VPN_PORT_FORWARDING_UP_COMMAND never runs in podman quadlet, although port forwarding is working.

[Greylinux]

Is this urgent?

No

Host OS

Fedora CoreOS

CPU arch

x86_64

VPN service provider

ProtonVPN

What are you using to run the container

Podman

What is the version of Gluetun

V3.41.1 latest

What's the problem 🤔

Hi,
I am running using Podman Quadlets with a rootless user. Port forwarding is enabled and working correctly ( tested using the port checker here ), however the VPN_PORT_FORWARDING_UP_COMMAND is never run, I'm not sure what I'm doing wrong.

this is the test command I'm using
/bin/sh -c "echo My forwarded ports are {{PORTS}}, the first forwarded port is {{PORT}} and the VPN network interface is {{VPN_INTERFACE}}"

Share your logs (at least 10 lines)

2026-07-01T09:01:43+01:00 INFO [routing] default route found: interface eth0, gateway 10.88.0.1, assigned IP 10.88.0.5 and family v4
2026-07-01T09:01:43+01:00 INFO [routing] adding route for 0.0.0.0/0
2026-07-01T09:01:43+01:00 INFO [firewall] setting allowed subnets...
2026-07-01T09:01:43+01:00 INFO [routing] default route found: interface eth0, gateway 10.88.0.1, assigned IP 10.88.0.5 and family v4
2026-07-01T09:01:43+01:00 INFO [firewall] setting allowed input port 8080 through interface eth0...
2026-07-01T09:01:43+01:00 INFO [healthcheck] listening on 127.0.0.1:9999
2026-07-01T09:01:43+01:00 INFO [http server] http server listening on [::]:8000
2026-07-01T09:01:43+01:00 INFO [firewall] allowing VPN connection...
2026-07-01T09:01:43+01:00 INFO [wireguard] Using available kernelspace implementation
2026-07-01T09:01:43+01:00 INFO [wireguard] Connecting to 31.13.191.66:51820
2026-07-01T09:01:43+01:00 INFO [vpn] wireguard setup is complete. Note wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the wireguard connection is not working.
2026-07-01T09:01:43+01:00 INFO [MTU discovery] finding maximum MTU, this can take up to 6 seconds
2026-07-01T09:01:47+01:00 INFO [MTU discovery] setting VPN interface tun0 MTU to maximum valid MTU 1400
2026-07-01T09:01:47+01:00 INFO [dns] DNS server listening on [::]:53
2026-07-01T09:01:47+01:00 INFO [dns] ready and using DNS server with dot upstream resolvers
2026-07-01T09:01:47+01:00 INFO [dns] downloading hostnames and IP block lists
2026-07-01T09:01:48+01:00 INFO [ip getter] Public IP address is 31.13.191.71 (Sweden, Stockholm, Kista - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-07-01T09:01:48+01:00 INFO [dns] leak check report: 104.23.222.41 (40%), 104.23.218.64 (30%), 162.158.180.55 (20%), 104.23.222.42 (10%)
2026-07-01T09:01:48+01:00 INFO [vpn] You are running on the bleeding edge of latest!
2026-07-01T09:01:48+01:00 INFO [port forwarding] starting
2026-07-01T09:01:49+01:00 INFO [port forwarding] port forwarded is 55271
2026-07-01T09:01:49+01:00 INFO [firewall] setting allowed input port 55271 through interface tun0...
2026-07-01T09:01:49+01:00 INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port

Share your configuration

[Unit]
Description=Gluetun Container

[Container]
ContainerName=gluetun
Image=docker.io/qmcgaw/gluetun:latest
PublishPort=8080:8080
Environment=FIREWALL_INPUT_PORTS=8080
Environment=VPN_SERVICE_PROVIDER=protonvpn
Environment=VPN_TYPE=wireguard
Environment=WIREGUARD_PRIVATE_KEY=
Environment=SERVER_COUNTRIES=Sweden,Netherlands
Environment=VPN_PORT_FORWARDING=on
Environment=PORT_FORWARD_ONLY=on
Environment=VPN_PORT_FORWARDING_PROVIDER=protonvpn
Environment=VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c "echo My forwarded ports are {{PORTS}}, the first forwarded port is {{PORT}} and the VPN network interface is {{VPN_INTERFACE}}"
Environment=TZ=Europe/London
AutoUpdate=registry
PodmanArgs=--privileged
AddCapability=NET_ADMIN
AddDevice=/dev/net/tun:/dev/net/tun

Volume=/var/home/core/ArrStack/gluetun/config:/gluetun:Z,U

[Service]
Restart=always

[Install]
WantedBy=default.target

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[Greylinux]

so I managed to resolve this issue by double quoting the whole command
Environment=VPN_PORT_FORWARDING_UP_COMMAND="/bin/sh -c 'echo My forwarded ports are {{PORTS}}, the first forwarded port is {{PORT}} and the VPN network interface is {{VPN_INTERFACE}}'"

2026-07-01T11:29:44+01:00 INFO [port forwarding] starting
2026-07-01T11:29:44+01:00 INFO [port forwarding] port forwarded is 33161
2026-07-01T11:29:44+01:00 INFO [firewall] setting allowed input port 33161 through interface tun0...
2026-07-01T11:29:44+01:00 INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2026-07-01T11:29:44+01:00 INFO [port forwarding] My forwarded ports are 33161, the first forwarded port is 33161 and the VPN network interface is tun0
2026-07-01T11:29:45+01:00 INFO [dns] leak check report: 162.159.112.42 (33%), 172.70.45.100 (22%), 104.23.171.40 (11%), 172.71.101.97 (11%), 172.71.181.105 (11%), 172.71.93.179 (11%), 104.23.169.40 (3%)

The issue I have now is that when I use the proper command

/bin/sh -c 'wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":{{PORT}},\"current_network_interface\":\"{{VPN_INTERFACE}}\",\"random_port\":false,\"upnp\":false}" http://127.0.0.1:8080/api/v2/app/setPreferences'

it errors out with

2026-07-01T11:34:20+01:00 ERROR [port forwarding] 2026-07-01 11:34:20 URL:http://127.0.0.1:8080/api/v2/app/setPreferences [0/0] -> "-" [1]

if I use the DOWN command inside the Gluetun container it works with out issue and qbittorrents port resets to 0 so I know the connection works.
wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":0,\"current_network_interface\":\"lo\"}" http://127.0.0.1:8080/api/v2/app/setPreferences

maybe its a timing issue and Qbittorrent isnt up when the command runs ?

I have it so that Qbittorent requires/starts after the Gluetun container so it wont start until after Gluetun is up

[Unit]
Description=qBittorrent Container
Requires=gluetun.service
After=gluetun.service

[Container]
ContainerName=qbittorrent
Image=lscr.io/linuxserver/qbittorrent:latest
Environment=WEBUI_PORT=8080
Environment=TZ=Europe/London
AutoUpdate=registry
UserNS=keep-id:uid=1000,gid=1000
Network=container:gluetun

Volume=/var/home/core/ArrStack/qbittorrent/config:/config:Z,U
Volume=/var/mydrive2/data/torrents:/data/torrents:z,U

[Service]
Restart=always

[Install]
WantedBy=default.target

maybe I should try sleep before sending the port change ?

[buggdude]

so I managed to resolve this issue by double quoting the whole command Environment=VPN_PORT_FORWARDING_UP_COMMAND="/bin/sh -c 'echo My forwarded ports are {{PORTS}}, the first forwarded port is {{PORT}} and the VPN network interface is {{VPN_INTERFACE}}'"

2026-07-01T11:29:44+01:00 INFO [port forwarding] starting
2026-07-01T11:29:44+01:00 INFO [port forwarding] port forwarded is 33161
2026-07-01T11:29:44+01:00 INFO [firewall] setting allowed input port 33161 through interface tun0...
2026-07-01T11:29:44+01:00 INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2026-07-01T11:29:44+01:00 INFO [port forwarding] My forwarded ports are 33161, the first forwarded port is 33161 and the VPN network interface is tun0
2026-07-01T11:29:45+01:00 INFO [dns] leak check report: 162.159.112.42 (33%), 172.70.45.100 (22%), 104.23.171.40 (11%), 172.71.101.97 (11%), 172.71.181.105 (11%), 172.71.93.179 (11%), 104.23.169.40 (3%)

The issue I have now is that when I use the proper command

/bin/sh -c 'wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":{{PORT}},\"current_network_interface\":\"{{VPN_INTERFACE}}\",\"random_port\":false,\"upnp\":false}" http://127.0.0.1:8080/api/v2/app/setPreferences'

it errors out with

2026-07-01T11:34:20+01:00 ERROR [port forwarding] 2026-07-01 11:34:20 URL:http://127.0.0.1:8080/api/v2/app/setPreferences [0/0] -> "-" [1]

if I use the DOWN command inside the Gluetun container it works with out issue and qbittorrents port resets to 0 so I know the connection works. wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":0,\"current_network_interface\":\"lo\"}" http://127.0.0.1:8080/api/v2/app/setPreferences

maybe its a timing issue and Qbittorrent isnt up when the command runs ?

I have it so that Qbittorent requires/starts after the Gluetun container so it wont start until after Gluetun is up

[Unit]
Description=qBittorrent Container
Requires=gluetun.service
After=gluetun.service

[Container]
ContainerName=qbittorrent
Image=lscr.io/linuxserver/qbittorrent:latest
Environment=WEBUI_PORT=8080
Environment=TZ=Europe/London
AutoUpdate=registry
UserNS=keep-id:uid=1000,gid=1000
Network=container:gluetun

Volume=/var/home/core/ArrStack/qbittorrent/config:/config:Z,U
Volume=/var/mydrive2/data/torrents:/data/torrents:z,U

[Service]
Restart=always

[Install]
WantedBy=default.target

maybe I should try sleep before sending the port change ?

Did you ever figure anything out with this? Switched to podman and am stuck on the port forwarding

[Greylinux]

Hi , Sadly no. Well not using the VPN_PORT_FORWARDING_UP_COMMAND at least. I found the best solution that worked well was Qsticky a sidecar container that updates the port for me using gluetun control server api.

this was the container file I used.

[Unit]
Description=Qsticky Container
Wants=gluetun.service qbittorrent.service
After=gluetun.service qbittorrent.service

[Container]
ContainerName=qsticky
Image=ghcr.io/monstermuffin/qsticky:latest
Network=gluetun.network
Environment=QBITTORRENT_HOST=gluetun
Environment=QBITTORRENT_HTTPS=false
Environment=QBITTORRENT_PORT=8080
Environment=QBITTORRENT_API_KEY=YOUR-QBITTORRENT-KEY
Environment=GLUETUN_HOST=gluetun
Environment=GLUETUN_AUTH_TYPE=apikey
Environment=GLUETUN_APIKEY=YOUR-GLUETUN-KEY   ( generate using podman run --rm qmcgaw/gluetun genkey)
Environment=LOG_LEVEL=INFO
Environment=TZ=UTC
AutoUpdate=registry

HealthCmd=["python3", "-c", "import json; exit(0 if json.load(open('/app/health/status.json'))['healthy'] else 1)"]
HealthInterval=30s
HealthTimeout=10s
HealthRetries=3

[Service]
Restart=always

[Install]
WantedBy=default.target

you will also need a config.toml for gluetun to use its control server api but its all explained in the qsticky readme.

hope this helps