Bug: ProtonVPN port forwarding and qBittorrent: `Connection Status: Firewalled`

[LeoMerlino]

Is this urgent?

No

Host OS

Debian Trixie

CPU arch

aarch64

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-07-19T14:13:11.572Z (commit 78f6076)

What's the problem 🤔

qBittorrent cannot connect with port forwarded port, shows status: Connection Status: Firewalled

Share your logs (at least 10 lines)

2026-08-20T12:33:30Z INFO [routing] default route found: interface eth0, gateway 172.29.0.1, assigned IP 172.29.0.2 and family v4
2026-08-20T12:33:30Z INFO [routing] adding route for 0.0.0.0/0
2026-08-20T12:33:30Z INFO [firewall] setting allowed subnets...
2026-08-20T12:33:30Z INFO [routing] default route found: interface eth0, gateway 172.29.0.1, assigned IP 172.29.0.2 and family v4
2026-08-20T12:33:30Z INFO [routing] adding route for 192.168.0.0/24
2026-08-20T12:33:30Z INFO [healthcheck] listening on 127.0.0.1:9999
2026-08-20T12:33:30Z INFO [http server] http server listening on [::]:8000
2026-08-20T12:33:30Z INFO [firewall] allowing VPN connection...
2026-08-20T12:33:30Z INFO [wireguard] Using available kernelspace implementation
2026-08-20T12:33:30Z INFO [wireguard] Connecting to 84.20.17.196:51820
2026-08-20T12:33:31Z INFO [vpn] wireguard setup is complete. Note wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the wireguard connection is not working.
2026-08-20T12:33:31Z INFO [MTU discovery] finding maximum MTU, this can take up to 6 seconds
2026-08-20T12:33:36Z INFO [MTU discovery] setting VPN interface tun0 MTU to maximum valid MTU 1400
2026-08-20T12:33:36Z INFO [dns] DNS server listening on [::]:53
2026-08-20T12:33:36Z INFO [dns] ready and using DNS server with dot upstream resolvers
2026-08-20T12:33:36Z INFO [dns] downloading hostnames and IP block lists
2026-08-20T12:33:37Z INFO [ip getter] Public IP address is 159.26.106.118 (United Kingdom, England, London - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-08-20T12:33:37Z INFO [vpn] You are running 25 commits behind the most recent latest
2026-08-20T12:33:37Z INFO [port forwarding] starting
2026-08-20T12:33:37Z INFO [port forwarding] port forwarded is 53625
2026-08-20T12:33:37Z INFO [firewall] setting allowed input port 53625 through interface tun0...
2026-08-20T12:33:37Z INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2026-08-20T12:33:37Z ERROR [port forwarding] 2026-08-20 12:33:37 URL:http://localhost:8113/api/v2/app/setPreferences [0/0] -> "-" [1]
2026-08-20T12:33:39Z INFO [dns] leak check report: 162.158.199.42 (22%), 172.71.240.43 (22%), 172.70.161.108 (13%), 172.70.84.117 (13%), 141.101.70.202 (10%), 172.70.88.170 (10%), 172.71.177.42 (10%), 172.69.43.12 (3%)

Not sure why it says ERROR when updating qBittorrent via the API because the settings change successfully...

Share your configuration

services:
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    depends_on:
      - gluetun
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - WEBUI_PORT=8113
      - TORRENTING_PORT=6881
    volumes:
      - ./appdata:/config
      - ./downloads:/downloads #optional
    stop_grace_period: "10s" #optional
    restart: unless-stopped
    network_mode: "service:gluetun"

  gluetun:
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8113:8113
      - 8114:8114
      - 6881:6881
      - 6881:6881/udp
    environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=redacted
      - SERVER_COUNTRIES=United Kingdom
      - SERVER_CITIES=London
      - PORT_FORWARD_ONLY=on
      - FIREWALL_VPN_INPUT_ALLOW=192.168.0.0/24
      - FIREWALL_OUTBOUND_SUBNETS=192.168.0.0/24
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c 'wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":{{PORT}},\"current_network_interface\":\"{{VPN_INTERFACE}}\",\"random_port\":false,\"upnp\":false}" http://localhost:8113/api/v2/app/setPreferences'
      - VPN_PORT_FORWARDING_DOWN_COMMAND=/bin/sh -c 'wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":0,\"current_network_interface\":\"lo\"}" http://localhost:8113/api/v2/app/setPreferences'

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[rob4226]

I think Gluetun logs an error even though the API request is successful because wget outputs its transfer status line on stderr. Too bad curl isn't available bc that could be fixed easily.

[qdm12]

Yep the error is due to ERROR [port forwarding] 2026-08-20 12:33:37 URL:http://localhost:8113/api/v2/app/setPreferences [0/0] -> "-" [1]. note you can install curl with apk add curl inside the container if you want, or extend the Dockerfile with

FROM qmcgaw/gluetun
RUN apk add curl

and build, tag that as you want, and use that. Closing this since it's not a bug.

[LeoMerlino]

@qdm12 That error is unrelated to the problem I am experiencing which is where qBittorrent states that the connection is "Firewalled"

[LeoMerlino]

This issue still remains unsolved.

[qdm12]

sorry I misread the error, indeed.

What port do you have set in qbit through the ui ?

[LeoMerlino]

It changes automatically based on the port forwarding port found by gluetun.

[cryeprecision]

I think this might be a problem with ProtonVPN? I didn't change my config and have the same problem, although it is disappearing and reappearing recently.

I also looked at iptables when it wasn't working and the packet counters on the rules for port forwarding in the INPUT chain didn't increase when checking the public IP + forwarded port with one of those "is my port open" online tools. I also tried different websites so the packets don't get swallowed by the ctstate RELATED,ESTABLISHED rule.

[qdm12]

Yeah nothing really changed on the port forwarding side recently. Does changing vpn server sometimes fix it ?

[LeoMerlino]

I think I managed to make it work once by reconnecting and waiting but now I can't get it to work again.

[cryeprecision]

I'd say this is pretty much confirmed to be on the side of ProtonVPN (in my opinion).

I just had the problem again, pinged the public IP:Port and got no packets in the iptables output. Restarted gluetun, got a new IP:Port combination from ProtonVPN, pinged the new IP:Port and then the packets started appearing in the iptables output again.

I'm also tracking the QBittorrent state (firewalled/connected/disconnected) in prometheus and this only started happening on the 20th this month. I guess it's time to wait a few days and maybe open a support ticket with ProtonVPN.

[LeoMerlino]

@cryeprecision How are you testing this with iptables?
I want to test here as well.