Confusion about DNS_KEEP_NAMESERVER and why is it not working for me without it in k8s?

[solat78]

TLDR: Gluetun only works for me if I set DNS_KEEP_NAMESERVER. Without it nslookup and curl succeeds but wget fails.

Hello, first I want to say thanks for all the work here. That's some great work.

I'm using gluetun as a sidecar container in Kubernetes.
Most of it works but it won’t function unless I set DNS_KEEP_NAMESERVER.

Maybe Im doing something wrong, but I can’t see what it is. I’ve read issues mentioning that DNS_KEEP_NAMESERVER is no longer necessary but that doesn’t work for me.

 I created a minimal reproduction using an alpine container to show the issue.

deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: alpine-with-gluetun
  namespace: gluetun-test
  labels:
    app: alpine-with-gluetun
    app.kubernetes.io/instance: alpine-with-gluetun
spec:
  replicas: 1
  selector:
    matchLabels:
      app: alpine-with-gluetun
  template:
    metadata:
      labels:
        app: alpine-with-gluetun
    spec:
      nodeSelector:
        worker: "true"
      containers:
        - name: alpine
          image: alpine
          command: ["/bin/sh", "-c", "while true; do sleep infinity; done"]
        - name: vpn
          image: qmcgaw/gluetun:v3.41.1
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
          env:
            - name: LOG_LEVEL
              value: debug
           # - name: WIREGUARD_MTU
           #   value: "1320"
           # - name: DNS_KEEP_NAMESERVER
           #   value: "on"
           # - name: FIREWALL_OUTBOUND_SUBNETS
           #   value: 10.0.0.0/8
            - name: VPN_SERVICE_PROVIDER
              value: mullvad
            - name: VPN_TYPE
              value: wireguard
            - name: SERVER_CITIES
              value: amsterdam
            - name: DNS_UPSTREAM_RESOLVERS
              value: quad9
            - name: WIREGUARD_PRIVATE_KEY
              valueFrom:
                secretKeyRef:
                  name: gluetun-test-vpn-creds
                  key: WIREGUARD_PRIVATE_KEY
            - name: WIREGUARD_ADDRESSES
              valueFrom:
                secretKeyRef:
                  name: gluetun-test-vpn-creds
                  key: WIREGUARD_ADDRESSES

Logs: (Sometimes I also get timeout errors on startup)

Running version v3.41.1 built on 2026-02-11T14:22:29.184Z (commit 7f22fb3)
🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
💻 Email? quentin.mcgaw@gmail.com
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2026-03-31T19:40:49Z INFO [routing] default route found: interface eth0, gateway 10.42.4.1, assigned IP 10.42.4.179 and family v4
2026-03-31T19:40:49Z INFO [routing] local ethernet link found: eth0
2026-03-31T19:40:49Z INFO [routing] local ipnet found: 10.42.4.0/24
2026-03-31T19:40:49Z INFO [routing] local ipnet found: fe80::/64
2026-03-31T19:40:49Z INFO [firewall] enabling...
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/iptables --policy INPUT DROP
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/iptables --policy OUTPUT DROP
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/iptables --policy FORWARD DROP
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --policy INPUT DROP
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --policy OUTPUT DROP
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --policy FORWARD DROP
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/iptables --append INPUT -i lo -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --append INPUT -i lo -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o lo -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --append OUTPUT -o lo -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/iptables --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o eth0 -s 10.42.4.179 -d 10.42.4.0/24 -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --append OUTPUT -o eth0 -d ff02::1:ff00:0/104 -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --append OUTPUT -o eth0 -s fe80::10d3:1ff:fe8b:f8f2 -d fe80::/64 -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/iptables --append INPUT -i eth0 -d 10.42.4.0/24 -j ACCEPT
2026-03-31T19:40:49Z DEBUG [firewall] /usr/sbin/ip6tables --append INPUT -i eth0 -d fe80::/64 -j ACCEPT
2026-03-31T19:40:49Z INFO [firewall] enabled successfully
2026-03-31T19:40:49Z INFO [storage] creating /gluetun/servers.json with 20901 hardcoded servers
2026-03-31T19:40:50Z DEBUG [netlink] IPv6 is supported by link eth0
2026-03-31T19:40:50Z INFO Alpine version: 3.22.3
2026-03-31T19:40:50Z INFO OpenVPN version: 2.6.16
2026-03-31T19:40:50Z INFO IPtables version: v1.8.11
2026-03-31T19:40:50Z INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: mullvad
|   |   └── Server selection settings:
|   |       ├── VPN type: wireguard
|   |       ├── Cities: amsterdam
|   |       └── Wireguard selection settings:
|   └── Wireguard settings:
|       ├── Private key: xxx
|       ├── Interface addresses:
|       |   └── 10.71.99.33/32
|       ├── Allowed IPs:
|       |   ├── 0.0.0.0/0
|       |   └── ::/0
|       └── Network interface: tun0
|           └── MTU: 1320
├── DNS settings:
|   ├── Keep existing nameserver(s): no
|   ├── DNS server address to use: 127.0.0.1
|   ├── DNS forwarder server enabled: yes
|   ├── Upstream resolver type: dot
|   ├── Upstream resolvers:
|   |   └── quad9
|   ├── Caching: yes
|   ├── IPv6: no
|   ├── Update period: every 24h0m0s
|   └── DNS filtering settings:
|       ├── Block malicious: yes
|       ├── Block ads: no
|       └── Block surveillance: no
├── Firewall settings:
|   └── Enabled: yes
├── Log settings:
|   └── Log level: debug
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target addresses:
|   |   ├── cloudflare.com:443
|   |   └── github.com:443
|   ├── Small health check type: ICMP echo request
|   |   └── ICMP target IPs:
|   |       ├── 1.1.1.1
|   |       └── 8.8.8.8
|   └── Restart VPN on healthcheck failure: yes
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   ├── Logging: yes
|   └── Authentication file path: /gluetun/auth/config.toml
├── Storage settings:
|   └── Filepath: /gluetun/servers.json
├── OS Alpine settings:
|   ├── Process UID: 1000
|   └── Process GID: 1000
├── Public IP settings:
|   ├── IP file path: /tmp/gluetun/ip
|   ├── Public IP data base API: ipinfo
|   └── Public IP data backup APIs:
|       ├── ifconfigco
|       ├── ip2location
|       └── cloudflare
└── Version settings:
    └── Enabled: yes
2026-03-31T19:40:50Z INFO [routing] default route found: interface eth0, gateway 10.42.4.1, assigned IP 10.42.4.179 and family v4
2026-03-31T19:40:50Z DEBUG [netlink] ip -4 rule list
2026-03-31T19:40:50Z DEBUG [netlink] ip -6 rule list
2026-03-31T19:40:50Z DEBUG [netlink] ip -f 0 rule add from 10.42.4.179/32 lookup 200 pref 100
2026-03-31T19:40:50Z INFO [routing] adding route for 0.0.0.0/0
2026-03-31T19:40:50Z DEBUG [routing] ip route replace 0.0.0.0/0 via 10.42.4.1 dev eth0 table 200
2026-03-31T19:40:50Z INFO [firewall] setting allowed subnets...
2026-03-31T19:40:50Z INFO [routing] default route found: interface eth0, gateway 10.42.4.1, assigned IP 10.42.4.179 and family v4
2026-03-31T19:40:50Z DEBUG [netlink] ip -4 rule list
2026-03-31T19:40:50Z DEBUG [netlink] ip -6 rule list
2026-03-31T19:40:50Z DEBUG [netlink] ip -f 0 rule add to 10.42.4.0/24 lookup 254 pref 98
2026-03-31T19:40:50Z DEBUG [netlink] ip -4 rule list
2026-03-31T19:40:50Z DEBUG [netlink] ip -6 rule list
2026-03-31T19:40:50Z DEBUG [netlink] ip -f 0 rule add to fe80::/64 lookup 254 pref 98
2026-03-31T19:40:50Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2026-03-31T19:40:50Z DEBUG [dns] filter updated: 0 hostnames, 0 IPs, 0 IP prefixes blocked
2026-03-31T19:40:50Z INFO [healthcheck] listening on 127.0.0.1:9999
2026-03-31T19:40:50Z INFO [dns] using plaintext DNS at address 9.9.9.9
2026-03-31T19:40:50Z INFO [http server] http server listening on [::]:8000
2026-03-31T19:40:50Z DEBUG [wireguard] Wireguard server public key: xxx
2026-03-31T19:40:50Z DEBUG [wireguard] Wireguard client private key: xxx
2026-03-31T19:40:50Z DEBUG [wireguard] Wireguard pre-shared key: [not set]
2026-03-31T19:40:50Z INFO [firewall] allowing VPN connection...
2026-03-31T19:40:50Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -d xxx -o eth0 -p udp -m udp --dport 51820 -j ACCEPT
2026-03-31T19:40:50Z DEBUG [firewall] /usr/sbin/iptables --append OUTPUT -o tun0 -j ACCEPT
2026-03-31T19:40:50Z DEBUG [firewall] /usr/sbin/ip6tables --append OUTPUT -o tun0 -j ACCEPT
2026-03-31T19:40:50Z INFO [wireguard] Using available kernelspace implementation
2026-03-31T19:40:50Z INFO [wireguard] Connecting to xxx
2026-03-31T19:40:50Z DEBUG [netlink] ip -f inet6 rule add lookup 51820 pref 101
2026-03-31T19:40:50Z DEBUG [netlink] ip -f inet rule add lookup 51820 pref 101
2026-03-31T19:40:50Z INFO [wireguard] Wireguard setup is complete. Note Wireguard is a silent protocol and it may or may not work, without giving any error message. Typically i/o timeout errors indicate the Wireguard connection is not working.
2026-03-31T19:40:50Z INFO [dns] downloading hostnames and IP block lists
2026-03-31T19:40:52Z DEBUG [dns] filter updated: 714744 hostnames, 31801 IPs, 4577 IP prefixes blocked
2026-03-31T19:40:52Z INFO [dns] DNS server listening on [::]:53
2026-03-31T19:40:53Z INFO [dns] ready
2026-03-31T19:40:54Z INFO [ip getter] Public IP address is xxx (Netherlands, North Holland, Amsterdam - source: ipinfo+ifconfig.co+ip2location+cloudflare)
2026-03-31T19:40:54Z INFO [vpn] You are running the latest release v3.41.1

Inside the alpine container nslookups works fine but wget fails with an bad address error. (curl also works if it’s available inside the container)

At first I thought it was a VPN provider issue but when I set DNS_KEEP_NAMESERVER and FIREWALL_OUTBOUND_SUBNETS it works fine. But then I’m wondering why the requests don’t come through my own DNS server instead.
The resolve.conf points to the Kubernetes DNS server, which normally forwards to my DNS server. But here it looks like requests are routed through the gluetun container. I can’t confirm that because I don’t see any relevant logs.


What am I missing? I’d like to run without DNS_KEEP_NAMESERVER so I’m sure DNS queries are also proxied through gluetun.

I hope this isn’t a dumb question or creating extra work for anyone.

[solat78]

I solved it, I just made a mistake.



My resolv.conf included my router’s domain, which isn’t reachable. For wget that’s enough to fail with „Bad address“.
I don’t need to set DNS_KEEP_NAMESERVER. I also created a custom resolv.conf for the whole k3s cluster and now everything works fine.