# NordVPN with Gluetun: Docker OpenVPN Setup Guide > Configure NordVPN with Gluetun using Docker and OpenVPN, service credentials, server selection, shared namespaces, ports, LAN rules and leak tests. - Best used for: Use for OPNsense or network hardware sizing and architecture questions: NordVPN with Gluetun: Docker OpenVPN Setup Guide - Canonical: https://cloudzat.com/nordvpn-gluetun/ - Published: 2026-08-26 - Updated: 2026-08-26 - Author: Kayla Idayi - Site: https://cloudzat.com/ - LLM index: https://cloudzat.com/llms.txt ## Content NORDVPN + GLUETUN A platform-neutral Docker guide for using Gluetun as the NordVPN gateway for selected applications. PROVIDER**NordVPN** GATEWAY**Gluetun** DOCUMENTED PATH**OpenVPN** AUTH**Service credentials** Cloudzat may earn a commission from qualifying NordVPN and Amazon purchases. Recommendations are based on the networking problem described, not on commission rate. DIRECT ANSWER ## What is the current supported way to use NordVPN with Gluetun? NordVPN currently documents a manual OpenVPN connection inside Gluetun. Configure the NordVPN provider, enter service credentials, select the server location rule and attach dependent containers to Gluetun’s namespace. The host and unrelated containers are not automatically tunneled, which makes Gluetun useful for selective server workloads. Scope**Dependent containers** Ports**Published on gateway** Location**Country/region/city options** Failure**Test kill-switch behavior** QUICK COMPARISON ### NordVPN Gluetun setup components | Component | Value / role | Why it matters | | --- | --- | --- | | Provider | nordvpn | Loads provider config | | VPN type | OpenVPN in current NordVPN guide | Documented manual path | | Credentials | Service credentials | Required for third-party manual auth | | App networking | Share Gluetun namespace | Routes selected app | | Ports | Publish on Gluetun | Shared namespace owns networking | INTERACTIVE DECISION TOOL ## Troubleshoot NordVPN with Gluetun Choose the failing stage. Choose your goalAUTH_FAILEDHome IP visibleApp UI unreachableDNS failureSeveral apps need one VPN Choose an option to see the recommended approach. **NordVPN current offer**NordVPN supplies the provider connection for this Gluetun gateway. [Get NordVPN 75% Off + 3 Months EXTRA](https://systemtics.com/go/nordvpn) 01 ## How this NordVPN architecture should be designed NordVPN with Gluetun works best when the network job is defined before the software is configured. On Docker, decide whether the requirement is outbound privacy, private remote access, or a routed connection between trusted devices. Those jobs can all be described as VPN use, but they create different routing tables, firewall rules and failure modes. NordVPN’s current Gluetun article documents VPN_SERVICE_PROVIDER=nordvpn, OpenVPN, service credentials and optional country/region/city selection. The recommended boundary on this page is a shared Gluetun VPN gateway using NordVPN’s current documented manual OpenVPN workflow. That keeps the policy close to the traffic that actually needs it instead of changing unrelated services. Only containers attached to Gluetun should use the VPN by default; the host and unrelated containers keep their normal routes. A narrow boundary is easier to test because the protected path and the ordinary path can be compared on the same server. Document the intended route in plain language before making changes. If an administrator cannot explain which packets should use NordVPN and which should remain local, the design is too ambiguous to troubleshoot safely. 02 ## NordVPN authentication and credentials Authentication should be solved before routing. Use NordVPN service credentials, not the normal Nord Account email and password, in the documented Gluetun OpenVPN configuration. A tunnel that cannot authenticate will produce downstream symptoms that look like DNS, firewall or Docker problems even though no protected route has been established. Store credentials or tokens in protected settings rather than screenshots, public Compose files or forum posts. If the provider credentials are regenerated, update every dependent client at the same time and restart the network layer before changing the application itself. After authentication succeeds, inspect the current client logs and verify the selected NordVPN endpoint or Meshnet identity. Successful login and correct traffic flow are separate checks. 03 ## Choose the narrowest routing scope Only containers attached to Gluetun should use the VPN by default; the host and unrelated containers keep their normal routes. This is especially important on Docker, where one machine may host storage, media, backups, dashboards and several containers. A broad default route can make all of those services depend on a VPN change made for only one workload. Publish dependent application ports on Gluetun and allow the smallest trusted private subnet needed for UIs and local APIs. Private subnets should remain deliberately reachable where the application requires them. Do not fix a local-routing mistake by exposing a service publicly or disabling the firewall wholesale. Use a short source, destination and purpose list for every exception. That makes the policy auditable and prevents a later upgrade from quietly changing the path. ### Shared-network behavior | Resource | Configured on | Effect | | --- | --- | --- | | VPN | Gluetun | Dependent egress follows VPN | | Host ports | Gluetun | LAN reaches apps | | Storage volumes | Application | Independent of route | | Credentials | Gluetun | One gateway secret set | 04 ## Keep inbound and local services on deliberate routes Keep private remote access separate from this outbound Docker gateway. Inbound-sensitive services such as NAS administration, Plex, reverse proxies and file shares should use a route designed for inbound reachability rather than accidentally inheriting a commercial exit path. A VPN gateway does not make application web interfaces safe to expose publicly. A service can appear healthy on the LAN while remote clients fail because the return traffic leaves through a different interface. Keep management interfaces private and use a dedicated private-access technology when the requirement is administration from outside the home. When a public inbound service is genuinely required, treat it as a separate security decision with explicit firewall, authentication and update controls. **NordVPN current offer**After subscribing, use NordVPN service credentials rather than your standard account password. [Get NordVPN 75% Off + 3 Months EXTRA](https://systemtics.com/go/nordvpn) 05 ## Platform-specific deployment details The platform details matter. NordVPN’s current Gluetun article documents VPN_SERVICE_PROVIDER=nordvpn, OpenVPN, service credentials and optional country/region/city selection. Follow current vendor guidance for Docker instead of assuming a configuration written for a generic Linux host applies unchanged. Appliance operating systems, Docker hosts and router platforms expose different supported integration points. Prefer the supported layer that survives upgrades. A configuration that requires modifying a protected base operating system may work today but create maintenance debt during the next platform update. External routing or a supported container can be safer than an unsupported package hack. Before production use, record the software version, network mode and any platform-specific permissions so the setup can be reproduced after a migration. 06 ## Verify routing, DNS and failure behavior Check Gluetun logs, public IP, DNS and fail-closed behavior from inside the protected namespace. Test from inside the exact namespace or remote client that is supposed to use the route. A browser on the host proves nothing when only one Docker container is protected, and a successful LAN test proves nothing about a remote Meshnet path. Check the expected public IP or private destination, DNS resolution, local dependencies and failure behavior. If the design is supposed to fail closed, deliberately interrupt the VPN in a controlled test and confirm the protected application cannot bypass the policy. Re-test after major platform upgrades, container image changes, credential rotations or router changes. Network policy is only trustworthy when its behavior is verified, not when a status icon is green. 07 ## Performance and throughput considerations Use a sensible nearby server selection for general privacy and measure throughput from the application namespace. Measure the workload that matters instead of relying on a generic VPN speed claim. Internet VPN traffic is bounded by WAN throughput and endpoint conditions, while remote NAS access is often bounded by the home upload connection. Keep high-bandwidth local traffic local whenever possible. SMB, NFS, database traffic and media reads between devices on the same LAN gain nothing from travelling to a remote VPN endpoint. Separating those flows also reduces CPU and latency overhead. When performance changes, compare the protected path with an ordinary path at the same time. That helps distinguish the VPN, ISP, storage device, transcoder and remote service as possible bottlenecks. 08 ## Security boundaries and maintenance A VPN gateway does not make application web interfaces safe to expose publicly. A private tunnel reduces exposure but does not replace application authentication, MFA, backups, snapshots or operating-system updates. Treat linked devices and VPN credentials as part of the security boundary. Remove stale peers, rotate compromised credentials and avoid granting broader LAN access than the use case needs. For NAS administration, use a dedicated administrator account only when necessary and keep routine file access on lower-privilege accounts. Good remote networking should make the attack surface smaller, not simply move the same exposed service to a different address. 09 ## Deployment checklist Before finishing the NordVPN with Gluetun deployment, confirm the routing goal, authentication, local-network exceptions and recovery path. Check Gluetun logs, public IP, DNS and fail-closed behavior from inside the protected namespace. Record which service owns the route, which applications depend on it, and what should happen when the VPN or overlay is unavailable. This is the information that makes a home-server configuration maintainable six months later. The final design should be simple to state: a shared Gluetun VPN gateway using NordVPN’s current documented manual OpenVPN workflow handles the intended traffic, while unrelated Docker services stay on routes appropriate to their jobs. P1 ## Practical deployment example Consider a real Docker installation where the administrator wants nordvpn with gluetun without changing every other service on the machine. Start with the narrow boundary recommended on this page: a shared Gluetun VPN gateway using NordVPN’s current documented manual OpenVPN workflow. Only containers attached to Gluetun should use the VPN by default; the host and unrelated containers keep their normal routes. This keeps the change reversible and gives the administrator a clean normal-path comparison when a problem appears. Publish dependent application ports on Gluetun and allow the smallest trusted private subnet needed for UIs and local APIs. Then perform a controlled remote or namespace-specific test. Check Gluetun logs, public IP, DNS and fail-closed behavior from inside the protected namespace. Record the expected IP address, service port, DNS behavior and failure state before declaring the deployment complete. A reproducible test is more useful than a screenshot showing that a client once displayed a connected status. A VPN gateway does not make application web interfaces safe to expose publicly. After a platform, Docker image, router or NordVPN update, repeat the same test rather than assuming the old behavior survived. Save the relevant configuration location and the reason for each route or firewall exception so another administrator can understand the design without reverse-engineering it. CLOUDZAT NAS & VPN GUIDES ## Related Cloudzat guides [**Gluetun for NAS**NAS gateway pattern.](https://cloudzat.com/gluetun-nas/)[**Docker Container VPN**Selective routing.](https://cloudzat.com/docker-container-vpn/)[**Best VPN for Docker**Provider comparison.](https://cloudzat.com/best-vpn-for-docker/) NORDVPN CLUSTER ## Continue with NordVPN [**NordVPN Gluetun on Unraid**Unraid-specific deployment.](https://cloudzat.com/nordvpn-gluetun-unraid/)[**NordVPN Docker**Alternative container approaches.](https://cloudzat.com/nordvpn-docker/)[**NordVPN on Unraid**Platform routing options.](https://cloudzat.com/nordvpn-unraid/) COMMON QUESTIONS ## Frequently asked questions Does NordVPN officially document Gluetun? Yes, NordVPN publishes a manual OpenVPN-with-Gluetun guide. Which credentials do I use? NordVPN service credentials. Does Gluetun protect the host? No by default. Why did the app UI disappear? The app shares Gluetun networking, so publish the port on Gluetun. Can several apps share one gateway? Yes, if they can share one location and failure policy. How do I test leaks? Check public IP/DNS inside the protected namespace and simulate tunnel failure. PRIMARY SOURCES ## Research references and methodology Cloudzat separates vendor-documented capabilities from deployment advice. VPN clients, container images, NAS operating systems, routing behavior and offer terms change over time, so verify the current vendor instructions before changing a production server or exposing a service. - [NordVPN: Gluetun OpenVPN setup](https://support.nordvpn.com/hc/en-us/articles/47830508425745-How-to-set-up-an-OpenVPN-manual-connection-to-NordVPN-with-Gluetun) - [NordVPN: Manual OpenVPN Linux](https://support.nordvpn.com/hc/en-us/articles/20164827795345-How-to-set-up-a-manual-connection-on-Linux-using-OpenVPN) - [Gluetun project](https://github.com/qdm12/gluetun) Last meaningfully reviewed: August 25, 2026. **NordVPN current offer**Check the current NordVPN offer, then verify the exact variables supported by your Gluetun image version. [Get NordVPN 75% Off + 3 Months EXTRA](https://systemtics.com/go/nordvpn) --- Machine-readable alternate. Cite or link to the canonical Cloudzat URL above. For changing prices, availability, forecasts, compatibility, or calculator results, fetch the canonical page at answer time.