Skip to content

Setting up VPN

Gluetun VPN Addon Setup Guide

Basic setup of the TrueCharts Gluetun VPN addon.


Ideally, a VPN provider supported by Gluetun, check the Gluetun Wiki for more info. There are custom providers but that is beyond the scope of this guide.

Gluetun VPN Addon Setup

Install the chart as per usual and add the the section for Gluetun like shown below. Don’t forget to set your Network in the excludedNetworks_IPv4 and enable the killswitch if desired, as shown below

type: gluetun
killSwitch: true
- ""
excludedNetworks_IPv6: []

Gluetun works with Environment Variables so we need to configure them below. Enter your VPN Provider specific ones as below.

OpenVPN Example

type: gluetun
killSwitch: true
- ""
excludedNetworks_IPv6: []
VPN_TYPE: "openvpn"
OPENVPN_USER: "username"

All providers will generally need VPN_SERVICE_PROVIDER and VPN_TYPE. For me, it’s Windscribe and openvpn but I could easily choose Wireguard.

Check the Gluetun Wiki to find your specific provider and enter their info, e.g. Windscribe Wiki Page.

Wireguard Example

I will demonstrate Wireguard VPN setup using Mullvad as the provider. I pull my private key, endpoint port and Wireguard Addresses from a Mullvad wireguard config file.

Mullvad Config File

You can generate a new config file from the Mullvad website, here is the Mullvad Config Generator.

Now we can enter the Env Vars. Install the chart as per usual and add the specific env vars to the gluetun section:

type: gluetun
killSwitch: true
- ""
excludedNetworks_IPv6: []
VPN_TYPE: "wireguard"
  • VPN Config File Location is not necessary, we will be using environment variables instead, so leave it blank
  • VPN_TYPE is wireguard
  • VPN_SERVICE_PROVIDER is mullvad in my case
  • WIREGUARD_PRIVATE_KEY is the private key from the Mullvad config file above
  • WIREGUARD_PUBLIC_KEY is the public key from the Mullvad config file above
  • FIREWALL_VPN_INPUT_PORTS is the port forward port
  • WIREGUARD_ADDRESSES is the Mullvad endpoint IP address, found in the Mullvad config file above
  • SERVER_CITIES is the Mullvad server city, it should likely be in from the same city your config file is from, and should share the same city as your forwarded port In my case, I am using the Toronto server city, and my forwarded port is from Toronto
  • VPN_ENDPOINT_PORT and VPN_ENDPOINT_IP is the Mullvad endpoint port and ip, found in the Mullvad config file above.

Verify it works

The easiest way to verify after it deploys (the chart will fail if your credentials don’t work) for me is using qbittorrent since the network page showing the interfaces can be shown quickly (or check the logs), the interface will be tun0.

Qbittorent Testing

Additional Gluetun Options

Proxy Example

Gluetun offers HTTP (and Shadowsocks) proxy support. This is useful in scenarios when a private tracker requires the same IP address for both indexing and downloading torrents. It is also generally useful if you want to route some HTTP traffic through your VPN from another container.

Step 1: Set the HTTP Proxy VPN Environment Variables

Those env have to be set additionally to your VPN setup from above.

  • HTTPPROXY_LOG: on (optional, but useful to verify initial setup)
type: gluetun
killSwitch: true
- ""
excludedNetworks_IPv6: []

Only the additional ENV needed for the Proxy are shown here to keep it shorter. You still need your VPN setup from above.

Gluetun’s default HTTP proxy port is 8888. If you wish to change the port, then change it by adding the HTTPPROXY_LISTENING_ADDRESS environment variable.

See Gluetun’s website for more proxy configuration options (like setting a username/password):

Step 2: Add a new service for the proxy

On the same chart where you configured the Gluetun VPN addon proxy environment variables, add the following additional service to your values.yaml as shown below. If you want to use said Proxy outside your Cluster you need to setup a LoadBalancer.

enabled: true
enabled: true
port: 8888
protocol: "http"
targetPort: 8888
type: "ClusterIP"

Step 3: Determine the proxy internal DNS name

The service name will end in -proxy. For a chart named qbittorrent it will be:


If your chart is named something different, you can look it up using k3s kubectl get svc -A.

Step 4: Configure the proxy in your indexer chart (Prowlarr)

In Prowlarr, under Settings -> Indexers -> Add [Indexer Proxies], select Http

  • Name: GluetunProxy (or whatever name you prefer)
  • Tags: proxy (set this if you only want the proxy to be used on certain trackers/indexers, otherwise leave blank)
  • Host: qbittorrent-proxy.ix-qbittorrent.svc.cluster.local
  • Port: 8888 (or whatever port you configured)
  • Username & Password: leave blank (unless you added those env variables).
  • Click Test to confirm connection, then Save.

Prowlarr VPN Proxy

If you added a proxy tag, make sure to also add that to the desired Indexers, under Indexers -> Edit Indexer -> Tags.

Your indexer traffic will now be routed through the Gluetun HTTP proxy. Check the qbittorrent-vpn container logs to confirm.