Bug: ProtonVPN refresh forward port error

[FlorentinGarnier]

Is this urgent?

Yes

Host OS

Docker

CPU arch

None

VPN service provider

ProtonVPN

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-07-19T14:13:11.572Z (commit 78f6076) on Linux 7.0.0-28-generic (x86_64)

What's the problem 🤔

An error occurs when gluetun try to contact ProtonVPN to take a new Port.

Share your logs (at least 10 lines)

ERROR [port forwarding] refreshing port mapping for internal port 51332 and external port 51332: adding TCP port mapping: executing remote procedure call: reading from udp connection: read udp 10.2.0.2:56502->10.2.0.1:5351: recvfrom: connection refused
gluetun  | 2026-07-28T10:30:20+02:00 INFO [port forwarding] starting
gluetun  | 2026-07-28T10:30:20+02:00 ERROR [port forwarding] starting port forwarding service: port forwarding for the first time: getting external IPv4 address: executing remote procedure call: reading from udp connection: read udp 10.2.0.2:57320->10.2.0.1:5351: recvfrom: connection refused - make sure you have +pmp at the end of your OpenVPN username or that your Wireguard key is set to work with PMP - retrying in 5s
gluetun  | 2026-07-28T10:30:25+02:00 INFO [port forwarding] starting
gluetun  | 2026-07-28T10:30:25+02:00 ERROR [port forwarding] starting port forwarding service: port forwarding for the first time: getting external IPv4 address: executing remote procedure call: reading from udp connection: read udp 10.2.0.2:49662->10.2.0.1:5351: recvfrom: connection refused - make sure you have +pmp at the end of your OpenVPN username or that your Wireguard key is set to work with PMP - retrying in 5s

Share your configuration

gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun    
    environment:
      - TZ=Europe/Paris #CHANGE_TO_YOUR_TZ
      - VPN_SERVICE_PROVIDER=protonvpn
      - SERVER_COUNTRIES=Switzerland
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=XXXX=
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused --post-data "json={\"listen_port\":{{PORT}}}" http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'  
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on  
    volumes:
      - ./gluetun:/gluetun
    ports:
      - "8080:8080"   # WebUI qBittorrent
      - "8989:8989"   # Sonarr
      - "7878:7878"   # Radarr
      - "8686:8686"   # Lidarr
      - "9696:9696"   # Prowlarr
      - "5000:5000"  #SonoBarr"
      - "2468:2468"
    restart: unless-stopped

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[qdm12]

Version latest is not a valid version string I need the whole line from your logs

[github-actions]

Closed issues are NOT monitored, so commenting here will likely NOT be seen.
If you think this is still unresolved and have more information to bring, please either
re-open this issue or create another issue.

❤️😠 temporarily help the Gluetun community and fight the AI slop scam website gluetun[dot]com by setting BORINGPOLL_GLUETUNCOM=on on the latest image.
See the option in the wiki for more information

This is an automated comment setup because @qdm12 is the sole maintainer of this project
which became too popular to monitor closed issues.

[FlorentinGarnier]

duplicate of #3408

[qdm12]

I don't think it's the same bug as #3408 although yours looks like either misconfiguration on your end or a vpn server gateway misbehaving.

[UncleArya]

I know this thread is noted as closed and there have been several related issues reported in the last few days. I don't know enough to know which existing thread is best for me to add to. Just wanted to say that v3.41.3 hasn't solved the port forwarding issue I have been seeing the last few days. Sharing my logs if helpful. Happy to do some troubleshooting or testing if it would be helpful.

gluetun  | ========================================
gluetun  | ========================================
gluetun  | =============== gluetun ================
gluetun  | ========================================
gluetun  | =========== Made with ❤️ by ============
gluetun  | ======= https://github.com/qdm12 =======
gluetun  | ========================================
gluetun  | ========================================
gluetun  | 
gluetun  | Running version v3.41.3 built on 2026-07-30T14:53:40.495Z (commit 3d1e20c)
gluetun  | 
gluetun  | 🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
gluetun  | 🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
gluetun  | 💻 Email? quentin.mcgaw@gmail.com
gluetun  | 💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
gluetun  | 2026-07-30T17:22:26Z INFO [routing] default route found: interface eth1, gateway 172.30.0.1, assigned IP 172.30.0.2 and family v4
gluetun  | 2026-07-30T17:22:26Z INFO [routing] local ethernet link found: eth0
gluetun  | 2026-07-30T17:22:26Z INFO [routing] local ethernet link found: eth1
gluetun  | 2026-07-30T17:22:26Z INFO [routing] local ipnet found: 172.10.0.0/16
gluetun  | 2026-07-30T17:22:26Z INFO [routing] local ipnet found: 172.30.0.0/16
gluetun  | 2026-07-30T17:22:26Z INFO [firewall] enabling...
gluetun  | 2026-07-30T17:22:26Z INFO [firewall] enabled successfully
gluetun  | 2026-07-30T17:22:27Z INFO [storage] merging by most recent 20957 hardcoded servers and 20957 servers read from /gluetun/servers.json
gluetun  | 2026-07-30T17:22:27Z INFO Alpine version: 3.22.5
gluetun  | 2026-07-30T17:22:27Z INFO OpenVPN version: 2.6.20
gluetun  | 2026-07-30T17:22:27Z INFO IPtables version: v1.8.11
gluetun  | 2026-07-30T17:22:27Z INFO Settings summary:
gluetun  | ├── VPN settings:
gluetun  | |   ├── VPN provider settings:
gluetun  | |   |   ├── Name: protonvpn
gluetun  | |   |   ├── Server selection settings:
gluetun  | |   |   |   ├── VPN type: wireguard
gluetun  | |   |   |   ├── Countries: canada
gluetun  | |   |   |   ├── Port forwarding only servers: yes
gluetun  | |   |   |   └── Wireguard selection settings:
gluetun  | |   |   └── Automatic port forwarding settings:
gluetun  | |   |       ├── Redirection listening port: disabled
gluetun  | |   |       ├── Use port forwarding code for current provider
gluetun  | |   |       ├── Forwarded port file path: /tmp/gluetun/forwarded_port
gluetun  | |   |       ├── Forwarded port up command: /bin/sh -c 'wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":{{PORT}},\"current_network_interface\":\"{{VPN_INTERFACE}}\",\"random_port\":false,\"upnp\":false}" http://127.0.0.1:11280/api/v2/app/setPreferences'
gluetun  | |   |       └── Forwarded port down command: /bin/sh -c 'wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":0,\"current_network_interface\":\"lo\"}" http://127.0.0.1:11280/api/v2/app/setPreferences'
gluetun  | |   └── Wireguard settings:
gluetun  | |       ├── Private key: UKP...lM=
gluetun  | |       ├── Interface addresses:
gluetun  | |       |   └── 10.2.0.2/32
gluetun  | |       ├── Allowed IPs:
gluetun  | |       |   ├── 0.0.0.0/0
gluetun  | |       |   └── ::/0
gluetun  | |       └── Network interface: tun0
gluetun  | |           └── MTU: 1320
gluetun  | ├── DNS settings:
gluetun  | |   ├── Keep existing nameserver(s): no
gluetun  | |   ├── DNS server address to use: 127.0.0.1
gluetun  | |   ├── DNS forwarder server enabled: yes
gluetun  | |   ├── Upstream resolver type: dot
gluetun  | |   ├── Upstream resolvers:
gluetun  | |   |   └── cloudflare
gluetun  | |   ├── Caching: yes
gluetun  | |   ├── IPv6: no
gluetun  | |   ├── Update period: every 24h0m0s
gluetun  | |   └── DNS filtering settings:
gluetun  | |       ├── Block malicious: yes
gluetun  | |       ├── Block ads: no
gluetun  | |       └── Block surveillance: no
gluetun  | ├── Firewall settings:
gluetun  | |   └── Enabled: yes
gluetun  | ├── Log settings:
gluetun  | |   └── Log level: info
gluetun  | ├── Health settings:
gluetun  | |   ├── Server listening address: 127.0.0.1:9999
gluetun  | |   ├── Target addresses:
gluetun  | |   |   ├── cloudflare.com:443
gluetun  | |   |   └── github.com:443
gluetun  | |   ├── Small health check type: ICMP echo request
gluetun  | |   |   └── ICMP target IPs:
gluetun  | |   |       ├── 1.1.1.1
gluetun  | |   |       └── 8.8.8.8
gluetun  | |   └── Restart VPN on healthcheck failure: yes
gluetun  | ├── Shadowsocks server settings:
gluetun  | |   └── Enabled: no
gluetun  | ├── HTTP proxy settings:
gluetun  | |   └── Enabled: no
gluetun  | ├── Control server settings:
gluetun  | |   ├── Listening address: :8000
gluetun  | |   ├── Logging: yes
gluetun  | |   ├── Authentication file path: /gluetun/auth/config.toml
gluetun  | |   └── Role default
gluetun  | |       ├── Authentication method: apikey
gluetun  | |       ├── API key: [set]
gluetun  | |       └── Number of routes covered: 0
gluetun  | ├── Storage settings:
gluetun  | |   └── Filepath: /gluetun/servers.json
gluetun  | ├── OS Alpine settings:
gluetun  | |   ├── Process UID: 1000
gluetun  | |   └── Process GID: 1000
gluetun  | ├── Public IP settings:
gluetun  | |   ├── IP file path: /tmp/gluetun/ip
gluetun  | |   ├── Public IP data base API: ipinfo
gluetun  | |   └── Public IP data backup APIs:
gluetun  | |       ├── ifconfigco
gluetun  | |       ├── ip2location
gluetun  | |       └── cloudflare
gluetun  | ├── Server data updater settings:
gluetun  | |   ├── Update period: 24h0m0s
gluetun  | |   ├── Minimum ratio: 0.8
gluetun  | |   ├── Providers to update: protonvpn
gluetun  | |   ├── Proton API email: 
gluetun  | |   └── Proton API password: [not set]
gluetun  | └── Version settings:
gluetun  |     └── Enabled: yes
gluetun  | 2026-07-30T17:22:27Z INFO [routing] default route found: interface eth1, gateway 172.30.0.1, assigned IP 172.30.0.2 and family v4
gluetun  | 2026-07-30T17:22:27Z INFO [routing] adding route for 0.0.0.0/0
gluetun  | 2026-07-30T17:22:27Z INFO [firewall] setting allowed subnets...
gluetun  | 2026-07-30T17:22:27Z INFO [routing] default route found: interface eth1, gateway 172.30.0.1, assigned IP 172.30.0.2 and family v4
gluetun  | 2026-07-30T17:22:27Z INFO [healthcheck] listening on 127.0.0.1:9999
gluetun  | 2026-07-30T17:22:27Z INFO [dns] using plaintext DNS at address 1.1.1.1
gluetun  | 2026-07-30T17:22:27Z INFO [http server] http server listening on [::]:8000
gluetun  | 2026-07-30T17:22:27Z INFO [firewall] allowing VPN connection...
gluetun  | 2026-07-30T17:22:27Z INFO [wireguard] Using available kernelspace implementation
gluetun  | 2026-07-30T17:22:27Z INFO [wireguard] Connecting to 185.111.110.68:51820
gluetun  | 2026-07-30T17:22:27Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
gluetun  | 2026-07-30T17:22:32Z INFO [dns] downloading hostnames and IP block lists
gluetun  | 2026-07-30T17:22:33Z INFO [dns] DNS server listening on [::]:53
gluetun  | 2026-07-30T17:22:34Z INFO [dns] ready
gluetun  | 2026-07-30T17:22:34Z INFO [ip getter] Public IP address is 185.98.171.188 (Canada, Ontario, Toronto - source: ipinfo+ifconfig.co+ip2location+cloudflare)
gluetun  | 2026-07-30T17:22:35Z INFO [vpn] You are running the latest release v3.41.3
gluetun  | 2026-07-30T17:22:35Z INFO [port forwarding] starting
gluetun  | 2026-07-30T17:22:35Z INFO [port forwarding] gateway external IPv4 address is 185.98.171.188
gluetun  | 2026-07-30T17:22:35Z INFO [port forwarding] port forwarded is 61220
gluetun  | 2026-07-30T17:22:35Z INFO [firewall] setting allowed input port 61220 through interface tun0...
gluetun  | 2026-07-30T17:22:35Z INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
gluetun  | 2026-07-30T17:22:35Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:22:36Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:22:38Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:22:41Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:22:45Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:22:50Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:22:56Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:23:03Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:23:11Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:23:20Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:23:30Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:23:40Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:23:50Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:24:00Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:24:10Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:24:20Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:24:30Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:24:40Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:24:50Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:25:00Z ERROR [port forwarding] failed: Connection refused.
gluetun  | 2026-07-30T17:25:00Z ERROR [port forwarding] running up command: exit status 4

[qdm12]

the connection refused you get is from wget (I should prefix in logs for clarity!). Maybe http://127.0.0.1:11280/api/v2/app/setPreferences is not the right address? You could exec in gluetun and try running the wget command you have until it works

[UncleArya]

Thanks for pointing me in the right direction! The address was right, I just needed to add a healthcheck to qbit since my gluetun and qbit are in separate compose stacks. It is working again in v3.41.3, I was just paying too much attention to the logs since it hadn't been working in v3.41.2. Gluetun was just ready before qbit was. Adding the healthcheck has removed those error logs.