Bug: Port Forwarding is Dropped Shortly After Startup

[finevan]

Is this urgent?

None

Host OS

Ubuntu 26.04 LTS vis Proxmox 9.2.3

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-06-11T14:13:22.901Z (commit 8abb055) on Linux 7.0.6-2-pve (x86_64)

What's the problem 🤔

Gluetun appears to start correctly with port forwarding, however after a couple minutes attempts to connect time out as I assume the nat-pmp lease expires.

This is a regression from qmcgaw/gluetun@sha256:5665416a97ad2823dda6986a581b8913cc3af1b196ac768f5130abad4b0d4f62 (Running version latest built on 2026-06-04T18:40:28.993Z (commit ff6e45f) on Linux 7.0.6-2-pve (x86_64)) which I can pin, and works as expected.

Running with debug logging enabled, the closest thing to a smoking gun that I see is these lines when things are working correctly, which do not appear when running latest:

DEBUG [port forwarding] refreshing forwarded ports since 45 seconds have elapsed
DEBUG [port forwarding] port forwarded 44013 maintained

Note: I attempted to switch from the kernel wireguard implementation to the userspace implementation using WIREGUARD_IMPLEMENTATION=userspace, which I verified in the logs was used, however the failure was still present.

Share your logs (at least 10 lines)

2026-06-13T15:08:27Z INFO [wireguard] Using available kernelspace implementation
2026-06-13T15:08:27Z INFO [wireguard] Connecting to <wg-ip>:<wg-port>
2026-06-13T15:08:27Z DEBUG [netlink] ip -f inet rule add lookup <wg-port> pref 101
2026-06-13T15:08:27Z INFO [vpn] wireguard setup is complete. Note wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the wireguard connection is not working.
2026-06-13T15:08:27Z DEBUG [dns] filter updated: 0 hostnames, 0 IPs, 0 IP prefixes blocked
2026-06-13T15:08:27Z INFO [dns] DNS server listening on [::]:53
2026-06-13T15:08:27Z INFO [dns] ready and using DNS server with dot upstream resolvers
2026-06-13T15:08:27Z INFO [dns] downloading hostnames and IP block lists
2026-06-13T15:08:27Z DEBUG [dns] filter updated: 0 hostnames, 0 IPs, 0 IP prefixes blocked
2026-06-13T15:08:28Z INFO [port forwarding] starting
2026-06-13T15:08:28Z DEBUG [port forwarding] gateway external IPv4 address is <wg-exit-ip>
2026-06-13T15:08:28Z INFO [port forwarding] port forwarded is 54582
2026-06-13T15:08:28Z INFO [firewall] setting allowed input port 54582 through interface tun0...
2026-06-13T15:08:28Z INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2026-06-13T15:08:30Z INFO [dns] leak check report: 162.158.77.14 (20%), 104.23.212.40 (12%), 172.70.173.220 (12%), 172.70.33.19 (12%), 172.70.41.143 (12%), 104.22.106.42 (10%), 172.68.246.43 (10%), 172.70.133.246 (8%), 172.71.221.192 (8%)
2026-06-13T15:08:30Z INFO [port forwarding] Updated listening port 54582
2026-06-13T15:40:33Z DEBUG [healthcheck] ICMP echo attempt 1/10 failed: timed out waiting for ICMP echo reply from 1.1.1.1

Share your configuration

services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - ./gluetun:/gluetun
    environment:
      - LOG_LEVEL=debug
      - UPDATER_PREFER_DIRECT_DOWNLOAD=yes
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_MTU=1280
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on
      - WIREGUARD_PRIVATE_KEY=[SNIP]
      - WIREGUARD_ADDRESSES=10.2.0.2/32
      - WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
      - TZ=Etc/UTC
      - SERVER_COUNTRIES=United States
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c '[SNIP] || true'
      - FIREWALL_OUTBOUND_SUBNETS=192.168.[SNIP]/32
      - BLOCK_MALICIOUS=off
      - BLOCK_SURVEILLANCE=off
      - BLOCK_ADS=off
      - DNS_REBINDING_PROTECTION_EXEMPT_HOSTNAMES=*.[SNIP]
      - VERSION_INFORMATION=off
      - PUBLICIP_ENABLED=false
    restart: unless-stopped

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[github-actions]

Closed issues are NOT monitored, so commenting here will likely NOT be seen.
If you think this is still unresolved and have more information to bring, please either
re-open this issue or create another issue.

❤️😠 temporarily help the Gluetun community and fight the AI slop scam website gluetun[dot]com by setting BORINGPOLL_GLUETUNCOM=on on the latest image.
See the option in the wiki for more information

This is an automated comment setup because @qdm12 is the sole maintainer of this project
which became too popular to monitor closed issues.

[qdm12]

Whoops indeed, thanks for nailing down the regression commits. It was due to a "fix" that actually was borked, which is fixed in 52a41cb