Bug: `latest` only - `creating iptables firewall: no iptables supported found`

[NorthyIE]

Is this urgent?

Yes

Host OS

Synology OS (DSM 7.3.2-86009 Update 1)

CPU arch

x86_64

VPN service provider

Mullvad

What are you using to run the container

docker-compose

What is the version of Gluetun

Running version latest built on 2026-03-10T12:57:02.381Z (commit 760fefd) on Linux 4.4.302+ (x86_64)

What's the problem 🤔

After updating gluetun to the latest build, I get an error that iptables are not found. When manually downgrading to qmcgaw/gluetun:v3.41.0 ("Running version v3.41.0 built on 2025-12-25T00:43:05.150Z (commit a10349e)"), everything start working again.

Share your logs (at least 10 lines)

Running version latest built on 2026-03-10T12:57:02.381Z (commit 760fefd) on Linux 4.4.302+ (x86_64)
...
2026-03-11T08:25:24+01:00 ERROR creating iptables firewall: no iptables supported found: errors encountered are: iptables-legacy:  (fork/exec /usr/sbin/iptables-legacy: no su             ch file or directory); iptables-nft:  (fork/exec /usr/sbin/iptables-nft: no such file or directory); iptables:  (fork/exec /usr/sbin/iptables: no such file or directory)
2026-03-11T08:25:24+01:00 INFO Shutdown successful

Share your configuration

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    hostname: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - VPN_SERVICE_PROVIDER=mullvad
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=<key>
      - WIREGUARD_ADDRESSES=<ip>
      - SERVER_COUNTRIES=<country>
      - TZ=Europe/Berlin
      - FIREWALL=on
      - FIREWALL_INPUT_PORTS=8080
      - FIREWALL_VPN_INPUT_PORTS=6881
    volumes:
      - /volume2/docker/gluetun:/gluetun
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "https://1.1.1.1"]
      interval: 30s
      timeout: 10s
      retries: 5
    restart: unless-stopped

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[qdm12]

What do you get when running

docker run -it --rm alpine:3.22
/ # apk add iptables iptables-legacy
/ # $(which iptables) --version
/ # $(which iptables-legacy) --version

If everything works without error, what do you get from

docker run -it --rm --entrypoint /bin/sh qmcgaw/gluetun
/ # apk add iptables iptables-legacy
/ # $(which iptables) --version
/ # $(which iptables-legacy) --version

[murakest]

Hello,
I had the same error for Synology NAS using latest Gluetun version, downgrade to v3.41.1 solved the issue.
Synology OS DSM 7.3.2-86009 Update 1

for this:

docker run -it --rm alpine:3.22
/ # apk add iptables iptables-legacy
/ # $(which iptables) --version
/ # $(which iptables-legacy) --version

I get this:

docker run -it --rm alpine:3.22
Unable to find image 'alpine:3.22' locally
3.22: Pulling from library/alpine
d49a2dee86fb: Already exists
Digest: sha256:55ae5d250caebc548793f321534bc6a8ef1d116f334f18f4ada1b2daad3251b2
Status: Downloaded newer image for alpine:3.22
/ #  apk add iptables iptables-legacy
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/community/x86_64/APKINDEX.tar.gz
(1/7) Installing libmnl (1.0.5-r2)
(2/7) Installing libnftnl (1.2.9-r0)
(3/7) Installing libxtables (1.8.11-r1)
(4/7) Installing iptables (1.8.11-r1)
(5/7) Installing libip4tc (1.8.11-r1)
(6/7) Installing libip6tc (1.8.11-r1)
(7/7) Installing iptables-legacy (1.8.11-r1)
Executing busybox-1.37.0-r20.trigger
OK: 10 MiB in 23 packages
/ # $(which iptables) --version
iptables v1.8.11 (nf_tables)
/ # $(which iptables-legacy) --version
iptables v1.8.11 (legacy)

for this:

docker run -it --rm --entrypoint /bin/sh qmcgaw/gluetun
/ # apk add iptables iptables-legacy
/ # $(which iptables) --version
/ # $(which iptables-legacy) --version

I get this:

docker run -it --rm --entrypoint /bin/sh qmcgaw/gluetun
Unable to find image 'qmcgaw/gluetun:latest' locally
latest: Pulling from qmcgaw/gluetun
589002ba0eae: Pull complete
ea4fa859e624: Pull complete
08123d8dc5b3: Pull complete
Digest: sha256:fcbe2e4919b05dd9653a6ce64304bd4f532d5b52e1356aaec4430713fa53c839
Status: Downloaded newer image for qmcgaw/gluetun:latest
/ # apk add iptables iptables-legacy
OK: 16.6 MiB in 37 packages
/ # $(which iptables) --version
iptables v1.8.11 (nf_tables)
/ # $(which iptables-legacy) --version
iptables v1.8.11 (legacy)

[qdm12]

Thanks @murakest !
That's quite strange... A few more shots in the dark I suppose:

Can you try

docker run -it --rm alpine:3.23
apk add iptables iptables-legacy
$(which iptables) --version
$(which iptables-legacy) --version

And also docker run -it --rm --entrypoint /usr/sbin/iptables qmcgaw/gluetun --version

[murakest]

docker run -it --rm alpine:3.23
apk add iptables iptables-legacy
$(which iptables) --version
$(which iptables-legacy) --version

Unable to find image 'alpine:3.23' locally
3.23: Pulling from library/alpine
589002ba0eae: Pull complete
Digest: sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
Status: Downloaded newer image for alpine:3.23
/ # apk add iptables iptables-legacy
(1/7) Installing libmnl (1.0.5-r2)
(2/7) Installing libnftnl (1.3.0-r0)
(3/7) Installing libxtables (1.8.11-r1)
(4/7) Installing iptables (1.8.11-r1)
(5/7) Installing libip4tc (1.8.11-r1)
(6/7) Installing libip6tc (1.8.11-r1)
(7/7) Installing iptables-legacy (1.8.11-r1)
Executing busybox-1.37.0-r30.trigger
OK: 10.2 MiB in 23 packages
/ # $(which iptables) --version
iptables v1.8.11 (nf_tables)
/ # $(which iptables-legacy) --version
iptables v1.8.11 (legacy)

And also docker run -it --rm --entrypoint /usr/sbin/iptables qmcgaw/gluetun --version

docker run -it --rm --entrypoint /usr/sbin/iptables qmcgaw/gluetun --version
Unable to find image 'qmcgaw/gluetun:latest' locally
latest: Pulling from qmcgaw/gluetun
589002ba0eae: Already exists
fd28868903f9: Pull complete
6039c24018a4: Pull complete
Digest: sha256:46407f10497e6b09770e63006439053ab88db9b94f009e88bcaef168233d5973
Status: Downloaded newer image for qmcgaw/gluetun:latest
iptables v1.8.11 (nf_tables)

[BingoRox]

I am also on a Synology host, using protonvpn running on latest:
Running version latest built on 2026-04-22T13:12:14.183Z (commit 628b0a2) on Linux 4.4.302+ (x86_64)
With the following in my compose:

    cap_add:
      - NET_ADMIN
      - NET_RAW

I have recently been getting an iptables warning on container startup, but gluetun is working without issue:

2026-04-23T10:50:54-04:00 WARN [iptables] restoring IPv4 iptables failed: exit status 1: iptables-restore: line 2 failed: restoring from data:
# Generated by iptables-save v1.8.11 on Thu Apr 23 10:50:54 2026
Warning: Extension DNAT is not supported, missing kernel module?
*mangle
:PREROUTING ACCEPT [476:255161]
:INPUT ACCEPT [476:255161]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [507:125758]
:POSTROUTING ACCEPT [501:125398]
COMMIT
# Completed on Thu Apr 23 10:50:54 2026
# Generated by iptables-save v1.8.11 on Thu Apr 23 10:50:54 2026
*nat
:PREROUTING ACCEPT [3:1528]
:INPUT ACCEPT [1:60]
:OUTPUT ACCEPT [56:4068]
:POSTROUTING ACCEPT [51:3768]
:DEFAULT_OUTPUT - [0:0]
:DEFAULT_POSTROUTING - [0:0]
:DOCKER_OUTPUT - [0:0]
:DOCKER_POSTROUTING - [0:0]
-A OUTPUT -j DEFAULT_OUTPUT
-A POSTROUTING -j DEFAULT_POSTROUTING
-A DEFAULT_OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
-A DEFAULT_POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:34824
-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:47926
-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 34824 -j SNAT --to-source :53
-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 47926 -j SNAT --to-source :53
COMMIT
# Completed on Thu Apr 23 10:50:54 2026
# Generated by iptables-save v1.8.11 on Thu Apr 23 10:50:54 2026
*filter
:INPUT DROP [2:1468]
:FORWARD DROP [0:0]
:OUTPUT DROP [6:360]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 172.20.0.0/16 -i eth0 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 56789 -j ACCEPT
-A INPUT -i tun0 -p udp -m udp --dport 56789 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -s 172.20.0.31/32 -d 172.20.0.0/16 -o eth0 -j ACCEPT
-A OUTPUT -s 172.20.0.31/32 -d 172.20.0.0/16 -o eth0 -j ACCEPT
-A OUTPUT -s 172.20.0.31/32 -d 192.168.2.0/24 -o eth0 -j ACCEPT
-A OUTPUT -d x.x.x.x/32 -o eth0 -p udp -m udp --dport 51820 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
COMMIT
# Completed on Thu Apr 23 10:50:54 2026
2026-04-23T10:50:54-04:00 WARN [iptables] IPv6 port redirection disabled because your kernel does not support IPv6 NAT: command failed: "ip6tables-legacy -t nat --append PREROUTING -i tun0 -p tcp --dport 56789 -j REDIRECT --to-ports 60050": ip6tables v1.8.11 (legacy): can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.: exit status 3

And when running iptables-legacy -S inside the container I can confirm the rules are being applied:

docker exec -it gluetun /bin/sh
iptables-legacy -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 172.20.0.0/16 -i eth0 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 56789 -j ACCEPT
-A INPUT -i tun0 -p udp -m udp --dport 56789 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 60050 -j ACCEPT
-A INPUT -i tun0 -p udp -m udp --dport 60050 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -s 172.20.0.31/32 -d 172.20.0.0/16 -o eth0 -j ACCEPT
-A OUTPUT -s 172.20.0.31/32 -d 172.20.0.0/16 -o eth0 -j ACCEPT
-A OUTPUT -s 172.20.0.31/32 -d 192.168.2.0/24 -o eth0 -j ACCEPT
-A OUTPUT -d x.x.x.x/32 -o eth0 -p udp -m udp --dport 51820 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT

@murakest and @NorthyIE maybe try latest and see if it's working now?
@qdm12 these warnings started sometime after commit d5eeec6

[Fiestaman]

I started getting the same error except I'm on MacOS running Docker Desktop on an Intel Mac Mini connecting to Proton. Rolling back to v3.41.1 instead of using "latest" fixed the issue for me. Most recent working version I have pulled is from 11 days ago. I did a pull today and error started.

[qdm12]

Sorry for the big delay; can you try docker run -it --rm --entrypoint /bin/sh qmcgaw/gluetun -c "which iptables". That's a really odd bug, maybe due to some exec-fork issue with more recent Alpine versions, I'll do some research on that when I get your output for that (hopefully) final command

[Fiestaman]

@qdm12 I pulled a fresh "latest" image today which is using commit e1d31f5 and the error seems to have resolved. No issues starting gluetun.

[apapushoy]

Running latest image on Synology and still see the DNAT extension warning. It appears to break the port forwarding since the internal 56789 port cannot be mapped to the port provided by Proton.

Running version latest built on 2026-05-09T14:50:17.073Z (commit 5b01324) on Linux 4.4.302+ (x86_64)
2026-05-10T12:24:50+08:00 INFO Alpine version: 3.23.4
2026-05-10T12:24:50+08:00 INFO OpenVPN version: 2.6.20
2026-05-10T12:24:50+08:00 INFO Firewall version: iptables v1.8.11

$ docker run -it --rm --entrypoint /bin/sh qmcgaw/gluetun -c "which iptables"
/usr/sbin/iptables

v3.41.1 works ok.

[BingoRox]

It appears to break the port forwarding

I'm not sure if it is what is breaking port forwarding, see also #3295 but confirming the same behaviour as @apapushoy as of 5b01324 on Synology with Proton, also rolled back to v3.41.1.