Bug: DNS upstream set as local plain address but cloudflare still being used

[sfxdude]

Is this urgent?

None

Host OS

Debian Buster

CPU arch

x86_64

VPN service provider

AirVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-03-11T20:49:21.026Z (commit b5b0e01) on Linux 6.12.73+deb13-amd64 (x86_64)

What's the problem 🤔

I have the following relevant config items set in my docker-compose:

      - DNS_UPSTREAM_RESOLVER_TYPE=plain
      - DNS_UPSTREAM_PLAIN_ADDRESSES=192.168.30.2:53

      - FIREWALL_OUTBOUND_SUBNETS=192.168.0.0/16

(this seems the only things I should need to enable entirely local based DNS resolution based on the latest wiki?)

This is the relevant section from the container startup:

gluetun-1 | ├── DNS settings:
gluetun-1 | | ├── Upstream resolver type: plain
gluetun-1 | | ├── Upstream resolvers:
gluetun-1 | | | └── 192.168.30.2:53
gluetun-1 | | ├── Caching: no
gluetun-1 | | ├── IPv6: no
gluetun-1 | | ├── Update period: every 24h0m0s
gluetun-1 | | └── DNS filtering settings:
gluetun-1 | | ├── Block malicious: yes
gluetun-1 | | ├── Block ads: no
gluetun-1 | | └── Block surveillance: no
gluetun-1 | ├── Firewall settings:
gluetun-1 | | ├── Enabled: yes
gluetun-1 | | ├── VPN input ports:
gluetun-1 | | | └── 23797
gluetun-1 | | └── Outbound subnets:
gluetun-1 | | └── 192.168.0.0/16

However the container never queries the upstream server located at 192.168.30.2:53.

Connecting a HTTP proxy to the container I can see cloudflare DNS shown as being used at https://ipleak.net

I've connected wbitt/network-multitool to the stack and it does seem that it is ignoring that upstream resolver.

From network-multiool connected to gluetuns network:

/ # dig +short pve1.internal @192.168.30.2
192.168.1.51
/ # dig +short pve1.internal
/ # 

Share your logs (at least 10 lines)

gluetun-1  | ├── DNS settings:
gluetun-1  | |   ├── Upstream resolver type: plain
gluetun-1  | |   ├── Upstream resolvers:
gluetun-1  | |   |   └── 192.168.30.2:53
gluetun-1  | |   ├── Caching: no
gluetun-1  | |   ├── IPv6: no
gluetun-1  | |   ├── Update period: every 24h0m0s
gluetun-1  | |   └── DNS filtering settings:
gluetun-1  | |       ├── Block malicious: yes
gluetun-1  | |       ├── Block ads: no
gluetun-1  | |       └── Block surveillance: no
gluetun-1  | ├── Firewall settings:
gluetun-1  | |   ├── Enabled: yes
gluetun-1  | |   ├── VPN input ports:
gluetun-1  | |   |   └── 23797
gluetun-1  | |   └── Outbound subnets:
gluetun-1  | |       └── 192.168.0.0/16

Share your configuration

- DNS_UPSTREAM_RESOLVER_TYPE=plain
      - DNS_UPSTREAM_PLAIN_ADDRESSES=192.168.30.2:53

      - FIREWALL_OUTBOUND_SUBNETS=192.168.0.0/16

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[leo15dev]

Did your DNS upstream DNS Server is clouflare? When I test with ipleak.net with VPN , it will showed the upstream server which I used in the DNS server (AdGuardHome).

[sfxdude]

Did your DNS upstream DNS Server is clouflare? When I test with ipleak.net with VPN , it will showed the upstream server which I used in the DNS server (AdGuardHome).

No, the upstream is unbound recursive. I can see from the logs that glutun never queries it.

[qdm12]

Ah i think i know why: (edit: this might not work) try setting DNS_UPSTREAM_RESOLVERS= - since it defaults to cloudflare, it then gets merged with your lan ip so half of requests go to cloudflare, the other half to your lan. I guess setting DNS_UPSTREAM_PLAIN_ADDRESSES should override instead or add to the list

Edit: afk over the weekend, I'll fix this Monday

[sfxdude]

Ah i think i know why: (edit: this might not work) try setting DNS_UPSTREAM_RESOLVERS= - since it defaults to cloudflare, it then gets merged with your lan ip so half of requests go to cloudflare, the other half to your lan. I guess setting DNS_UPSTREAM_PLAIN_ADDRESSES should override instead or add to the list

Edit: afk over the weekend, I'll fix this Monday

Have added 'DNS_UPSTREAM_RESOLVERS=' to environment: but it seems to make no difference: ipleak still shows cloudflare DNS.

[sfxdude]

Further info: I think you're correct, cloudflare DNS is appended to whatever is in 'DNS_UPSTREAM_PLAIN_ADDRESSES' so I can see it querying the unbound server on 192.168.30.2 every so often.

However I'm finding it hard to diagnose the next problem: these internal domain resolutions are getting REFUSED responses from the (gluetun?) DNS server/forwarder - I assume this is some sort of DNSSEC/private domain issue but this is outside my ability to diagnose. As far I can tell the unbound server is responding correctly to the forwarder.

As you can tell this is all with the aim of getting internal DNS resolution working correctly within the gluetun stack.

[leo15dev]

To fetch data about detected DNS in json format (replace [session] with a random hash (40 chars long) and [random] with random chars every request). Perform many request with same [session] and different [random] to populate.

https://[session]-[random].ipleak.net/dnsdetection/

docker run -it --rm --network=container:gluetun(e.g. windscribe for this test) alpine:3.22 /bin/sh -c "apk add curl && curl https://hash-test01.ipleak.net/dnsdetection/"

got

{
    "session": "hash",
    "ip": {
        "Upstream DNS in AdGuradHome (e.g. NextDNS)": 2,
        "VPN DNS": 2,
        "Cloudflare DNS": 1,
        "Upstream DNS in AdGuradHome (e.g. Google DNS)": 1,
        "Upstream DNS in AdGuradHome (e.g. Google DNS)": 1
    }

AdGuardHome set in DNS_UPSTREAM_RESOLVERS

[geonon436]

See the issue I just closed for more context, but I'm running into the same issue. gluetun is not respecting the plain-text DNS server I'm specifying.

If I attach to the gluetun container, install bind-tools (apk add bind-tools), and run dig domain.com @192.168.50.200 -p 5353 I get the correct response. So my Dnsmasq instance is reachable by the gluetun container, but gluetun is not sending it DNS queries despite the seemingly proper configuration.

[geonon436]

I guess setting DNS_UPSTREAM_PLAIN_ADDRESSES should override instead or add to the list

This would work best for my use case, I want a method of setting a DNS address that 100% of traffic runs through. Though others may have different use cases. Perhaps a separate variable or boolean to specify that you want to replace the DNS server list as opposed to prepend/append to it would be best?