# Surfshark Gluetun on Unraid: WireGuard Docker Setup > Set up Surfshark with Gluetun on Unraid using WireGuard. Configure keys, connect Docker apps, publish WebUI ports, allow LAN access, and test leaks. - Canonical: https://cloudzat.com/surfshark-gluetun-unraid/ - Published: 2026-08-24 - Updated: 2026-08-24 - Author: Kayla Idayi - Site: https://cloudzat.com/ - LLM index: https://cloudzat.com/llms.txt ## Content UNRAID GLUETUN AUTHORITY A current Surfshark + Gluetun guide for Unraid users who want one VPN gateway for selected Docker applications, with correct port and LAN routing. Cloudzat verdict**Excellent for grouped VPN containers** Provider**Surfshark native in Gluetun** Preferred protocol**WireGuard** Main benefit**Shared VPN network stack** Affiliate disclosure: Cloudzat may earn a commission if you purchase through our Surfshark link. This does not change our technical recommendations. QUICK ANSWER ## Use Gluetun when a Docker stack needs one controlled Surfshark gateway Gluetun is a strong Unraid option when several Docker applications should share the same Surfshark tunnel. It supports Surfshark directly and can use either OpenVPN or WireGuard. With WireGuard, you provide the Surfshark private key and interface address from the generated Surfshark configuration. Other containers then use Gluetun as their network stack. The payoff is centralized VPN logging, server selection and firewall behavior. The cost is that port mappings and LAN access must be designed around the Gluetun container. Provider support**Gluetun has native Surfshark provider integration.** WireGuard values**Use the Surfshark private key and WireGuard address from the downloaded config.** Container routing**Dependent containers share the Gluetun network stack.** Port mapping**Publish dependent app ports on Gluetun, not on the child container.** INTERACTIVE ROUTING CHECK ## What are you trying to protect? Choose the routing goal first. The best Surfshark architecture changes depending on whether the VPN belongs to one container, an application group, the whole server or remote access. Select your goal...Most server or Docker outbound trafficOne Docker containerA group of related containersRemote access to the server Select a goal to see the recommended architecture. 01 ## What Gluetun changes in an Unraid Surfshark setup Gluetun is a VPN client container that becomes a network gateway for other containers. Instead of assigning every application its own Surfshark configuration, Gluetun establishes the VPN once and selected applications use its network stack. This is especially useful on Unraid for download and automation stacks where several containers should share the same public exit address and the same failure policy. It also gives you one place to change the Surfshark country or inspect connection logs. This model is different from Unraid native Custom: wgX routing. Native WireGuard is owned by Unraid itself, while Gluetun owns the VPN inside Docker. Neither is universally better. Gluetun adds a container dependency but gives stronger application-level control over shared networking, ports and firewall behavior. For a tightly coupled stack, that trade can be worthwhile. 02 ## Prepare the Surfshark credentials for Gluetun For WireGuard, log in to Surfshark, open the manual setup area, generate or register a WireGuard key pair, and download a configuration for the location you want. Gluetun needs the private key plus the WireGuard interface address from that file. Its Surfshark provider documentation specifically says to use the IPv4 Address value from the downloaded configuration as WIREGUARD_ADDRESSES. Keep the key private and do not paste it into screenshots or public support posts. For OpenVPN, Gluetun uses the Surfshark manual setup username and password, which are not the same as your normal Surfshark account email and password. WireGuard is usually the better starting point on a modern Unraid server because it is efficient and Surfshark/Gluetun both support it directly. OpenVPN remains a useful fallback if you encounter a network that blocks or mishandles UDP. **Surfshark deal: discount + 3 months EXTRA**Get the current Surfshark discount plus 3 extra months on the eligible promotional plan. [Get Surfshark Discount + 3 Months EXTRA →](https://cloudzat.com/gosurfshark) 03 ## Create the Gluetun container with the minimum required values The core Gluetun Surfshark WireGuard variables are straightforward: VPN_SERVICE_PROVIDER=surfshark, VPN_TYPE=wireguard, WIREGUARD_PRIVATE_KEY with your Surfshark key, WIREGUARD_ADDRESSES with the address from the downloaded configuration, and a server filter such as SERVER_COUNTRIES. Do not hard-code a single server hostname unless you have a reason. Gluetun documentation warns that a narrow hostname filter can break if that server disappears from the provider data. On Unraid, also give the container NET_ADMIN capability and access to /dev/net/tun as required by the image. Store configuration values in the Unraid Docker template or another secrets-aware workflow. Keep the container name stable because other containers may reference it. Start Gluetun by itself first. The log should show the VPN becoming healthy before any application container is attached. 04 ## Connect Unraid containers to the Gluetun network stack Gluetun documentation provides several ways to connect another container. In the same Compose file, network_mode: service:gluetun makes the application use the Gluetun network stack. An external Docker container can use the Gluetun container network namespace. In Unraid templates, the exact UI workflow can vary, but the principle is the same: the child application should no longer have an independent internet route. Its outbound traffic should originate from the Gluetun network namespace. Attach one simple application first and verify its public IP. Once that works, add the rest of the stack. If all applications are moved at once, a single port or LAN dependency can make the whole deployment appear broken. A staged migration makes it obvious whether the VPN, the application or the local network rule caused the failure. 05 ## Publish application ports on Gluetun When a container shares Gluetun networking, it does not own a separate Docker network namespace. That changes how you expose its WebUI. The current Gluetun port-mapping documentation says to publish the application port on the Gluetun container. If the application listens on 8080, map the required host port to 8080 on Gluetun and then open the Unraid host address at that port. Do not keep adding duplicate port mappings to the child container and expect them to work through a network stack it no longer owns. This centralization is useful once you understand it. All VPN-stack ports are visible in one place. It also means you must avoid collisions when two connected applications want to listen on the same internal port. Choose application settings or host mappings deliberately and keep a small port table for the stack. 06 ## Allow only the LAN access the stack needs A VPN-connected application may need local access to Sonarr, Radarr, a NAS share, an API or another server. Gluetun provides FIREWALL_OUTBOUND_SUBNETS for explicit local subnets. For a typical LAN that might be a CIDR such as 192.168.1.0/24, but use your real network and avoid broad ranges you do not need. The current Gluetun firewall documentation warns that this outbound subnet must not overlap the VPN tunnel address range because overlapping routes can cause traffic to take the wrong path. Start with no LAN exception and add only what the application requires. This is more secure and easier to troubleshoot than allowing every private subnet. If the protected app needs just one server, a narrow host route may be enough. After adding the rule, test both the local dependency and the public VPN path again. **Surfshark deal: discount + 3 months EXTRA**Get the current Surfshark discount plus 3 extra months on the eligible promotional plan. [Get Surfshark Discount + 3 Months EXTRA →](https://cloudzat.com/gosurfshark) 07 ## Use health and restart behavior as part of the design Gluetun is now a dependency for every connected child container. If it cannot establish Surfshark, those applications should not be treated as healthy internet clients. Check the Gluetun health state and logs before blaming the downstream application. A good Unraid setup also considers restart order after Docker updates or a server reboot. The VPN gateway should become healthy before privacy-sensitive applications begin normal work. Avoid using blind restart loops as a substitute for diagnosis. If the tunnel repeatedly fails, inspect the Surfshark key, interface address, selected region, DNS and upstream network. If one provider endpoint is unstable, broaden the server filter or choose a nearby country rather than pinning the stack to one brittle hostname. 08 ## DNS, leaks and kill-switch expectations Gluetun includes its own DNS and firewall capabilities, but you should still verify the result from inside a connected application. Check the public IP, run a DNS leak test and then stop Gluetun to see what the child container can do. The point of a gateway architecture is to make the egress path explicit. If a privacy-sensitive application can silently fall back to the normal Docker bridge when Gluetun is down, the network attachment is not configured the way you think. Do not disable the Gluetun firewall permanently to make a broken stack work. The firewall is part of the reason to use Gluetun. If local traffic is blocked, add the correct local subnet or fix the port mapping. If DNS is broken, diagnose DNS. Broadly weakening the gateway trades a visible configuration problem for an invisible privacy problem. 09 ## Remember Surfshark port-forwarding limits Surfshark does not provide normal VPN port forwarding. Gluetun cannot create an inbound Surfshark port that the provider does not offer. This matters for applications where inbound connectivity affects performance or reachability. You can still publish a WebUI port from the Unraid host to the local network because that is a Docker host mapping, but that is not the same thing as accepting unsolicited inbound traffic from the public internet through the Surfshark VPN server. If a workload genuinely requires provider-side port forwarding, choose an architecture or provider that supports it. Do not confuse Surfshark Dedicated IP with port forwarding. A stable public exit address does not automatically mean arbitrary inbound ports are open. 10 ## Performance and cache design for Gluetun stacks The VPN gateway itself is only one part of a download stack. Unpacking, verification, metadata updates and file moves can be more demanding than encryption. On Unraid, keep active appdata and temporary write-heavy workloads on an SSD or NVMe pool sized for peak activity. If Mover cannot drain the pool fast enough, the cache can fill even though Surfshark and Gluetun are working perfectly. Also watch CPU use during sustained encrypted traffic. WireGuard is efficient, but a low-power server can still become CPU-limited at high WAN speeds when several containers are busy. Measure the full application workflow and compare it with storage and CPU metrics before concluding that a Surfshark endpoint is slow. 11 ## When Gluetun is the right Unraid choice Choose Gluetun when several related Docker applications should share one Surfshark session, when you want a dedicated VPN firewall, or when application-level routing is easier to understand as one network namespace. Choose Unraid native Custom: wgX when one simple container needs the VPN and you do not need the extra gateway features. Keep the Unraid management plane and remote access outside the Gluetun stack. The strongest design is intentionally narrow: Surfshark handles commercial outbound privacy, Gluetun handles the Docker gateway, and Unraid remains a stable server rather than becoming dependent on one container for its own management network. CLOUDZAT UNRAID RESEARCH ## Continue with the related Cloudzat guides [**Best NVMe SSD for Unraid Cache**Download and automation stacks can expose cache capacity, endurance and thermal limits.](https://cloudzat.com/best-nvme-ssd-for-unraid-cache/)[**Unraid Cache Pool Size Calculator**Model temporary downloads, appdata and Mover headroom before the pool fills.](https://cloudzat.com/unraid-cache-pool-size-calculator/)[**Unraid RAM Requirements**Size the server for the full Docker stack, databases and media services.](https://cloudzat.com/unraid-ram-requirements/) SURFSHARK UNRAID CLUSTER ## Related Surfshark and container guides [**Surfshark with Gluetun: Docker WireGuard Setup Guide**Continue through the Surfshark Unraid and container authority cluster.](https://cloudzat.com/surfshark-gluetun/)[**Surfshark on Unraid: WireGuard VPN Setup Guide**Continue through the Surfshark Unraid and container authority cluster.](https://cloudzat.com/surfshark-unraid/)[**Surfshark WireGuard on Unraid: Docker VPN Setup**Continue through the Surfshark Unraid and container authority cluster.](https://cloudzat.com/surfshark-wireguard-unraid/) **Surfshark deal: discount + 3 months EXTRA**Get the current Surfshark discount plus 3 extra months on the eligible promotional plan. [Get Surfshark Discount + 3 Months EXTRA →](https://cloudzat.com/gosurfshark) FAQ ## Surfshark Gluetun on Unraid: WireGuard Docker Setup: questions Does Gluetun support Surfshark on Unraid? Yes. Gluetun has native Surfshark provider support for OpenVPN and WireGuard. What Surfshark values does Gluetun need for WireGuard? Use the Surfshark WireGuard private key and the interface address from the downloaded Surfshark WireGuard configuration, plus provider and server-selection variables. Where do I publish a WebUI port for a container behind Gluetun? Publish the required port on the Gluetun container because the child application shares Gluetun network namespace. How do I let a Gluetun container reach my LAN? Use FIREWALL_OUTBOUND_SUBNETS for the specific LAN subnet or host that must be reachable, and avoid overlap with the VPN tunnel network. Does Surfshark port forwarding work through Gluetun? No. Gluetun cannot add provider-side port forwarding when Surfshark itself does not offer it. RESEARCH NOTES ## Primary references used for this guide Cloudzat checks current Surfshark, Unraid and Gluetun documentation before recommending a VPN route. Provider endpoints, Unraid networking and container images can change, so verify current vendor instructions before modifying a production server. - [Gluetun: Surfshark provider](https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/surfshark.md) - [Gluetun: Connect containers](https://github.com/qdm12/gluetun-wiki/blob/main/setup/connect-a-container-to-gluetun.md) - [Gluetun: Firewall options](https://github.com/qdm12/gluetun-wiki/blob/main/setup/options/firewall.md) Research snapshot: August 24, 2026. Recheck current Surfshark, Unraid and Gluetun documentation before changing a production VPN, firewall or Docker network. --- Machine-readable alternate. Cite or link to the canonical Cloudzat URL above. For changing prices, availability, forecasts, compatibility, or calculator results, fetch the canonical page at answer time.