Private Internet Access updated servers give `TLS Error: TLS key negotiation failed to occur within 60 seconds`

[jonasflataas]

Is this urgent?

Yes

Host OS

Proxmox running Docker LXC with portainer

CPU arch

x86_64

VPN service provider

Private Internet Access

What are you using to run the container

Portainer

What is the version of Gluetun

Running version latest built on 2026-04-08T15:11:45.399Z (commit 2006fae) on Linux 6.17.4-2-pve (x86_64)

What's the problem 🤔

I've been running v3.35.0 for months without any issues and all of a sudden I started experiencing issues with the vpn / port forwarding.

I have updated the server lists and still no change.

Share your logs (at least 10 lines)

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================
Running version latest built on 2026-04-08T15:11:45.399Z (commit 2006fae) on Linux 6.17.4-2-pve (x86_64)
📣 Set BORINGPOLL_GLUETUNCOM=on to help combat AI slop and shutdown that scam website
🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2026-04-16T19:01:35+02:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2026-04-16T19:01:35+02:00 INFO [routing] local ethernet link found: eth0
2026-04-16T19:01:35+02:00 INFO [routing] local ipnet found: 172.18.0.0/16
2026-04-16T19:01:35+02:00 INFO [firewall] enabling...
2026-04-16T19:01:36+02:00 INFO [firewall] enabled successfully
2026-04-16T19:01:36+02:00 INFO [storage] merging by most recent 20646 hardcoded servers and 20653 servers read from /gluetun/servers.json
2026-04-16T19:01:36+02:00 INFO [storage] Using private internet access servers from file which are 113 days more recent
2026-04-16T19:01:36+02:00 INFO Alpine version: 3.23.3
2026-04-16T19:01:36+02:00 INFO OpenVPN version: 2.6.16
2026-04-16T19:01:36+02:00 INFO Firewall version: iptables v1.8.11
2026-04-16T19:01:36+02:00 INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: private internet access
|   |   ├── Server selection settings:
|   |   |   ├── VPN type: openvpn
|   |   |   ├── Regions: norway
|   |   |   ├── Port forwarding only servers: yes
|   |   |   └── OpenVPN server selection settings:
|   |   |       ├── Protocol: UDP
|   |   |       └── Private Internet Access encryption preset: strong
|   |   └── Automatic port forwarding settings:
|   |       ├── Redirection listening port: disabled
|   |       ├── Use port forwarding code for current provider
|   |       ├── Forwarded port file path: /tmp/gluetun/forwarded_port
|   |       └── Credentials:
|   |           ├── Username: ********
|   |           └── Password: ******
|   ├── OpenVPN settings:
|   |   ├── OpenVPN version: 2.6
|   |   ├── User: [set]
|   |   ├── Password: [set]
|   |   ├── Private Internet Access encryption preset: strong
|   |   ├── Network interface: tun0
|   |   ├── Run OpenVPN as: root
|   |   └── Verbosity level: 1
|   └── Path MTU discovery:
|       ├── ICMP addresses:
|       |   ├── 1.1.1.1
|       |   └── 8.8.8.8
|       └── TCP addresses:
|           ├── 1.1.1.1:443
|           ├── 8.8.8.8:443
|           ├── 1.1.1.1:53
|           ├── 8.8.8.8:53
|           ├── [2606:4700:4700::1111]:53
|           ├── [2001:4860:4860::8888]:53
|           ├── [2606:4700:4700::1111]:443
|           └── [2001:4860:4860::8888]:443
├── DNS settings:
|   ├── Upstream resolver type: dot
|   ├── Upstream resolvers:
|   |   └── Cloudflare
|   ├── Caching: yes
|   ├── IPv6: no
|   ├── Update period: every 24h0m0s
|   └── DNS filtering settings:
|       ├── Block malicious: yes
|       ├── Block ads: no
|       └── Block surveillance: no
├── Firewall settings:
|   ├── Enabled: yes
|   ├── Iptables settings:
|   |   └── Log level: info
|   └── Outbound subnets:
|       └── 192.168.1.0/24
├── Log settings:
|   └── Log level: info
├── IPv6 settings:
|   └── Check addresses:
|       ├── [2001:4860:4860::8888]:53
|       └── [2606:4700:4700::1111]:53
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target addresses:
|   |   ├── cloudflare.com:443
|   |   └── github.com:443
|   ├── Small health check type: ICMP echo request
|   |   └── ICMP target IPs:
|   |       ├── 1.1.1.1
|   |       └── 8.8.8.8
|   └── Restart VPN on healthcheck failure: yes
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 1000
|   ├── Process GID: 10000
|   └── Timezone: europe/oslo
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
└── Version settings:
    └── Enabled: yes
2026-04-16T19:01:36+02:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2026-04-16T19:01:36+02:00 INFO [routing] adding route for 0.0.0.0/0
2026-04-16T19:01:36+02:00 INFO [firewall] setting allowed subnets...
2026-04-16T19:01:36+02:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2026-04-16T19:01:36+02:00 INFO [routing] adding route for 192.168.1.0/24
2026-04-16T19:01:36+02:00 INFO [healthcheck] listening on 127.0.0.1:9999
2026-04-16T19:01:36+02:00 INFO [http server] http server listening on [::]:8000
2026-04-16T19:01:36+02:00 INFO [firewall] allowing VPN connection...
2026-04-16T19:01:36+02:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-04-16T19:01:36+02:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026-04-16T19:01:36+02:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]158.173.166.73:1197
2026-04-16T19:01:36+02:00 INFO [openvpn] UDPv4 link local: (not bound)
2026-04-16T19:01:36+02:00 INFO [openvpn] UDPv4 link remote: [AF_INET]158.173.166.73:1197
2026-04-16T19:02:36+02:00 WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
That error usually happens because either:
1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
3. Your Internet connection is not working 🤯, ensure it works
4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
2026-04-16T19:02:36+02:00 INFO [openvpn] TLS Error: TLS handshake failed
2026-04-16T19:02:36+02:00 INFO [openvpn] SIGTERM received, sending exit notification to peer
2026-04-16T19:02:36+02:00 INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
2026-04-16T19:02:36+02:00 INFO [vpn] retrying in 15s
2026-04-16T19:02:51+02:00 INFO [firewall] allowing VPN connection...
2026-04-16T19:02:51+02:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-04-16T19:02:51+02:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026-04-16T19:02:51+02:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]158.173.166.73:1197
2026-04-16T19:02:51+02:00 INFO [openvpn] UDPv4 link local: (not bound)
2026-04-16T19:02:51+02:00 INFO [openvpn] UDPv4 link remote: [AF_INET]158.173.166.73:1197
2026-04-16T19:03:51+02:00 WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
That error usually happens because either:
1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
3. Your Internet connection is not working 🤯, ensure it works
4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
2026-04-16T19:03:51+02:00 INFO [openvpn] TLS Error: TLS handshake failed
2026-04-16T19:03:51+02:00 INFO [openvpn] SIGTERM received, sending exit notification to peer
2026-04-16T19:03:51+02:00 INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
2026-04-16T19:03:51+02:00 INFO [vpn] retrying in 15s
2026-04-16T19:04:06+02:00 INFO [firewall] allowing VPN connection...
2026-04-16T19:04:06+02:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-04-16T19:04:06+02:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026-04-16T19:04:06+02:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]158.173.166.163:1197
2026-04-16T19:04:06+02:00 INFO [openvpn] UDPv4 link local: (not bound)
2026-04-16T19:04:06+02:00 INFO [openvpn] UDPv4 link remote: [AF_INET]158.173.166.163:1197
2026-04-16T19:05:06+02:00 WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
That error usually happens because either:
1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
3. Your Internet connection is not working 🤯, ensure it works
4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
2026-04-16T19:05:06+02:00 INFO [openvpn] TLS Error: TLS handshake failed
2026-04-16T19:05:06+02:00 INFO [openvpn] SIGTERM received, sending exit notification to peer
2026-04-16T19:05:06+02:00 INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
2026-04-16T19:05:06+02:00 INFO [vpn] retrying in 15s
2026-04-16T19:05:21+02:00 INFO [firewall] allowing VPN connection...
2026-04-16T19:05:21+02:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-04-16T19:05:21+02:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026-04-16T19:05:21+02:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]158.173.166.10:1197
2026-04-16T19:05:21+02:00 INFO [openvpn] UDPv4 link local: (not bound)
2026-04-16T19:05:21+02:00 INFO [openvpn] UDPv4 link remote: [AF_INET]158.173.166.10:1197
2026-04-16T19:06:21+02:00 WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
That error usually happens because either:
1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
3. Your Internet connection is not working 🤯, ensure it works
4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
2026-04-16T19:06:21+02:00 INFO [openvpn] TLS Error: TLS handshake failed
2026-04-16T19:06:21+02:00 INFO [openvpn] SIGTERM received, sending exit notification to peer
2026-04-16T19:06:21+02:00 INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
2026-04-16T19:06:21+02:00 INFO [vpn] retrying in 15s
2026-04-16T19:06:36+02:00 INFO [firewall] allowing VPN connection...
2026-04-16T19:06:36+02:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-04-16T19:06:36+02:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026-04-16T19:06:36+02:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]158.173.166.47:1197
2026-04-16T19:06:36+02:00 INFO [openvpn] UDPv4 link local: (not bound)
2026-04-16T19:06:36+02:00 INFO [openvpn] UDPv4 link remote: [AF_INET]158.173.166.47:1197
2026-04-16T19:06:36+02:00 INFO [openvpn] [Server-11800-3a] Peer Connection Initiated with [AF_INET]158.173.166.47:1197
2026-04-16T19:06:36+02:00 INFO [openvpn] TUN/TAP device tun0 opened
2026-04-16T19:06:36+02:00 INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2026-04-16T19:06:36+02:00 INFO [openvpn] /sbin/ip link set dev tun0 up
2026-04-16T19:06:36+02:00 INFO [openvpn] /sbin/ip addr add dev tun0 10.242.0.37/16 broadcast +
2026-04-16T19:06:36+02:00 INFO [openvpn] UID set to nonrootuser
2026-04-16T19:06:36+02:00 INFO [openvpn] Initialization Sequence Completed
2026-04-16T19:06:36+02:00 INFO [MTU discovery] finding maximum MTU, this can take up to 6 seconds
2026-04-16T19:06:37+02:00 INFO [MTU discovery] setting VPN interface tun0 MTU to maximum valid MTU 1258
2026-04-16T19:06:37+02:00 INFO [dns] DNS server listening on [::]:53
2026-04-16T19:06:37+02:00 INFO [dns] ready and using DNS server with dot upstream resolvers
2026-04-16T19:06:37+02:00 INFO [dns] downloading hostnames and IP block lists
2026-04-16T19:06:39+02:00 INFO [dns] leak check report: 172.64.210.29 (60%), 162.158.221.108 (40%)
2026-04-16T19:06:39+02:00 INFO [ip getter] Public IP address is 158.173.166.126 (Norway, Oslo, Oslo - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-04-16T19:06:39+02:00 INFO [vpn] You are running 2 commits behind the most recent latest
2026-04-16T19:06:39+02:00 INFO [port forwarding] starting
2026-04-16T19:06:44+02:00 ERROR [vpn] starting port forwarding service: port forwarding for the first time: refreshing port forward data: fetching port forwarding data: obtaining signature payload: Get "https://10.242.128.1:19999/getSignature?token=<token>": context deadline exceeded

Share your configuration

networks:
  media-network:
    name: media-network
    driver: bridge

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8112:8112
      - 9696:9696
    volumes:
      - ${FOLDER_FOR_CONFIGS:?err}/gluetun:/gluetun
    environment:
      - PUID=${PUID:?err}
      - PGID=${PGID:?err}
      - TZ=${TIMEZONE:?err}
      - VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER:?err}
      - SERVER_REGIONS=Norway
      - OPENVPN_USER=${VPN_USERNAME}
      - OPENVPN_PASSWORD=${VPN_PASSWORD}
      - FIREWALL_OUTBOUND_SUBNETS=${LOCAL_SUBNET:?err}
      - PORT_FORWARD_ONLY=true
      - VPN_PORT_FORWARDING=on

    healthcheck:
      test: ping -c 1 www.google.com || exit 1
      interval: 60s
      timeout: 20s
      retries: 5
    restart: unless-stopped
    networks:
      - media-network


  deluge:
    image: lscr.io/linuxserver/deluge:latest
    container_name: deluge
    restart: unless-stopped
    volumes:
      - ${FOLDER_FOR_CONFIGS:?err}/deluge:/config
      - ${FOLDER_FOR_MEDIA:?err}:/mnt/data
    labels:
      - deunhealth.restart.on.unhealthy= "true"
    environment:
      - PUID=${PUID:?err}
      - PGID=${PGID:?err}
      - TZ=${TIMEZONE:?err}
    network_mode: service:gluetun
    healthcheck:
        test: ping -c 1 www.google.com || exit 1
        interval: 60s
        retries: 3
        start_period: 20s
        timeout: 10s

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    labels:
      - deunhealth.restart.on.unhealthy= "true"
    environment:
      - PUID=${PUID:?err}
      - PGID=${PGID:?err}
      - TZ=${TIMEZONE:?err}
    volumes:
     - ${FOLDER_FOR_CONFIGS:?err}/prowlarr/data:/config
     - ${FOLDER_FOR_MEDIA:?err}:/mnt/media_root
    restart: unless-stopped
    network_mode: service:gluetun
    healthcheck:
        test: ping -c 1 www.google.com || exit 1
        interval: 60s
        retries: 3
        start_period: 20s
        timeout: 10s

  deunhealth:
    image: qmcgaw/deunhealth
    container_name: deunhealth
    network_mode: "none"
    environment:
      - LOG_LEVEL=info
      - HEALTH_SERVER_ADDRESS=127.0.0.1:9999
      - TZ=Europe/Oslo
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

Environment variables

COMPOSE_PROJECT_NAME=media-stack
LOCAL_SUBNET=192.168.1.0/24
FOLDER_FOR_CONFIGS=/mnt/data/app_config
FOLDER_FOR_MEDIA=/mnt/data
PUID=1000
PGID=10000
TIMEZONE=Europe/Oslo
VPN_SERVICE_PROVIDER=private internet access
VPN_USERNAME=
VPN_PASSWORD=

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[jonasflataas]

I removed - SERVER_REGIONS=Norway and it worked

Share your logs (at least 10 lines)

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================
Running version latest built on 2026-04-08T15:11:45.399Z (commit 2006fae) on Linux 6.17.4-2-pve (x86_64)
📣 Set BORINGPOLL_GLUETUNCOM=on to help combat AI slop and shutdown that scam website
🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2026-04-16T19:23:05+02:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2026-04-16T19:23:05+02:00 INFO [routing] local ethernet link found: eth0
2026-04-16T19:23:05+02:00 INFO [routing] local ipnet found: 172.18.0.0/16
2026-04-16T19:23:05+02:00 INFO [firewall] enabling...
2026-04-16T19:23:05+02:00 INFO [firewall] enabled successfully
2026-04-16T19:23:05+02:00 INFO [storage] merging by most recent 20646 hardcoded servers and 20653 servers read from /gluetun/servers.json
2026-04-16T19:23:05+02:00 INFO [storage] Using private internet access servers from file which are 113 days more recent
2026-04-16T19:23:05+02:00 INFO Alpine version: 3.23.3
2026-04-16T19:23:05+02:00 INFO OpenVPN version: 2.6.16
2026-04-16T19:23:05+02:00 INFO Firewall version: iptables v1.8.11
2026-04-16T19:23:05+02:00 INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: private internet access
|   |   ├── Server selection settings:
|   |   |   ├── VPN type: openvpn
|   |   |   ├── Port forwarding only servers: yes
|   |   |   └── OpenVPN server selection settings:
|   |   |       ├── Protocol: UDP
|   |   |       └── Private Internet Access encryption preset: strong
|   |   └── Automatic port forwarding settings:
|   |       ├── Redirection listening port: disabled
|   |       ├── Use port forwarding code for current provider
|   |       ├── Forwarded port file path: /tmp/gluetun/forwarded_port
|   |       └── Credentials:
|   |           ├── Username: ****
|   |           └── Password: ****
|   ├── OpenVPN settings:
|   |   ├── OpenVPN version: 2.6
|   |   ├── User: [set]
|   |   ├── Password: [set]
|   |   ├── Private Internet Access encryption preset: strong
|   |   ├── Network interface: tun0
|   |   ├── Run OpenVPN as: root
|   |   └── Verbosity level: 1
|   └── Path MTU discovery:
|       ├── ICMP addresses:
|       |   ├── 1.1.1.1
|       |   └── 8.8.8.8
|       └── TCP addresses:
|           ├── 1.1.1.1:443
|           ├── 8.8.8.8:443
|           ├── 1.1.1.1:53
|           ├── 8.8.8.8:53
|           ├── [2606:4700:4700::1111]:53
|           ├── [2001:4860:4860::8888]:53
|           ├── [2606:4700:4700::1111]:443
|           └── [2001:4860:4860::8888]:443
├── DNS settings:
|   ├── Upstream resolver type: dot
|   ├── Upstream resolvers:
|   |   └── Cloudflare
|   ├── Caching: yes
|   ├── IPv6: no
|   ├── Update period: every 24h0m0s
|   └── DNS filtering settings:
|       ├── Block malicious: yes
|       ├── Block ads: no
|       └── Block surveillance: no
├── Firewall settings:
|   ├── Enabled: yes
|   ├── Iptables settings:
|   |   └── Log level: info
|   └── Outbound subnets:
|       └── 192.168.1.0/24
├── Log settings:
|   └── Log level: info
├── IPv6 settings:
|   └── Check addresses:
|       ├── [2001:4860:4860::8888]:53
|       └── [2606:4700:4700::1111]:53
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target addresses:
|   |   ├── cloudflare.com:443
|   |   └── github.com:443
|   ├── Small health check type: ICMP echo request
|   |   └── ICMP target IPs:
|   |       ├── 1.1.1.1
|   |       └── 8.8.8.8
|   └── Restart VPN on healthcheck failure: yes
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 1000
|   ├── Process GID: 10000
|   └── Timezone: europe/oslo
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
└── Version settings:
    └── Enabled: yes
2026-04-16T19:23:06+02:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2026-04-16T19:23:06+02:00 INFO [routing] adding route for 0.0.0.0/0
2026-04-16T19:23:06+02:00 INFO [firewall] setting allowed subnets...
2026-04-16T19:23:06+02:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2026-04-16T19:23:06+02:00 INFO [routing] adding route for 192.168.1.0/24
2026-04-16T19:23:06+02:00 INFO [healthcheck] listening on 127.0.0.1:9999
2026-04-16T19:23:06+02:00 INFO [http server] http server listening on [::]:8000
2026-04-16T19:23:06+02:00 INFO [firewall] allowing VPN connection...
2026-04-16T19:23:06+02:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-04-16T19:23:06+02:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026-04-16T19:23:06+02:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]158.173.76.213:1197
2026-04-16T19:23:06+02:00 INFO [openvpn] UDPv4 link local: (not bound)
2026-04-16T19:23:06+02:00 INFO [openvpn] UDPv4 link remote: [AF_INET]158.173.76.213:1197
2026-04-16T19:24:06+02:00 WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
That error usually happens because either:
1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
3. Your Internet connection is not working 🤯, ensure it works
4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
2026-04-16T19:24:06+02:00 INFO [openvpn] TLS Error: TLS handshake failed
2026-04-16T19:24:06+02:00 INFO [openvpn] SIGTERM received, sending exit notification to peer
2026-04-16T19:24:06+02:00 INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
2026-04-16T19:24:06+02:00 INFO [vpn] retrying in 15s
2026-04-16T19:24:21+02:00 INFO [firewall] allowing VPN connection...
2026-04-16T19:24:21+02:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-04-16T19:24:21+02:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026-04-16T19:24:21+02:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]173.244.49.92:1197
2026-04-16T19:24:21+02:00 INFO [openvpn] UDPv4 link local: (not bound)
2026-04-16T19:24:21+02:00 INFO [openvpn] UDPv4 link remote: [AF_INET]173.244.49.92:1197
2026-04-16T19:24:22+02:00 INFO [openvpn] [taiwan406] Peer Connection Initiated with [AF_INET]173.244.49.92:1197
2026-04-16T19:24:22+02:00 INFO [openvpn] TUN/TAP device tun0 opened
2026-04-16T19:24:22+02:00 INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2026-04-16T19:24:22+02:00 INFO [openvpn] /sbin/ip link set dev tun0 up
2026-04-16T19:24:22+02:00 INFO [openvpn] /sbin/ip addr add dev tun0 10.18.110.102/24 broadcast +
2026-04-16T19:24:22+02:00 INFO [openvpn] UID set to nonrootuser
2026-04-16T19:24:22+02:00 INFO [openvpn] Initialization Sequence Completed
2026-04-16T19:24:22+02:00 INFO [MTU discovery] finding maximum MTU, this can take up to 6 seconds
2026-04-16T19:24:24+02:00 INFO [MTU discovery] setting VPN interface tun0 MTU to maximum valid MTU 1258
2026-04-16T19:24:24+02:00 INFO [dns] DNS server listening on [::]:53
2026-04-16T19:24:24+02:00 INFO [dns] ready and using DNS server with dot upstream resolvers
2026-04-16T19:24:24+02:00 INFO [dns] downloading hostnames and IP block lists
2026-04-16T19:24:37+02:00 INFO [dns] leak check report: 162.158.117.83 (20%), 162.159.109.41 (20%), 172.70.221.58 (20%), 172.71.4.42 (20%), 172.64.214.42 (10%), 172.68.117.96 (10%)
2026-04-16T19:24:37+02:00 INFO [ip getter] Public IP address is 173.244.49.92 (Japan, Tokyo, Tokyo - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-04-16T19:24:39+02:00 INFO [vpn] You are running 2 commits behind the most recent latest
2026-04-16T19:24:39+02:00 INFO [port forwarding] starting
2026-04-16T19:24:41+02:00 INFO [port forwarding] Port forwarded data expires in 62 days
2026-04-16T19:24:41+02:00 INFO [port forwarding] port forwarded is 34926
2026-04-16T19:24:41+02:00 INFO [firewall] setting allowed input port 34926 through interface tun0...
2026-04-16T19:24:41+02:00 INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2026-04-16T20:17:49+02:00 WARN [healthcheck] ignoring ICMP echo reply mismatching expected id 52282 (id: 0, seq: 645, type: 0, code: 0, length: 64, return address 142.251.151.119)
2026-04-16T20:18:50+02:00 WARN [healthcheck] ignoring ICMP echo reply mismatching expected id 52282 (id: 0, seq: 652, type: 0, code: 0, length: 64, return address 142.251.153.119)

Share your configuration

networks:
  media-network:
    name: media-network
    driver: bridge

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8112:8112
      - 9696:9696
    volumes:
      - ${FOLDER_FOR_CONFIGS:?err}/gluetun:/gluetun
    environment:
      - PUID=${PUID:?err}
      - PGID=${PGID:?err}
      - TZ=${TIMEZONE:?err}
      - VPN_SERVICE_PROVIDER=${VPN_SERVICE_PROVIDER:?err}
      - OPENVPN_USER=${VPN_USERNAME}
      - OPENVPN_PASSWORD=${VPN_PASSWORD}
      - FIREWALL_OUTBOUND_SUBNETS=${LOCAL_SUBNET:?err}
      - PORT_FORWARD_ONLY=true
      - VPN_PORT_FORWARDING=on

    healthcheck:
      test: ping -c 1 www.google.com || exit 1
      interval: 60s
      timeout: 20s
      retries: 5
    restart: unless-stopped
    networks:
      - media-network


  deluge:
    image: lscr.io/linuxserver/deluge:latest
    container_name: deluge
    restart: unless-stopped
    volumes:
      - ${FOLDER_FOR_CONFIGS:?err}/deluge:/config
      - ${FOLDER_FOR_MEDIA:?err}:/mnt/data
    labels:
      - deunhealth.restart.on.unhealthy= "true"
    environment:
      - PUID=${PUID:?err}
      - PGID=${PGID:?err}
      - TZ=${TIMEZONE:?err}
    network_mode: service:gluetun
    healthcheck:
        test: ping -c 1 www.google.com || exit 1
        interval: 60s
        retries: 3
        start_period: 20s
        timeout: 10s

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    labels:
      - deunhealth.restart.on.unhealthy= "true"
    environment:
      - PUID=${PUID:?err}
      - PGID=${PGID:?err}
      - TZ=${TIMEZONE:?err}
    volumes:
     - ${FOLDER_FOR_CONFIGS:?err}/prowlarr/data:/config
     - ${FOLDER_FOR_MEDIA:?err}:/mnt/media_root
    restart: unless-stopped
    network_mode: service:gluetun
    healthcheck:
        test: ping -c 1 www.google.com || exit 1
        interval: 60s
        retries: 3
        start_period: 20s
        timeout: 10s

  deunhealth:
    image: qmcgaw/deunhealth
    container_name: deunhealth
    network_mode: "none"
    environment:
      - LOG_LEVEL=info
      - HEALTH_SERVER_ADDRESS=127.0.0.1:9999
      - TZ=Europe/Oslo
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

      

Environment variables

COMPOSE_PROJECT_NAME=media-stack
LOCAL_SUBNET=192.168.1.0/24
FOLDER_FOR_CONFIGS=/mnt/data/app_config
FOLDER_FOR_MEDIA=/mnt/data
PUID=1000
PGID=10000
TIMEZONE=Europe/Oslo
VPN_SERVICE_PROVIDER=private internet access
VPN_USERNAME=****
VPN_PASSWORD=****

[bezdu]

Having the same issue.

on SERVER_REGIONS=Lithuania,Latvia,Estonia

I keep restarting the container untill it catches the endpoint ip.

Also, after few restarts works on SERVER_REGIONS=Poland

I would assume this should work with norway after a few container restarts.

I think the issue is PIA Servers.

[greggameplayer]

Same as my #3286 issue, for me it does that on France,Belgium,DE Frankfurt,Netherlands

[nathank1989]

Same here. This was my config before it broke

  gluetun:
    image: qmcgaw/gluetun:latest
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=private internet access
      - VPN_TYPE=openvpn
      - OPENVPN_USER=***********
      - OPENVPN_PASSWORD=***********
      - SERVER_REGIONS=Israel
      - SERVER_NAMES=jeruselem415
      - SERVER_HOSTNAMES=israel.privacy.network
      - PORT_FORWARD_ONLY=true
      - PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET=normal
      - VPN_ENDPOINT_PORT=1198
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_STATUS_FILE=/tmp/gluetun/forwarded_port
    ports:
      - 10095:8080
      - 6881:6881
      - 6881:6881/udp
    restart: unless-stopped
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: service:gluetun
    environment:
      - PUID=568
      - PGID=568
      - TZ=America/New_York
      - WEBUI_PORT=8080
    volumes:
      - /data/qbittorrent:/config
      - /mnt/torrents/downloads:/downloads
      - /mnt/torrents/incomplete:/incomplete
    restart: unless-stopped
    depends_on:
      gluetun:
        condition: service_healthy
networks: {}

After lots of trial and error, this is what worked for me

  gluetun:
    image: qmcgaw/gluetun:latest
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - VPN_SERVICE_PROVIDER=private internet access
      - VPN_TYPE=openvpn
      - OPENVPN_USER=*******
      - OPENVPN_PASSWORD=*******
      #- SERVER_REGIONS=Israel
      #- SERVER_NAMES=Server-11590-4a
      #- SERVER_HOSTNAMES=israel.pvt.site
      - PORT_FORWARD_ONLY=true
      #- PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET=normal
      #- VPN_ENDPOINT_PORT=8080
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_STATUS_FILE=/tmp/gluetun/forwarded_port
    ports:
      - 10095:8080
      - 6881:6881
      - 6881:6881/udp
    volumes:
      - /data/gluetun:/gluetun
    #command: update -enduser -providers "private internet access"
    restart: unless-stopped
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: service:gluetun
    environment:
      - PUID=568
      - PGID=568
      - TZ=America/New_York
      - WEBUI_PORT=8080
    volumes:
      - /data/qbittorrent:/config
      - /mnt/torrents/downloads:/downloads
      - /mnt/torrents/incomplete:/incomplete
    restart: unless-stopped
    depends_on:
      gluetun:
        condition: service_healthy
networks: {}

So it just connected to the first server it could in Great Britain. For my usecase doesn't really matter, but odd that this was the only way I could revive the tunnel with PIA

[qdm12]

Could it be an issue on PIA's side? Nothing really changed recently on Gluetun's side.

[bezdu]

I found PIA support article that says it was updated recently and something about Handshake updates: Removing OpenVPN Handshake and Authentication Settings

Also I have found similar issue that has been discussed in openssl github here and it has possible solutions

[alternativ]

Could it be an issue on PIA's side? Nothing really changed recently on Gluetun's side.

@qdm12, PIA implemented new ways on getting a port as well, they have renamed and changed their server approach for getting a key. Now you require a token for certain regions (Like Frankfurt and Berlin).

Broken:

2026-04-19T05:50:15Z INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: custom
|   |   ├── Server selection settings:
|   |   |   ├── VPN type: wireguard
|   |   |   ├── Server names: server-12399-1a
|   |   |   └── Wireguard selection settings:
|   |   |       ├── Endpoint IP address: 84.233.216.134
|   |   |       ├── Endpoint port: 1337
|   |   |       └── Server public key: ..
|   |   └── Automatic port forwarding settings:
|   |       ├── Number of ports to be forwarded: 1
|   |       ├── Use code for provider: private internet access
|   |       ├── Forwarded port file path: /tmp/gluetun/forwarded_port

[CUT FOR LONGEVITY]

2026-04-19T05:50:18Z INFO [ip getter] Public IP address is 84.233.216.250 (Germany, Hesse, Frankfurt am Main - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-04-19T05:50:18Z INFO [vpn] You are running on the bleeding edge of latest!
2026-04-19T05:50:23Z ERROR [vpn] starting port forwarding service: port forwarding for the first time: binding port: Get "https://10.237.128.1:19999/bindPort?payload=<payload>&signature=<signature>": context deadline exceeded

Working:

2026-04-19T05:53:18Z INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: custom
|   |   ├── Server selection settings:
|   |   |   ├── VPN type: wireguard
|   |   |   ├── Server names: zurich4xx
|   |   |   └── Wireguard selection settings:
|   |   |       ├── Endpoint IP address: 158.173.x.x
|   |   |       ├── Endpoint port: 1337
|   |   |       └── Server public key: ..
|   |   └── Automatic port forwarding settings:
|   |       ├── Number of ports to be forwarded: 1
|   |       ├── Use code for provider: private internet access
|   |       ├── Forwarded port file path: /tmp/gluetun/forwarded_port

[CUT FOR LONGEVITY]

2026-04-19T05:53:21Z INFO [ip getter] Public IP address is 158.173.x.x(Switzerland, Zurich, Zürich - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-04-19T05:53:21Z INFO [vpn] You are running on the bleeding edge of latest!
2026-04-19T05:53:21Z INFO [port forwarding] starting
2026-04-19T05:53:21Z INFO [port forwarding] Found saved forwarded port data for port xxxx
2026-04-19T05:53:21Z INFO [port forwarding] Port forwarded data expires in 60 days
2026-04-19T05:53:21Z INFO [port forwarding] port forwarded is xxxx
2026-04-19T05:53:21Z INFO [firewall] setting allowed input port xxxx through interface tun0...

[chumleychuff]

Hi - I started getting issues like this 5th April 2026 - this config hadn't been updated since 2023 so pretty good run :)

I thought it was just me - Wireguard config works for me but its a pain because the credentials expire and I have to extract them using the script method (Link Here) :(

Would love to have OpenVPN support back! :)

Here are my logs in case it helps:

{
date | stream | content
-- | -- | --
2026/04/19 13:36:11 | stdout | 2026-04-19T14:36:11+01:00 INFO [openvpn] UDPv4 link remote: [AF_INET]98.159.234.133:1197
2026/04/19 13:36:11 | stdout | 2026-04-19T14:36:11+01:00 INFO [openvpn] UDPv4 link local: (not bound)
2026/04/19 13:36:11 | stdout | 2026-04-19T14:36:11+01:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]98.159.234.133:1197
2026/04/19 13:36:11 | stdout | 2026-04-19T14:36:11+01:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026/04/19 13:36:11 | stdout | 2026-04-19T14:36:11+01:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026/04/19 13:36:11 | stdout | 2026-04-19T14:36:11+01:00 INFO [firewall] allowing VPN connection...
2026/04/19 13:35:56 | stdout | 2026-04-19T14:35:56+01:00 INFO [vpn] retrying in 15s
2026/04/19 13:35:56 | stdout | 2026-04-19T14:35:56+01:00 INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
2026/04/19 13:35:56 | stdout | 2026-04-19T14:35:56+01:00 INFO [openvpn] SIGTERM received, sending exit notification to peer
2026/04/19 13:35:56 | stdout | 2026-04-19T14:35:56+01:00 INFO [openvpn] TLS Error: TLS handshake failed
2026/04/19 13:35:56 | stdout |  
2026/04/19 13:35:56 | stdout | 4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
2026/04/19 13:35:56 | stdout |  
2026/04/19 13:35:56 | stdout | 3. Your Internet connection is not working 🤯, ensure it works
2026/04/19 13:35:56 | stdout |  
2026/04/19 13:35:56 | stdout | 2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
2026/04/19 13:35:56 | stdout |  
2026/04/19 13:35:56 | stdout | Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2026/04/19 13:35:56 | stdout | 1. The VPN server IP address you are trying to connect to is no longer valid 🔌
2026/04/19 13:35:56 | stdout |  
2026/04/19 13:35:56 | stdout | That error usually happens because either:
2026/04/19 13:35:56 | stdout | 🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
2026/04/19 13:35:56 | stdout | 2026-04-19T14:35:56+01:00 WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2026/04/19 13:34:56 | stdout | 2026-04-19T14:34:56+01:00 INFO [openvpn] UDPv4 link remote: [AF_INET]45.133.172.208:1197
2026/04/19 13:34:56 | stdout | 2026-04-19T14:34:56+01:00 INFO [openvpn] UDPv4 link local: (not bound)
2026/04/19 13:34:56 | stdout | 2026-04-19T14:34:56+01:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]45.133.172.208:1197
2026/04/19 13:34:56 | stdout | 2026-04-19T14:34:56+01:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026/04/19 13:34:56 | stdout | 2026-04-19T14:34:56+01:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026/04/19 13:34:56 | stdout | 2026-04-19T14:34:56+01:00 INFO [firewall] allowing VPN connection...
2026/04/19 13:34:41 | stdout | 2026-04-19T14:34:41+01:00 INFO [vpn] retrying in 15s
2026/04/19 13:34:41 | stdout | 2026-04-19T14:34:41+01:00 INFO [openvpn] SIGTERM[soft,tls-error] received, process exiting
2026/04/19 13:34:41 | stdout | 2026-04-19T14:34:41+01:00 INFO [openvpn] SIGTERM received, sending exit notification to peer
2026/04/19 13:34:41 | stdout | 2026-04-19T14:34:41+01:00 INFO [openvpn] TLS Error: TLS handshake failed
2026/04/19 13:34:41 | stdout |  
2026/04/19 13:34:41 | stdout | 4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose
2026/04/19 13:34:41 | stdout |  
2026/04/19 13:34:41 | stdout | 3. Your Internet connection is not working 🤯, ensure it works
2026/04/19 13:34:41 | stdout |  
2026/04/19 13:34:41 | stdout | 2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
2026/04/19 13:34:41 | stdout |  
2026/04/19 13:34:41 | stdout | Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
2026/04/19 13:34:41 | stdout | 1. The VPN server IP address you are trying to connect to is no longer valid 🔌
2026/04/19 13:34:41 | stdout |  
2026/04/19 13:34:41 | stdout | That error usually happens because either:
2026/04/19 13:34:41 | stdout | 🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
2026/04/19 13:34:41 | stdout | 2026-04-19T14:34:41+01:00 WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2026/04/19 13:34:12 | stdout | 2026-04-19T14:34:12+01:00 INFO [openvpn] read UDPv4 [ECONNREFUSED]: Connection refused (fd=3,code=111)
2026/04/19 13:33:56 | stdout | 2026-04-19T14:33:56+01:00 INFO [openvpn] read UDPv4 [ECONNREFUSED]: Connection refused (fd=3,code=111)
2026/04/19 13:33:47 | stdout | 2026-04-19T14:33:47+01:00 INFO [openvpn] read UDPv4 [ECONNREFUSED]: Connection refused (fd=3,code=111)
2026/04/19 13:33:43 | stdout | 2026-04-19T14:33:43+01:00 INFO [openvpn] read UDPv4 [ECONNREFUSED]: Connection refused (fd=3,code=111)
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [openvpn] read UDPv4 [ECONNREFUSED]: Connection refused (fd=3,code=111)
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [openvpn] UDPv4 link remote: [AF_INET]158.173.23.89:1197
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [openvpn] UDPv4 link local: (not bound)
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]158.173.23.89:1197
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [openvpn] library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [firewall] allowing VPN connection...
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [http server] http server listening on [::]:8000
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [healthcheck] listening on xx.0.0.1:9999
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [routing] adding route for xx.xx.50.0/24
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [routing] adding route for xx.20.0.0/16
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [routing] default route found: interface eth0, gateway xx.xx0.0.1, assigned IP 172.20.0.5 and family v4
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [firewall] setting allowed subnets...
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [routing] adding route for 0.0.0.0/0
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO [routing] default route found: interface eth0, gateway xx.xx.0.1, assigned IP xx.xx.0.5 and family v4
2026/04/19 13:33:41 | stdout | └── Enabled: yes
2026/04/19 13:33:41 | stdout | └── Version settings:
2026/04/19 13:33:41 | stdout | \|   └── Providers to update: private internet access
2026/04/19 13:33:41 | stdout | \|   ├── Minimum ratio: 0.8
2026/04/19 13:33:41 | stdout | \|   ├── Update period: 24h0m0s
2026/04/19 13:33:41 | stdout | ├── Server data updater settings:
2026/04/19 13:33:41 | stdout | \|       └── cloudflare
2026/04/19 13:33:41 | stdout | \|       ├── ip2location
2026/04/19 13:33:41 | stdout | \|       ├── ifconfigco
2026/04/19 13:33:41 | stdout | \|   └── Public IP data backup APIs:
2026/04/19 13:33:41 | stdout | \|   ├── Public IP data base API: ipinfo
2026/04/19 13:33:41 | stdout | \|   ├── IP file path: /tmp/gluetun/ip
2026/04/19 13:33:41 | stdout | ├── Public IP settings:
2026/04/19 13:33:41 | stdout | \|   └── Timezone: gb
2026/04/19 13:33:41 | stdout | \|   ├── Process GID: 100
2026/04/19 13:33:41 | stdout | \|   ├── Process UID: 1027
2026/04/19 13:33:41 | stdout | ├── OS Alpine settings:
2026/04/19 13:33:41 | stdout | \|   └── Filepath: /gluetun/servers.json
2026/04/19 13:33:41 | stdout | ├── Storage settings:
2026/04/19 13:33:41 | stdout | \|   └── Authentication file path: /gluetun/auth/config.toml
2026/04/19 13:33:41 | stdout | \|   ├── Logging: yes
2026/04/19 13:33:41 | stdout | \|   ├── Listening address: :8000
2026/04/19 13:33:41 | stdout | ├── Control server settings:
2026/04/19 13:33:41 | stdout | \|   └── Enabled: no
2026/04/19 13:33:41 | stdout | ├── HTTP proxy settings:
2026/04/19 13:33:41 | stdout | \|   └── Enabled: no
2026/04/19 13:33:41 | stdout | ├── Shadowsocks server settings:
2026/04/19 13:33:41 | stdout | \|   └── Restart VPN on healthcheck failure: yes
2026/04/19 13:33:41 | stdout | \|   \|       └── 8.8.8.8
2026/04/19 13:33:41 | stdout | \|   \|       ├── 1.1.1.1
2026/04/19 13:33:41 | stdout | \|   \|   └── ICMP target IPs:
2026/04/19 13:33:41 | stdout | \|   ├── Small health check type: ICMP echo request
2026/04/19 13:33:41 | stdout | \|   \|   └── github.com:443
2026/04/19 13:33:41 | stdout | \|   \|   ├── cloudflare.com:443
2026/04/19 13:33:41 | stdout | \|   ├── Target addresses:
2026/04/19 13:33:41 | stdout | \|   ├── Server listening address: 127.0.0.1:9999
2026/04/19 13:33:41 | stdout | ├── Health settings:
2026/04/19 13:33:41 | stdout | \|   └── Log level: info
2026/04/19 13:33:41 | stdout | ├── Log settings:
2026/04/19 13:33:41 | stdout | \|       └── xx.xx.xx.0/24
2026/04/19 13:33:41 | stdout | \|       ├── xx.xx.0.0/16
2026/04/19 13:33:41 | stdout | \|   └── Outbound subnets:
2026/04/19 13:33:41 | stdout | \|   \|   └── Log level: info
2026/04/19 13:33:41 | stdout | \|   ├── Iptables settings:
2026/04/19 13:33:41 | stdout | \|   ├── Enabled: yes
2026/04/19 13:33:41 | stdout | ├── Firewall settings:
2026/04/19 13:33:41 | stdout | \|       └── Block surveillance: no
2026/04/19 13:33:41 | stdout | \|       ├── Block ads: no
2026/04/19 13:33:41 | stdout | \|       ├── Block malicious: yes
2026/04/19 13:33:41 | stdout | \|   └── DNS filtering settings:
2026/04/19 13:33:41 | stdout | \|   ├── Update period: every 24h0m0s
2026/04/19 13:33:41 | stdout | \|   ├── IPv6: no
2026/04/19 13:33:41 | stdout | \|   ├── Caching: yes
2026/04/19 13:33:41 | stdout | \|   \|   └── Cloudflare
2026/04/19 13:33:41 | stdout | \|   ├── Upstream resolvers:
2026/04/19 13:33:41 | stdout | \|   ├── Upstream resolver type: dot
2026/04/19 13:33:41 | stdout | ├── DNS settings:
2026/04/19 13:33:41 | stdout | \|           └── [2001:4860:4860::8888]:443
2026/04/19 13:33:41 | stdout | \|           ├── [2606:4700:4700::1111]:443
2026/04/19 13:33:41 | stdout | \|           ├── [2001:4860:4860::8888]:53
2026/04/19 13:33:41 | stdout | \|           ├── [2606:4700:4700::1111]:53
2026/04/19 13:33:41 | stdout | \|           ├── 8.8.8.8:53
2026/04/19 13:33:41 | stdout | \|           ├── 1.1.1.1:53
2026/04/19 13:33:41 | stdout | \|           ├── 8.8.8.8:443
2026/04/19 13:33:41 | stdout | \|           ├── 1.1.1.1:443
2026/04/19 13:33:41 | stdout | \|       └── TCP addresses:
2026/04/19 13:33:41 | stdout | \|       \|   └── 8.8.8.8
2026/04/19 13:33:41 | stdout | \|       \|   ├── 1.1.1.1
2026/04/19 13:33:41 | stdout | \|       ├── ICMP addresses:
2026/04/19 13:33:41 | stdout | \|   └── Path MTU discovery:
2026/04/19 13:33:41 | stdout | \|   \|   └── Verbosity level: 1
2026/04/19 13:33:41 | stdout | \|   \|   ├── Run OpenVPN as: root
2026/04/19 13:33:41 | stdout | \|   \|   ├── Network interface: tun0
2026/04/19 13:33:41 | stdout | \|   \|   ├── Private Internet Access encryption preset: strong
2026/04/19 13:33:41 | stdout | \|   \|   ├── Password: [set]
2026/04/19 13:33:41 | stdout | \|   \|   ├── User: [set]
2026/04/19 13:33:41 | stdout | \|   \|   ├── OpenVPN version: 2.6
2026/04/19 13:33:41 | stdout | \|   ├── OpenVPN settings:
2026/04/19 13:33:41 | stdout | \|   \|           └── Private Internet Access encryption preset: strong
2026/04/19 13:33:41 | stdout | \|   \|           ├── Protocol: UDP
2026/04/19 13:33:41 | stdout | \|   \|       └── OpenVPN server selection settings:
2026/04/19 13:33:41 | stdout | \|   \|       ├── Regions: uk london, uk manchester, uk southampton
2026/04/19 13:33:41 | stdout | \|   \|       ├── VPN type: openvpn
2026/04/19 13:33:41 | stdout | \|   \|   └── Server selection settings:
2026/04/19 13:33:41 | stdout | \|   \|   ├── Name: private internet access
2026/04/19 13:33:41 | stdout | \|   ├── VPN provider settings:
2026/04/19 13:33:41 | stdout | ├── VPN settings:
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO Settings summary:
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO Firewall version: iptables v1.8.11
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:41+01:00 INFO OpenVPN version: 2.6.16
2026/04/19 13:33:41 | stdout | 2026-04-19T14:33:40+01:00 INFO Alpine version: 3.23.3
2026/04/19 13:33:40 | stdout | 2026-04-19T14:33:40+01:00 INFO [storage] merging by most recent 20646 hardcoded servers and 20646 servers read from /gluetun/servers.json
2026/04/19 13:33:39 | stdout | 2026-04-19T14:33:39+01:00 WARN flushing conntrack failed: querying netlink request: netfilter query: netlink receive: invalid argument
2026/04/19 13:33:39 | stdout | 2026-04-19T14:33:39+01:00 INFO [firewall] enabled successfully
2026/04/19 13:33:39 | stdout | 2026-04-19T14:33:39+01:00 INFO [firewall] enabling...
2026/04/19 13:33:38 | stdout | 2026-04-19T14:33:38+01:00 INFO [routing] local ipnet found: xx.xx.0.0/16
2026/04/19 13:33:38 | stdout | 2026-04-19T14:33:38+01:00 INFO [routing] local ethernet link found: eth0
2026/04/19 13:33:38 | stdout | 2026-04-19T14:33:38+01:00 INFO [routing] default route found: interface eth0, gateway xx.20.0.1, assigned IP xx.20.0.5 and family v4
2026/04/19 13:33:38 | stdout | 💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2026/04/19 13:33:38 | stdout | 💻 Email? quentin.mcgaw@gmail.com
2026/04/19 13:33:38 | stdout | 🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
2026/04/19 13:33:38 | stdout | 🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
2026/04/19 13:33:38 | stdout |  
2026/04/19 13:33:38 | stdout | 📣 Set BORINGPOLL_GLUETUNCOM=on to help combat AI slop and shutdown that scam website
2026/04/19 13:33:38 | stdout |  
2026/04/19 13:33:38 | stdout | Running version latest built on 2026-04-03T12:39:51.234Z (commit 1ae85aa) on Linux 4.4.302+ (x86_64)
2026/04/19 13:33:38 | stdout |  
2026/04/19 13:33:38 | stdout | ========================================
2026/04/19 13:33:38 | stdout | ========================================
2026/04/19 13:33:38 | stdout | ======= https://github.com/qdm12 =======
2026/04/19 13:33:38 | stdout | =========== Made with ❤️ by ============
2026/04/19 13:33:38 | stdout | ========================================
2026/04/19 13:33:38 | stdout | =============== gluetun ================
2026/04/19 13:33:38 | stdout | ========================================
2026/04/19 13:33:38 | stdout | ========================================
}

Here are my docker settings:

{

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    #image: qmcgaw/gluetun:v3.41.0
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - #redacted#
    volumes:
      - /volume1/docker/gluetun:/gluetun
      - /volume1/docker/gluetun/wireguard/wg0.conf:/gluetun/wireguard/wg0.conf:ro
    environment:
      - PUID=#redacted#
      - PGID=#redacted#
      - TZ=#redacted#
      #OpenVPN Section
      - VPN_SERVICE_PROVIDER=private internet access
      - VPN_TYPE=openvpn
      - OPENVPN_USER=xxxx
      - OPENVPN_PASSWORD=xxxx
      - SERVER_REGIONS=UK London,UK Manchester,UK Southampton
      #- SERVER_COUNTRIES=VPNSERVERCOUNTRY
      #End of OpenVPN Section
      #Wireguard Section
      #- VPN_SERVICE_PROVIDER=custom
      #- VPN_TYPE=wireguard
      #End of Wireguard Section
      - HTTPPROXY=off
      - SHADOWSOCKS=off
      - FIREWALL_OUTBOUND_SUBNETS=xx.xx.0.0/16,xx.xx.xx.0/24
     #- FIREWALL_VPN_INPUT_PORTS=12345
      - UPDATER_PERIOD=24h
    network_mode: synobridge
    labels:
      - com.centurylinklabs.watchtower.enable=false
    security_opt:
      - no-new-privileges:true
    restart: always

#redacted#
}