Gluetun

What it's good for#

Some apps talk to the wider internet on your behalf: a front end that fetches YouTube or Reddit for you, a podcast or music app pulling in feeds. Routed through Gluetun, those requests leave from your VPN provider's address rather than your home's, so the sites they talk to see the VPN and your internet provider sees only encrypted traffic to it.

Gluetun is a VPN client for your apps. It isn't a way to reach your server from outside; that's the LibrePortal VPN. And it's not for your phone or laptop: devices keep using your normal connection, and only the apps you pick go through Gluetun.

It has a kill switch built in. If the connection to your provider drops, apps routed through it can't reach the internet at all until it's back, so nothing leaks out from your home address by accident.

Before you install: have your VPN account ready#

You need an account with a VPN provider Gluetun supports (it knows dozens). Out of the box it's set up for Mullvad over WireGuard. Fill in these settings on the Config tab:

• VPN Provider and VPN Protocol: your provider, and WireGuard or OpenVPN. WireGuard is faster where your provider offers it.
• For WireGuard, WireGuard Private Key and WireGuard Address. Your provider gives you both when you create a WireGuard configuration in your account on their website.
• For OpenVPN, OpenVPN Username and OpenVPN Password. These are often special VPN credentials, not the ones you sign in to the provider's website with.
• VPN Countries (optional): pick countries from the list for your provider, or leave it empty for any.

Until those are right, Gluetun can't connect, and it keeps restarting while it tries. Its Logs tab says what it's unhappy about.

Sending an app through it#

Once Gluetun is installed, apps it's suited to get a Network Mode setting on their Config tab, with a choice of Default network or Through Gluetun (VPN). Switch it, save, and the app is reinstalled on Gluetun's connection.

You can also do several at once with the Route Apps button on Gluetun's Config tab, which lists your installed apps with a tick box each. Each change re-runs that app's install.

Out of the box, only media apps get the choice (the likes of Invidious, Redlib and SoundCloak), because apps that fetch things from the internet for you are where a VPN makes sense. To offer it for every app, switch on Gluetun For All Apps in LibrePortal's SSH & Access Hardening settings (shown in Advanced mode).

To check: the Route Apps list reads frontend/data/apps/gluetun-eligible-categories.json, which isn't in the repo, so it shows no apps unless Gluetun For All Apps is on; the Network Mode setting itself uses its own list (media, downloads, torrent, usenet, arr)

What changes for a routed app#

A routed app shares Gluetun's connection completely, which has a few consequences worth knowing before you switch one over:

• Its domain address stops working. Traefik can't reach an app inside Gluetun, so the app is only reachable on its own port at your server's address, like http://192.168.1.50:8123. LibrePortal moves the app's ports onto Gluetun for you, so the port number stays the same.
• If Gluetun is down, so is the app's internet, and while Gluetun is stopped you can't reach the app at all.
• Restarting or updating Gluetun briefly restarts every routed app too. LibrePortal reattaches them afterwards, because an app left pointing at the old Gluetun would quietly lose its connection.
• Some sites block VPN addresses, so an app that fetches from one of them might start failing. Try another country, or take that app off the VPN.

Checking it's working#

Gluetun checks its own connection all the time, by reaching the sites in Health Check Sites and pinging the addresses in Health Check IPs. The defaults are Mullvad, the Electronic Frontier Foundation and Quad9's DNS, all privacy-minded. If those checks fail, Gluetun reconnects on its own. Its Logs tab shows which server it's connected to and the public address it's using.

Good to know#

• The HTTP Server port is Gluetun's own control interface, kept to trusted places. You don't need it for anything; LibrePortal doesn't set up the login Gluetun asks for, so it answers nothing useful.
• Your VPN key and password are kept in Gluetun's settings on the server, like any other app setting. Anyone with your VPN key can use your VPN account, so treat it like a password.
• Updates are automatic, with a backup taken first, and every routed app blinks while Gluetun restarts.
• One per server. Routed apps attach to Gluetun by name, so a second copy would leave them not knowing which to use.