dial tcp4: lookup github.com: i/o timeout, parallel attempt 2/2 failed: dialing: dial tcp4: lookup cloudflare.com: i/o timeout
gluetun-1 | 2026-03-23T15:14:08Z INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
gluetun-1 | 2026-03-23T15:14:08Z INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION
gluetun-1 | 2026-03-23T15:14:08Z INFO [vpn] stopping
gluetun-1 | 2026-03-23T15:14:09Z INFO [vpn] starting
gluetun-1 | 2026-03-23T15:14:09Z INFO [firewall] allowing VPN connection...
gluetun-1 | 2026-03-23T15:14:09Z INFO [wireguard] Using available kernelspace implementation
gluetun-1 | 2026-03-23T15:14:09Z INFO [wireguard] Connecting to [redacted].190:55042
gluetun-1 | 2026-03-23T15:14:09Z INFO [vpn] wireguard setup is complete. Note wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the wireguard connection is not working.
gluetun-1 | 2026-03-23T15:14:09Z INFO [MTU discovery] finding maximum MTU, this can take up to 6 seconds
gluetun-1 | 2026-03-23T15:14:14Z INFO [MTU discovery] reverting VPN interface tun0 MTU to 1320 (due to: PMTUD failed with both ICMP and TCP)
gluetun-1 | 2026-03-23T15:14:20Z WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: all check tries failed: parallel attempt 1/2 failed: dialing: dial tcp4: lookup cloudflare.com: i/o timeout, parallel attempt 2/2 failed: dialing: dial tcp4: lookup github.com: i/o timeout
gluetun-1 | 2026-03-23T15:14:20Z INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md
gluetun-1 | 2026-03-23T15:14:20Z INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION
gluetun-1 | 2026-03-23T15:14:20Z INFO [vpn] stopping
gluetun-1 | 2026-03-23T15:14:20Z INFO [vpn] starting
gluetun-1 | 2026-03-23T15:14:20Z INFO [firewall] allowing VPN connection...
gluetun-1 | 2026-03-23T15:14:20Z INFO [wireguard] Using available kernelspace implementation
gluetun-1 | 2026-03-23T15:14:20Z INFO [wireguard] Connecting to [redacted]:55042
gluetun-1 | 2026-03-23T15:14:20Z INFO [vpn] wireguard setup is complete. Note wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the wireguard connection is not working.

gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
environment:
- VPN_TYPE=wireguard
- VPN_SERVICE_PROVIDER=custom
- WIREGUARD_ENDPOINT_IP=[redacted]
- WIREGUARD_ENDPOINT_PORT=55042
- WIREGUARD_PUBLIC_KEY=[redacted]
- WIREGUARD_PRIVATE_KEY=[redacted]
- WIREGUARD_PRESHARED_KEY=[redacted]
- WIREGUARD_ADDRESSES=10.66.66.5/32

I came across #1661 but the firewall changes that got suggested there didn't work for me. It does work if I add a rule to Hetzner Firewall that just allows all traffic tho.

-> allowing traffic to destination port 55042 was suggested in the mentioned issue, I added the port that my Server connects to on my VPS too just to make sure (although I realize it doesn't really make sense). I also tried just allowing all incoming traffic from 1.1.1.1 but that's not enough for it to work either. Only working config I came across so far is having that yolo rule. I would really like if I could just configure the Hetzner Firewall as I don't like meddling with ufw so if anyone has any idea how I could get this working that'd be much appreciated.

[bl4zee1g]

in case anyone else has the same thing happen to them, the "solution" I ended up with is just whitelist all IPv4 requests coming from the IP where my Wireguard server is. It's not super safe but better than just having the yolo rule aka no firewall at all. I'm sure you could expose fewer ports to that IP with it still working but I cba to do that right now.