Unhealthy container until I turn off Synology firewall

[MrJamesT]

Hi, first of all thank you for this awesome package, I first tried some other packages but none of them worked on my "amazing" NAS but gluetun has saved me! 😁
The last issue I have is the fact that I'm used to having my synology firewall turned on and the only way I can get the package to report as healthy and not constantly restart is by turning it off.
I tried allowing port :9999 as I've seen that in the environment variables as the healthcheck server but that didn't help. Is there any other port I need to allow?

[qdm12]

Strange, do you restrict outbound connections or just inbound? If you do restrict outbound (I do hehe), then you need to allow the vpn port depending on the provider/vpn protocol/network protocol you use.

[MrJamesT]

Oh, so if I'm using PIA through OpenVPN with port forwarding ON, do I need to specify the forwarded port in the firewall settings? I don't think I can make a script for that to change it automatically, but if the port "lease" lasts 2 months, I guess I can just change it manually :)

[qdm12]

No the port forwarded is from the VPN server to gluetun, so it only goes through gluetun's built-in automatically configured firewall, it doesn't touch the host really.

I'm talking more about the VPN server endpoint port. For PIA, it's TCP 501 or UDP 1197 (for strong encryption preset which is the default). Or just disable filtering outbound connections to test.

[MrJamesT]

Oh I see, forwarding UDP 1197 did the trick, thank you very much!

[MacularDegenerate]

Here in 2025 to say allowing traffic on port 1197 as a “destination port” in the Synology firewall fixed this for me. I am using PIA with default VPN configuration settings. Thank you.