---
title: Charmhub | Deploy Gluetun VPN Gateway using Charmhub - The Open Operator Collection
description: Deploy the latest version of Gluetun VPN Gateway as a Kubernetes Operator
  on any cloud.
url: https://charmhub.io/gluetun-k8s/configurations
---

# Gluetun VPN Gateway

[Adhitya Sriram Ravi](https://charmhub.io/publisher/ivdi "View all packages from Adhitya Sriram Ravi")

* [Adhitya Sriram Ravi](https://charmhub.io/publisher/ivdi "View all packages from Adhitya Sriram Ravi")

Platform:

edge 21

```
juju deploy gluetun-k8s --channel edge
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

* [cluster-cidrs](https://charmhub.io/gluetun-k8s/configurations#cluster-cidrs)
* [custom-overrides](https://charmhub.io/gluetun-k8s/configurations#custom-overrides)
* [dns-over-tls](https://charmhub.io/gluetun-k8s/configurations#dns-over-tls)
* [extended-alert-rules](https://charmhub.io/gluetun-k8s/configurations#extended-alert-rules)
* [server-cities](https://charmhub.io/gluetun-k8s/configurations#server-cities)
* [server-countries](https://charmhub.io/gluetun-k8s/configurations#server-countries)
* [vpn-endpoint-ip](https://charmhub.io/gluetun-k8s/configurations#vpn-endpoint-ip)
* [vpn-endpoint-port](https://charmhub.io/gluetun-k8s/configurations#vpn-endpoint-port)
* [vpn-provider](https://charmhub.io/gluetun-k8s/configurations#vpn-provider)
* [vpn-type](https://charmhub.io/gluetun-k8s/configurations#vpn-type)
* [vxlan-id](https://charmhub.io/gluetun-k8s/configurations#vxlan-id)
* [wireguard-addresses](https://charmhub.io/gluetun-k8s/configurations#wireguard-addresses)
* [wireguard-private-key-secret](https://charmhub.io/gluetun-k8s/configurations#wireguard-private-key-secret)
* [wireguard-public-key](https://charmhub.io/gluetun-k8s/configurations#wireguard-public-key)

[Learn about configurations >](https://juju.is/docs/juju/configuration#heading--application-configuration)

* cluster-cidrs | string

  Comma-separated pod/service CIDRs excluded from VPN routing.
  Example: "10.1.0.0/16,10.152.183.0/24" (MicroK8s)
* custom-overrides | string

  JSON object of extra environment variables to set on the gluetun container.
  Values are merged on top of the charm's built-in environment and take
  precedence on conflict (e.g. setting DOT here overrides dns-over-tls config).

  When set, config validation is relaxed (e.g. openvpn is allowed) and the
  charm runs in override mode with no config sanity guarantees.

  Example: '{"VPN\_TYPE": "openvpn", "OPENVPN\_USER": "foo", "OPENVPN\_PASSWORD": "bar"}'
* dns-over-tls | boolean

  Enable gluetun's internal DNS server with DNS-over-TLS.

  WARNING: Broken with pod-gateway sidecar. Gluetun binds its DNS server
  to port 53 on all interfaces, conflicting with pod-gateway's dnsmasq
  which binds to the VXLAN interface (172.16.0.1:53). This causes bind
  errors and connection instability. Keep disabled.
* extended-alert-rules | boolean

  Ship the extended Prometheus alert rule set on the metrics-endpoint
  relation in addition to the always-on baseline.

  See src/prometheus\_alert\_rules\_extended/gluetun-extended.rules.yaml.
* server-cities | string

  Comma-separated preferred server cities.
* server-countries | string

  Comma-separated preferred server countries.
* vpn-endpoint-ip | string

  VPN server IP address (custom provider).
* vpn-endpoint-port | int

  Default: 51820

  VPN server port (custom provider).
* vpn-provider | string

  VPN provider (nordvpn, mullvad, protonvpn, pia, surfshark, ivpn, windscribe, custom).
* vpn-type | string

  Default: wireguard

  VPN protocol (wireguard only in v1).
* vxlan-id | int

  Default: 42

  VXLAN tunnel ID (1-16777215).

  Unique ID for each gluetun-k8s instance in the cluster.
  If not running multiple instances, change the default only if you know what you're doing.
* wireguard-addresses | string

  WireGuard interface address in CIDR format.
  Example: "10.64.222.21/32"
* wireguard-private-key-secret | secret

  Juju secret with 'private-key' attribute containing WireGuard private key.

  juju add-secret vpn-key private-key="wOEI9rqqbDwnN8/..."
  juju grant-secret vpn-key gluetun
  juju config gluetun wireguard-private-key-secret=secret:vpn-key
* wireguard-public-key | string

  Server's WireGuard public key (custom provider).