Bug: Default BLOCK_MALICIOUS option (on) blocking hosts/domains that are safe/it used not to.

[kpupp]

Is this urgent?

No

Host OS

Ubuntu

CPU arch

x86_64

VPN service provider

Private Internet Access

What are you using to run the container

docker-compose

What is the version of Gluetun

2025-09-11T19:17:25.911Z (commit 075cbd5)

What's the problem 🤔

Leaving BLOCK_MALICIOUS on is blocking some legitimate domains/hosts (in my case, Milkie.cc). I only found that 1) this can be disabled and 2) should be after some extensive googling that this was mentioned somewhere offhand on Discord (where to even find the Discord???).

I'd much rather not disable protection and security features to have proper use of a program - @qdm12 are there any updates that have been/can be made to the block list, perhaps with some crowdsourced help? I'd also rather not see critical information (such as blocklists having false positives) hidden behind discord's non-indexed walled garden - I'm tired of joining discord servers for simple requests.

Share your logs (at least 10 lines)

Running version latest built on 2025-09-11T19:17:25.911Z (commit 075cbd5)

🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12

2025-09-19T17:57:24-05:00 INFO [routing] local ethernet link found: eth0

2025-09-19T17:57:24-05:00 INFO [firewall] enabling...
2025-09-19T17:57:24-05:00 INFO [firewall] enabled successfully
2025-09-19T17:57:24-05:00 INFO [storage] merging by most recent 20776 hardcoded servers and 20776 servers read from /gluetun/servers.json
2025-09-19T17:57:25-05:00 INFO Alpine version: 3.20.7
2025-09-19T17:57:25-05:00 INFO OpenVPN 2.5 version: 2.5.10
2025-09-19T17:57:25-05:00 INFO OpenVPN 2.6 version: 2.6.11
2025-09-19T17:57:25-05:00 INFO IPtables version: v1.8.10
2025-09-19T17:57:25-05:00 INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: private internet access
|   |   ├── Server selection settings:
|   |   |   ├── VPN type: openvpn
|   |   |   ├── Regions: ca ontario, greenland
|   |   |   ├── Port forwarding only servers: yes
|   |   |   └── OpenVPN server selection settings:
|   |   |       ├── Protocol: UDP
|   |   |       └── Private Internet Access encryption preset: strong
|   |   └── Automatic port forwarding settings:
|   |       ├── Redirection listening port: disabled
|   |       ├── Use port forwarding code for current provider
|   |       ├── Forwarded port file path: /gluetun/forwarded_port
|   |       └── Credentials:

|   └── OpenVPN settings:
|       ├── OpenVPN version: 2.6
|       ├── User: [set]
|       ├── Password: [set]
|       ├── Private Internet Access encryption preset: strong
|       ├── Network interface: tun0
|       ├── Run OpenVPN as: root
|       └── Verbosity level: 1
├── DNS settings:
|   ├── Keep existing nameserver(s): no
|   ├── DNS server address to use: 127.0.0.1
|   └── DNS over TLS settings:
|       ├── Enabled: yes
|       ├── Update period: every 24h0m0s
|       ├── Upstream resolvers:
|       |   └── cloudflare
|       ├── Caching: yes
|       ├── IPv6: no
|       └── DNS filtering settings:
|           ├── Block malicious: no
|           ├── Block ads: no
|           ├── Block surveillance: no
|           └── Blocked IP networks:
|               ├── 127.0.0.1/8
|               ├── 10.0.0.0/8
|               ├── 172.16.0.0/12
|               ├── 192.168.0.0/16
|               ├── 169.254.0.0/16
|               ├── ::1/128
|               ├── fc00::/7
|               ├── fe80::/10
|               ├── ::ffff:127.0.0.1/104
|               ├── ::ffff:10.0.0.0/104
|               ├── ::ffff:169.254.0.0/112
|               ├── ::ffff:172.16.0.0/108
|               └── ::ffff:192.168.0.0/112
├── Firewall settings:
|   └── Enabled: yes
├── Log settings:
|   └── Log level: info
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: cloudflare.com:443
|   ├── Duration to wait after success: 5s
|   ├── Read header timeout: 100ms
|   ├── Read timeout: 500ms
|   └── VPN wait durations:
|       ├── Initial duration: 6s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 1000
|   ├── Process GID: 1000
|   └── Timezone: america/chicago
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
└── Version settings:
    └── Enabled: yes
2025-09-19T17:57:25-05:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2025-09-19T17:57:25-05:00 INFO [routing] adding route for 0.0.0.0/0
2025-09-19T17:57:25-05:00 INFO [firewall] setting allowed subnets...
2025-09-19T17:57:25-05:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
2025-09-19T17:57:25-05:00 INFO [dns] using plaintext DNS at address 1.1.1.1
2025-09-19T17:57:25-05:00 INFO [http server] http server listening on [::]:8000
2025-09-19T17:57:25-05:00 INFO [healthcheck] listening on 127.0.0.1:9999
2025-09-19T17:57:25-05:00 INFO [firewall] allowing VPN connection...
2025-09-19T17:57:25-05:00 INFO [openvpn] OpenVPN 2.6.11 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2025-09-19T17:57:25-05:00 INFO [openvpn] library versions: OpenSSL 3.3.4 1 Jul 2025, LZO 2.10
2025-09-19T17:57:25-05:00 INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]91.90.120.201:1197
2025-09-19T17:57:25-05:00 INFO [openvpn] UDPv4 link local: (not bound)
2025-09-19T17:57:25-05:00 INFO [openvpn] UDPv4 link remote: [AF_INET]91.90.120.201:1197
2025-09-19T17:57:25-05:00 INFO [openvpn] [greenland407] Peer Connection Initiated with [AF_INET]91.90.120.201:1197
2025-09-19T17:57:25-05:00 INFO [openvpn] TUN/TAP device tun0 opened
2025-09-19T17:57:25-05:00 INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2025-09-19T17:57:25-05:00 INFO [openvpn] /sbin/ip link set dev tun0 up
2025-09-19T17:57:25-05:00 INFO [openvpn] /sbin/ip addr add dev tun0 10.11.110.42/24
2025-09-19T17:57:25-05:00 INFO [openvpn] UID set to nonrootuser
2025-09-19T17:57:25-05:00 INFO [openvpn] Initialization Sequence Completed
2025-09-19T17:57:25-05:00 INFO [dns] downloading hostnames and IP block lists
2025-09-19T17:57:25-05:00 INFO [dns] DNS server listening on [::]:53
2025-09-19T17:57:25-05:00 INFO [healthcheck] healthy!
2025-09-19T17:57:25-05:00 INFO [dns] ready
2025-09-19T17:57:26-05:00 INFO [ip getter] Public IP address is 91.90.120.201 (Canada, Quebec, Montréal - source: ipinfo)
2025-09-19T17:57:26-05:00 INFO [vpn] You are running 1 commit behind the most recent latest
2025-09-19T17:57:26-05:00 INFO [port forwarding] starting
2025-09-19T17:57:26-05:00 INFO [port forwarding] Found saved forwarded port data for port 59431
2025-09-19T17:57:26-05:00 INFO [port forwarding] Port forwarded data expires in 8 days
2025-09-19T17:57:26-05:00 INFO [port forwarding] port forwarded is 59431
2025-09-19T17:57:26-05:00 INFO [firewall] setting allowed input port 59431 through interface tun0...
2025-09-19T17:57:26-05:00 INFO [port forwarding] writing port file /gluetun/forwarded_port
2025-09-19T18:00:21-05:00 INFO [healthcheck] healthy!
2025-09-19T18:00:35-05:00 INFO [healthcheck] healthy!
2025-09-19T18:00:37-05:00 INFO [healthcheck] healthy!
2025-09-19T18:00:47-05:00 INFO [healthcheck] healthy!
2025-09-19T18:01:02-05:00 INFO [healthcheck] healthy!
2025-09-19T18:01:22-05:00 INFO [healthcheck] healthy!
2025-09-19T18:01:36-05:00 INFO [healthcheck] healthy!
2025-09-19T18:01:50-05:00 INFO [healthcheck] healthy!
2025-09-19T18:01:52-05:00 INFO [healthcheck] healthy!
2025-09-19T18:02:35-05:00 INFO [healthcheck] healthy!
2025-09-19T18:03:03-05:00 INFO [healthcheck] healthy!
2025-09-19T18:03:29-05:00 INFO [healthcheck] healthy!
2025-09-19T18:03:32-05:00 WARN [dns] dialing tls server for request IN A cloudflare.com.: context deadline exceeded

Share your configuration

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[qdm12]

The malicious hostnames list is built by this function from different URL sources, every 24h. I'm always happy to get some PRs on https://github.com/qdm12/updated for example qdm12/updated#7 (comment) was commented yesterday, it could be nice to add more sources 😉

Milkie.cc does not seem to be part of that list today, so that should be fixed. Note you can also use UNBLOCK=milkie.cc (documented here) - I have no idea what that Discord is either.

[github-actions]

Closed issues are NOT monitored, so commenting here is likely to be not seen.
If you think this is still unresolved and have more information to bring, please create another issue.

This is an automated comment setup because @qdm12 is the sole maintainer of this project
which became too popular to monitor issues closed.