Gluetun has been not working for me i tried protonvpn wiregaurd & openvpn, expressvpn openvpn keys and still it is not connecting. It only connected once but it broke. I did 3 fresh installs nuked everything and tried again and no luck. I decided to see if i can use media without vpn and tomAI said it is possible yet gluetun did not work again. Please help tom I have been struggling with this issue and sparkbox is unusable because of it. ChrisAI does suggestions do not help. So if Tom i can contact you directly that would be great. Thanks. I told tom ai to summarize my issue: Bug: VPNENABLED=off doesn't actually disable gluetun What's broken: Setting VPNENABLED=off in .env should stop gluetun from starting and let the media apps (qBittorrent, Sonarr, Radarr, etc.) run on the normal home network. Instead, gluetun still gets created and everything waits for it to become healthy — which never happens because the VPN credentials are bad/expired. Steps to reproduce: Set VPNENABLED=off using sudo sparkbox set-env VPNENABLED off Run sudo sparkbox restart media or sudo sparkbox up media gluetun container still gets created and starts All the media apps (qBittorrent, Sonarr, Radarr, Prowlarr, etc.) sit in "Starting" state waiting for gluetun to be healthy gluetun keeps restart-looping because the VPN config is broken Everything stays stuck What should happen: When VPNENABLED=off, gluetun should not be created at all, and the media apps should use networkmode: bridge (or host networking) instead of networkmode: service:gluetun. Workaround that partially works: Manually editing /opt/sparkbox/modules/media/docker-compose.yml to change qBittorrent from networkmode: service:gluetun to networkmode: bridge and removing the dependson: gluetun line. But this gets overwritten on the next sparkbox up. Environment: SparkBox v1.6.612 WSL2 (Windows 11) VPN provider: ProtonVPN (WireGuard) The VPN itself is broken (bad keys or expired config), which is why the user wants to disable it entirely Logs showing the problem: [INFO] .env changed since last up — recreating the affected containers to pick up new values [INFO] media: configuration changed — recreating its containers [+] up 4/133 ✔ Container sb-bazarr Started ⠸ Container sb-gluetun Waiting <-- should not exist when VPNENABLED=off ⠼ Container sb-prowlarr Starting <-- stuck waiting for gluetun ⠴ Container sb-qbittorrent Starting <-- stuck waiting for gluetun Even after manually deleting the gluetun container with docker rm sb-gluetun, running sparkbox up media recreates it and everything waits again. Expected fix: The media module's compose generation logic needs to check VPNENABLED and: Skip creating the gluetun service entirely when it's off Change all the media apps from networkmode: service:gluetun to networkmode: bridge (or remove the networkmode line so they use the default bridge) Remove the dependson: gluetun dependency from all media apps Right now it looks like the compose file is hardcoded to always use gluetun regardless of the VPNENABLED setting.
7 replies
Chris wrote:
Good news — this isn't your VPN keys, it's the setting name. The switch that turns the VPN off for the media apps is MEDIASTACKNOVPN, not VPNENABLED. Typing a name SparkBox doesn't recognize is exactly why gluetun kept coming back no matter how many fresh installs you did. Run these two lines in your terminal: sudo sparkbox set-env MEDIASTACKNOVPN 1 sudo sparkbox restart media That swaps the tunnel for a harmless placeholder, so qBittorrent, Sonarr, Radarr and the rest come up on your normal network. To confirm it worked, run sudo sparkbox doctor — it'll say "VPN is DISABLED by your choice." One heads-up: with the VPN off, your downloads run on your home connection, so your internet provider can see them. If you'd rather keep the VPN, I'm happy to chase the ProtonVPN keys with you instead.
Zypherdose wrote:
These commands did work, but it was as a last straw solution i would still prefer to have some vpn over media apps. I am planning to use immich and if i use a host vpn then immich might get screwed? Also, sparkbox does not turn on by itself i have to turn it on from powershell everytime. i need toms help with this
Chris wrote:
You don't need a host VPN here, so Immich is safe either way. The media apps — qBittorrent, Sonarr, Radarr and the rest — have their own VPN built in, and Immich is a separate app that never touches it, so it just runs on your normal home network. The reason that built-in VPN wouldn't connect is your keys, not the feature itself, so that's the piece we'll fix together. Tell me which provider you're going with (ProtonVPN or ExpressVPN) and I'll walk you through the exact key to paste. Once it's right, we switch the VPN back on and your downloads are protected again, with no host VPN at all. On the box not starting by itself — that's already with Tom from your other thread, and he's looking into it. You don't need to chase it in two places.
Zypherdose wrote:
sure ill follow your steps for protonvpn keys. also i will paste the error log of gluten that keeps looping. My proton keys pipeline, I got them from protonvpn accountsdownloadswireguard config select gnu/linux platform vpn options netsheild blockmalware only, moderate nat off, natpmp on vpn acc on select server countrycreate config filedownload i tried on sparkbox to manually input the keys, uploading config file and non worked. gluten just keeps getting errors. logs 2026-08-22T18:20:15+04:00 WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: all check tries failed: parallel attempt 1/2 failed: dialing: dial tcp4: lookup github.com: i/o timeout, parallel attempt 2/2 failed: dialing: dial tcp4: lookup cloudflare.com: i/o timeout 2026-08-22T18:20:15+04:00 INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md 2026-08-22T18:20:15+04:00 INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION 2026-08-22T18:20:15+04:00 INFO [vpn] stopping 2026-08-22T18:20:16+04:00 INFO [vpn] starting 2026-08-22T18:20:16+04:00 INFO [firewall] allowing VPN connection... 2026-08-22T18:20:16+04:00 INFO [wireguard] Using available kernelspace implementation 2026-08-22T18:20:16+04:00 INFO [wireguard] Connecting to [redacted] 2026-08-22T18:20:16+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
Chris wrote:
Pasting the log was exactly right — it ends the guessing. Your ProtonVPN key setup is correct (that's the standard way to grab a WireGuard config), so don't redo it. The log shows the tunnel actually comes up, but then its health check can't resolve any name — github.com and cloudflare.com both time out — so it restarts over and over. The usual culprit is the encrypted DNS setting, which is on by default and some VPN servers block. Run these two lines, one after the other: sudo sparkbox set-env VPNDOT off sudo sparkbox restart media Your traffic still goes through the VPN either way — this only changes how names are looked up. If it still loops after that, reply here and we'll check the address line on your key next.
Zypherdose wrote:
did that and gluetun is still looping and trying to connect. log 2026-08-22T20:01:02+04:00 WARN [vpn] restarting VPN because it failed to pass the healthcheck: startup check: all check tries failed: parallel attempt 1/2 failed: dialing: dial tcp4: lookup cloudflare.com: i/o timeout, parallel attempt 2/2 failed: dialing: dial tcp4: lookup github.com: i/o timeout 2026-08-22T20:01:02+04:00 INFO [vpn] 👉 See https://github.com/qdm12/gluetun-wiki/blob/main/faq/healthcheck.md 2026-08-22T20:01:02+04:00 INFO [vpn] DO NOT OPEN AN ISSUE UNLESS YOU HAVE READ AND TRIED EVERY POSSIBLE SOLUTION 2026-08-22T20:01:02+04:00 INFO [vpn] stopping 2026-08-22T20:01:02+04:00 INFO [vpn] starting 2026-08-22T20:01:02+04:00 INFO [firewall] allowing VPN connection... 2026-08-22T20:01:02+04:00 INFO [wireguard] Using available kernelspace implementation 2026-08-22T20:01:02+04:00 INFO [wireguard] Connecting to [redacted] 2026-08-22T20:01:02+04:00 INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
Chris wrote:
That log narrows it down — the tunnel comes up, but it can't carry traffic, so its own health check keeps failing and it restarts. With the encrypted-DNS switch off, two quick checks are left. First, the address: in the WireGuard config Proton gave you there's a line starting "Address =", usually 10.2.0.2/32 for Proton. Make sure SparkBox's "WireGuard Address" field matches it exactly, including the /32. If it matches, the packet size is the likely culprit — in VPN settings there's a "WireGuard MTU" box. Put 1280 in it and save; if it still loops, drop to 1220. If neither fixes it, I'll take your full log to Tom.