Bug: Port forwarding loop crashed

[ColinHebert]

Is this urgent?

Yes

Host OS

Synology (not relevant)

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

commit d3c7d3c ·

What's the problem 🤔

Port forwarding loop crashes when attempting to parse an iptables call.

Share your logs (at least 10 lines)

2025-10-31T06:12:27Z INFO [port forwarding] starting
2025-10-31T06:12:27Z INFO [port forwarding] gateway external IPv4 address is 180.149.229.132
2025-10-31T06:12:27Z INFO [port forwarding] port forwarded is 63499
2025-10-31T06:12:27Z INFO [firewall] setting allowed input port 63499 through interface tun0...
2025-10-31T06:12:27Z DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -i tun0 -p tcp -m tcp --dport 63499 -j ACCEPT
2025-10-31T06:12:27Z DEBUG [firewall] /usr/sbin/ip6tables-legacy --append INPUT -i tun0 -p tcp -m tcp --dport 63499 -j ACCEPT
2025-10-31T06:12:27Z DEBUG [firewall] /usr/sbin/iptables-legacy --append INPUT -i tun0 -p udp -m udp --dport 63499 -j ACCEPT
2025-10-31T06:12:27Z DEBUG [firewall] /usr/sbin/ip6tables-legacy --append INPUT -i tun0 -p udp -m udp --dport 63499 -j ACCEPT
2025-10-31T06:12:27Z INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2025-10-31T06:12:27Z INFO [port forwarding] --2025-10-31 06:12:27--  http://127.0.0.1:8080/api/v2/app/setPreferences
2025-10-31T06:12:27Z INFO [port forwarding] Connecting to 127.0.0.1:8080... connected.
2025-10-31T06:12:27Z INFO [port forwarding] HTTP request sent, awaiting response... 200 OK
2025-10-31T06:12:27Z INFO [port forwarding] Length: 0 [text/plain]
2025-10-31T06:12:27Z INFO [port forwarding] Saving to: 'STDOUT'
2025-10-31T06:12:27Z INFO [port forwarding] 
2025-10-31T06:12:27Z INFO [port forwarding]      0K                                                        0.00 =0s
2025-10-31T06:12:27Z INFO [port forwarding] 
2025-10-31T06:12:28Z WARN [http server] route GET /v1/vpn/status is unprotected by default, please set up authentication following the documentation at https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/control-server.md#authentication since this will become no longer publicly accessible after release v3.40.
2025-10-31T06:12:28Z DEBUG [http server] access to route GET /v1/vpn/status authorized for role public
2025-10-31T06:12:28Z INFO [http server] 200 GET /status wrote 21B to 127.0.0.1:51526 in 461.169µs
2025-10-31T06:13:12Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:13:12Z DEBUG [port forwarding] port forwarded 63499 maintained
2025-10-31T06:13:57Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:13:57Z DEBUG [port forwarding] port forwarded 63499 maintained
2025-10-31T06:14:42Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:14:42Z DEBUG [port forwarding] port forwarded 63499 maintained
2025-10-31T06:15:27Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:15:27Z DEBUG [port forwarding] port forwarded 63499 maintained
2025-10-31T06:16:12Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:16:12Z DEBUG [port forwarding] port forwarded 63499 maintained
2025-10-31T06:16:57Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:16:57Z DEBUG [port forwarding] port forwarded 63499 maintained
2025-10-31T06:17:42Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:17:42Z DEBUG [port forwarding] port forwarded 63499 maintained
2025-10-31T06:18:27Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:18:27Z DEBUG [port forwarding] port forwarded 63499 maintained
2025-10-31T06:19:12Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:19:12Z DEBUG [port forwarding] port forwarded 63499 maintained
2025-10-31T06:19:57Z DEBUG [port forwarding] refreshing port forward since 45 seconds have elapsed
2025-10-31T06:19:57Z INFO [firewall] removing allowed port 63499...
2025-10-31T06:19:57Z DEBUG [firewall] /usr/sbin/iptables-legacy -t filter -L INPUT --line-numbers -n -v
2025-10-31T06:19:57Z ERROR [port forwarding] external port changed: 63499 changed to 40762
2025-10-31T06:19:57Z INFO [port forwarding] stopping
2025-10-31T06:19:57Z INFO [firewall] removing allowed port 63499...
2025-10-31T06:19:57Z DEBUG [firewall] /usr/sbin/iptables-legacy -t filter -L INPUT --line-numbers -n -v
2025-10-31T06:19:57Z ERROR port forwarding loop crashed: stopping previous service: blocking previous port in firewall: removing allowed port 63499 on interface tun0: finding iptables chain rule line number: parsing chain list: parsing chain rule "1     2230  211K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           ": parsing chain rule field: parsing protocol: unknown protocol: all
2025-10-31T06:19:57Z INFO dns ticker: terminated ✔️
2025-10-31T06:19:57Z INFO updater ticker: terminated ✔️
2025-10-31T06:19:57Z INFO http server: terminated ✔️
2025-10-31T06:19:57Z INFO control: terminated ✔️
2025-10-31T06:19:57Z INFO updater: terminated ✔️
2025-10-31T06:19:57Z INFO tickers: terminated ✔️
2025-10-31T06:19:57Z INFO HTTP health server: terminated ✔️
2025-10-31T06:19:58Z WARN vpn: goroutine shutdown timed out: after 1s ⚠️
2025-10-31T06:19:58Z INFO shadowsocks proxy: terminated ✔️
2025-10-31T06:19:58Z INFO http proxy: terminated ✔️
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x88 pc=0x9e65e2]

goroutine 88 [running]:
internal/sync.(*Mutex).Lock(...)
        internal/sync/mutex.go:63
sync.(*Mutex).Lock(...)
        sync/mutex.go:46
github.com/qdm12/dns/v2/pkg/server.(*Server).Stop(0x0)
        github.com/qdm12/dns/v2@v2.0.0-rc8/pkg/server/server.go:149 +0x42
github.com/qdm12/gluetun/internal/dns.(*Loop).stopServer(0xc0002641b0)
        github.com/qdm12/gluetun/internal/dns/run.go:102 +0x1c
github.com/qdm12/gluetun/internal/dns.(*Loop).runWait(0xc0002641b0, {0x14ee778, 0xc00023ee60}, 0x0)
        github.com/qdm12/gluetun/internal/dns/run.go:77 +0x157
github.com/qdm12/gluetun/internal/dns.(*Loop).Run(0xc0002641b0, {0x14ee778, 0xc00023ee60}, 0xc0002f59d0?)
        github.com/qdm12/gluetun/internal/dns/run.go:66 +0x38f
created by main._main in goroutine 20
        ./main.go:399 +0x2745

Share your configuration

gluetun:
  image: qmcgaw/gluetun
  environment:
    VPN_SERVICE_PROVIDER: protonvpn
    VPN_TYPE: wireguard
    WIREGUARD_PRIVATE_KEY: ***
    SERVER_COUNTRIES: ***
    SERVER_CITIES: ***
    PORT_FORWARD_ONLY: on
    VPN_PORT_FORWARDING: on
    DNS_KEEP_NAMESERVER: on
    VPN_PORT_FORWARDING_UP_COMMAND: >
      /bin/sh -c 'wget -O- --retry-connrefused --post-data
      "json={\"listen_port\":{{PORTS}}}"
      http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'
    UPDATER_PERIOD: 24h
    LOG_LEVEL: debug
  cap_add:
    - NET_ADMIN
  devices:
    - /dev/net/tun:/dev/net/tun

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[ColinHebert]

This is likely due to a different version of iptables which returns all for protocol instead of 0.

https://github.com/qdm12/gluetun/blob/master/internal/firewall/list.go#L326

[cthulu]

Same issue, I've reverted to v3 tag for now (though it's 10mo old)

[DrSKiZZ]

I use qsticky to update qbit port when it changes on protonvpn.

[jd4ever1]

Having the same issue

[jd4ever1]

I use qsticky to update qbit port when it changes on protonvpn.

Can you elaborate? Very interested in how you got it to work

[yarafie]

I was having different problems overall was using

image: qmcgaw/gluetun
or
image: qmcgaw/gluetun:latest

had to pin to version v3.40.0

image: qmcgaw/gluetun:v3.40.0

and everything went back to normal

[Ditaveloci]

I was having different problems overall was using

image: qmcgaw/gluetun or image: qmcgaw/gluetun:latest

had to pin to version v3.40.0

image: qmcgaw/gluetun:v3.40.0

and everything went back to normal

+1 for this for temp fix

[luall0]

If you want have a more newer version than the v3.40.0, you can use docker tag pr-2586 which currently work and have been created on Oct 17, 2025.

[ColinHebert]

@qdm12 the fix in 2e2e5f9 is not quite enough, same needs to be done with the different protocols (udp, icmp, tcp).

See an example here:

2025-11-04T02:01:54Z ERROR [firewall] cannot remove outdated VPN connection rule: finding iptables chain rule line number: parsing chain list: parsing chain rule "5        1   176 ACCEPT     udp  --  *      eth0    0.0.0.0/0            111.111.111.111      udp dpt:51820": parsing chain rule field: parsing protocol: unknown protocol: udp

or

2025-11-04T02:08:17Z ERROR port forwarding loop crashed: stopping previous service: blocking previous port in firewall: removing allowed port 59675 on interface tun0: finding iptables chain rule line number: parsing chain list: parsing chain rule "5        9   516 ACCEPT     tcp  --  tun0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:59675": parsing chain rule field: parsing protocol: unknown protocol: tcp

[qdm12]

1. For the iptables error, /usr/sbin/iptables-legacy -t filter -L INPUT --line-numbers -n -v has -n a.k.a. --numeric which should be printing protocol with their id numbers. My guess is this was introduced by upgrading Alpine in 5687555 on 30 October 2025. And yet again, a borked iptables release on Alpine, ugh! Added support for textual values for icmp, tcp and udp on top of all, that should fix it with commit 6712adf
2. On the terminal panic (not really a user problem), I'm still investigating, but we can close this issue if this is resolved for you, let me know!