Cannot select a valid country #2904

LouisChoiniere · 2025-09-21T04:23:54Z

LouisChoiniere
Sep 21, 2025

Can't connect to the VPN with PIA indicating invalid country. I looked over google and the wiki, either I'm oblivious or there is something wrong somewhere. The only things I've modified from the default unraid template is: timezone, user, password, country, city.

Log and config tlrd
Log: ERROR VPN settings: provider settings: server selection: for VPN service provider private internet access: the country specified is not valid: one or more values is set but there is no possible value available
Config: -e 'SERVER_COUNTRIES'='Canada'

Canada is available for PIA -> https://www.privateinternetaccess.com/vpn-server

Logs

Running version latest built on 2025-09-11T19:17:25.911Z (commit 075cbd5)

🔧 Need help? ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new/choose
🐛 Bug? ✨ New feature? https://github.com/qdm12/gluetun/issues/new/choose
💻 Email? [email protected]
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2025-09-21T00:04:36-04:00 WARN PUBLICIP_PERIOD is no longer used. It is assumed from its non-zero value you want PUBLICIP_ENABLED=yes. Please migrate to use PUBLICIP_ENABLED only in the future.
2025-09-21T00:04:36-04:00 INFO [routing] default route found: interface eth0, gateway 172.17.0.1, assigned IP 172.17.0.4 and family v4
2025-09-21T00:04:36-04:00 INFO [routing] local ethernet link found: eth0
2025-09-21T00:04:36-04:00 INFO [routing] local ipnet found: 172.17.0.0/16
2025-09-21T00:04:36-04:00 INFO [firewall] enabling...
2025-09-21T00:04:36-04:00 INFO [firewall] enabled successfully
2025-09-21T00:04:36-04:00 INFO [storage] merging by most recent 20776 hardcoded servers and 20776 servers read from /gluetun/servers.json
2025-09-21T00:04:36-04:00 ERROR VPN settings: provider settings: server selection: for VPN service provider private internet access: the country specified is not valid: one or more values is set but there is no possible value available
2025-09-21T00:04:36-04:00 INFO Shutdown successful
========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================

Unraid docker run command

docker run
  -d
  --name='GluetunVPN'
  --net='bridge'
  --pids-limit 2048
  -e TZ="America/New_York"
  -e HOST_OS="Unraid"
  -e HOST_HOSTNAME="Anton"
  -e HOST_CONTAINERNAME="GluetunVPN"
  -e 'TZ'='America/New_York'
  -e 'VPN_SERVICE_PROVIDER'='private internet access'
  -e 'VPN_TYPE'='openvpn'
  -e 'VPN_INTERFACE'='tun0'
  -e 'VPN_ENDPOINT_PORT'=''
  -e 'VPN_ENDPOINT_IP'=''
  -e 'OPENVPN_PROTOCOL'='udp'
  -e 'OPENVPN_USER'='p85*****'
  -e 'OPENVPN_PASSWORD'='********'
  -e 'OPENVPN_VERSION'='2.6'
  -e 'OPENVPN_VERBOSITY'='1'
  -e 'OPENVPN_FLAGS'=''
  -e 'OPENVPN_CIPHERS'=''
  -e 'OPENVPN_AUTH'=''
  -e 'OPENVPN_PROCESS_USER'='no'
  -e 'OPENVPN_IPV6'='off'
  -e 'OPENVPN_CUSTOM_CONFIG'=''
  -e 'WIREGUARD_IMPLEMENTATION'='auto'
  -e 'WIREGUARD_PRIVATE_KEY'=''
  -e 'WIREGUARD_PRESHARED_KEY'=''
  -e 'WIREGUARD_PUBLIC_KEY'=''
  -e 'WIREGUARD_ADDRESSES'=''
  -e 'WIREGUARD_ALLOWED_IPS'='0.0.0.0/0,::/0'
  -e 'WIREGUARD_MTU'='1400'
  -e 'WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL'=''
  -e 'SERVER_COUNTRIES'='Canada'
  -e 'SERVER_CITIES'='Montreal'
  -e 'SERVER_NAMES'=''
  -e 'SERVER_HOSTNAMES'=''
  -e 'VPN_PORT_FORWARDING'='off'
  -e 'VPN_PORT_FORWARDING_LISTENING_PORT'=''
  -e 'FIREWALL'='on'
  -e 'FIREWALL_VPN_INPUT_PORTS'=''
  -e 'FIREWALL_INPUT_PORTS'=''
  -e 'FIREWALL_OUTBOUND_SUBNETS'=''
  -e 'FIREWALL_DEBUG'='off'
  -e 'LOG_LEVEL'='info'
  -e 'DOT'='on'
  -e 'DOT_PROVIDERS'='cloudflare'
  -e 'DOT_PRIVATE_ADDRESS'='127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff:7f00:1/104,::ffff:a00:0/104,::ffff:a9fe:0/112,::ffff:ac10:0/108,::ffff:c0a8:0/112'
  -e 'DOT_CACHING'='on'
  -e 'DOT_IPV6'='off'
  -e 'BLOCK_MALICIOUS'='on'
  -e 'BLOCK_SURVEILLANCE'='off'
  -e 'BLOCK_ADS'='off'
  -e 'UNBLOCK'=''
  -e 'DNS_UPDATE_PERIOD'='24h'
  -e 'DNS_ADDRESS'=''
  -e 'DNS_KEEP_NAMESERVER'='off'
  -e 'HTTPPROXY'='off'
  -e 'HTTPPROXY_LOG'='off'
  -e 'HTTPPROXY_USER'=''
  -e 'HTTPPROXY_PASSWORD'=''
  -e 'HTTPPROXY_STEALTH'='off'
  -e 'SHADOWSOCKS'='off'
  -e 'SHADOWSOCKS_LOG'='off'
  -e ':8388'=':8388'
  -e 'SHADOWSOCKS_PASSWORD'=''
  -e 'SHADOWSOCKS_CIPHER'='chacha20-ietf-poly1305'
  -e 'UPDATER_PERIOD'='0'
  -e 'PORT_FORWARD_ONLY'='off'
  -e 'VPN_PORT_FORWARDING_STATUS_FILE'='/gluetun/forwarded_port'
  -e 'VPN_PORT_FORWARDING_UP_COMMAND'=''
  -e 'VPN_PORT_FORWARDING_DOWN_COMMAND'=''
  -e 'VPN_PORT_FORWARDING_PROVIDER'=''
  -e 'VPN_PORT_FORWARDING_USERNAME'=''
  -e 'VPN_PORT_FORWARDING_PASSWORD'=''
  -e 'HEALTH_SERVER_ADDRESS'='127.0.0.1:9999'
  -e 'HEALTH_TARGET_ADDRESS'='cloudflare.com:443'
  -e 'HEALTH_VPN_DURATION_INITIAL'='6s'
  -e 'HEALTH_VPN_DURATION_ADDITION'='5s'
  -e 'PUBLICIP_FILE'='/gluetun/ip'
  -e 'PUBLICIP_PERIOD'='12h'
  -e 'VERSION_INFORMATION'='on'
  -e 'HTTP_CONTROL_SERVER_LOG'='on'
  -e 'PUID'='1000'
  -e 'PGID'='1000'
  -l net.unraid.docker.managed=dockerman
  -l net.unraid.docker.webui='http://[IP]:[PORT:8000]'
  -l net.unraid.docker.icon='https://raw.githubusercontent.com/qdm12/gluetun/master/doc/logo_256.png'
  -p '8888:8888/tcp'
  -p '8000:8000/tcp'
  -v '/mnt/user/appdata/gluetun':'/gluetun':'rw'
  --cap-add=NET_ADMIN
  --restart always 'qmcgaw/gluetun'

xml

<?xml version="1.0"?>
<Container version="2">
  <Name>GluetunVPN</Name>
  <Repository>qmcgaw/gluetun</Repository>
  <Registry>https://hub.docker.com/r/qmcgaw/gluetun</Registry>
  <Network>bridge</Network>
  <MyIP/>
  <Shell>sh</Shell>
  <Privileged>false</Privileged>
  <Support>https://forums.unraid.net/topic/111725-support-diamondprecisioncomputing-all-images-and-files</Support>
  <Project>https://github.com/qdm12/gluetun</Project>
  <Overview>...</Overview>
  <Category>Security: Network:VPN spotlight:</Category>
  <WebUI>http://[IP]:[PORT:8000]</WebUI>
  <TemplateURL>https://raw.githubusercontent.com/DiamondPrecisionComputing/unraid-templates/master/templates/GluetunVPN.xml</TemplateURL>
  <Icon>https://raw.githubusercontent.com/qdm12/gluetun/master/doc/logo_256.png</Icon>
  <ExtraParams>--cap-add=NET_ADMIN --restart always</ExtraParams>
  <PostArgs/>
  <CPUset/>
  <DateInstalled>1758428209</DateInstalled>
  <DonateText>This app and docker were generously made by qmcgaw. If you like the project please consider making a donation toward his efforts and check out the MANY other projects he has created on GitHub.</DonateText>
  <DonateLink>https://www.paypal.me/qmcgaw</DonateLink>
  <Requires/>
  <Config Name="TIMEZONE" Target="TZ" Default="" Mode="" Description="Specify a timezone to use to have correct log times. i.e. Europe/London" Type="Variable" Display="always" Required="true" Mask="false">America/New_York</Config>
  <Config Name="config" Target="/gluetun" Default="/mnt/user/appdata/gluetun" Mode="rw" Description="" Type="Path" Display="always" Required="false" Mask="false">/mnt/user/appdata/gluetun</Config>
  <Config Name="VPN_SERVICE_PROVIDER" Target="VPN_SERVICE_PROVIDER" Default="private internet access|airvpn|cyberghost|expressvpn|fastestvpn|hidemyass|ipvanish|ivpn|mullvad|nordvpn|perfect privacy|privado|privatevpn|protonvpn|purevpn|slickvpn|surfshark|torguard|vpnsecure|vpn unlimited|vyprvpn|wevpn|windscribe|custom" Mode="" Description="VPN Service Provider" Type="Variable" Display="always" Required="true" Mask="false">private internet access</Config>
  <Config Name="VPN_TYPE" Target="VPN_TYPE" Default="openvpn|wireguard" Mode="" Description="VPN Type. Default is OpenVPN. Note not all providers support Wireguard." Type="Variable" Display="always" Required="true" Mask="false">openvpn</Config>
  <Config Name="VPN_INTERFACE" Target="VPN_INTERFACE" Default="tun0" Mode="" Description="OPTIONAL: Specify a custom network interface name to use. (e.g. tun0 or wg0)" Type="Variable" Display="always" Required="true" Mask="false">tun0</Config>
  <Config Name="VPN_ENDPOINT_PORT" Target="VPN_ENDPOINT_PORT" Default="" Mode="" Description="OPTIONAL: Custom OpenVPN/Wireguard server endpoint port to use" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="VPN_ENDPOINT_IP" Target="VPN_ENDPOINT_IP" Default="" Mode="" Description="OPTIONAL: Specify a target VPN IP address to use" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="OPENVPN_PROTOCOL" Target="OPENVPN_PROTOCOL" Default="udp|tcp" Mode="" Description="OPTIONAL: Container Variable: OPENVPN_PROTOCOL" Type="Variable" Display="always" Required="false" Mask="false">udp</Config>
  <Config Name="OPENVPN_USER" Target="OPENVPN_USER" Default="" Mode="" Description="" Type="Variable" Display="always" Required="false" Mask="false">p85*****</Config>
  <Config Name="OPENVPN_PASSWORD" Target="OPENVPN_PASSWORD" Default="" Mode="" Description="" Type="Variable" Display="always" Required="false" Mask="true">*********</Config>
  <Config Name="OPENVPN_VERSION" Target="OPENVPN_VERSION" Default="2.6|2.5" Mode="" Description="OPTIONAL: Set the OpenVPN version to run" Type="Variable" Display="always" Required="false" Mask="false">2.6</Config>
  <Config Name="OPENVPN_VERBOSITY" Target="OPENVPN_VERBOSITY" Default="0|1|2|3|4|5|6" Mode="" Description="OPTIONAL: OpenVPN verbosity level" Type="Variable" Display="always" Required="false" Mask="false">1</Config>
  <Config Name="OPENVPN_FLAGS" Target="OPENVPN_FLAGS" Default="" Mode="" Description="OPTIONAL: Space delimited OpenVPN flags to pass to openvpn" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="OPENVPN_CIPHERS" Target="OPENVPN_CIPHERS" Default="" Mode="" Description="OPTIONAL: Specify one or more custom ciphers to use" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="OPENVPN_AUTH" Target="OPENVPN_AUTH" Default="" Mode="" Description="OPTIONAL: Specify a custom auth algorithm to use. i.e. sha256" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="OPENVPN_PROCESS_USER" Target="OPENVPN_PROCESS_USER" Default="no|yes" Mode="" Description="OPTIONAL: Run OpenVPN as root" Type="Variable" Display="always" Required="false" Mask="false">no</Config>
  <Config Name="OPENVPN_IPV6" Target="OPENVPN_IPV6" Default="off|on" Mode="" Description="OPTIONAL: Enable tunneling of IPv6 (only for Mullvad)" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="OPENVPN_CUSTOM_CONFIG" Target="OPENVPN_CUSTOM_CONFIG" Default="" Mode="" Description="OPTIONAL: The path to your OpenVPN configuration file. This implies VPN_SERVICE_PROVIDER=custom" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="WIREGUARD_IMPLEMENTATION" Target="WIREGUARD_IMPLEMENTATION" Default="auto|userspace|kernelspace" Mode="" Description="Implementation of Wireguard to use." Type="Variable" Display="always" Required="false" Mask="false">auto</Config>
  <Config Name="WIREGUARD_PRIVATE_KEY" Target="WIREGUARD_PRIVATE_KEY" Default="" Mode="" Description="OPTINAL: 32 bytes private key in base64 format" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="WIREGUARD_PRESHARED_KEY" Target="WIREGUARD_PRESHARED_KEY" Default="" Mode="" Description="OPTINAL: 32 bytes pre-shared key in base64 format" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="WIREGUARD_PUBLIC_KEY" Target="WIREGUARD_PUBLIC_KEY" Default="" Mode="" Description="Only for VPN_SERVICE_PROVIDER=custom and VPN_TYPE=wireguard: Wireguard server public key" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="WIREGUARD_ADDRESSES" Target="WIREGUARD_ADDRESSES" Default="" Mode="" Description="Wireguard IP network in the format xx.xx.xx.xx/xx. Wireguard interface address, only required if VPN_TYPE=wireguard. Note this is usually specific by user and the same for all servers." Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="WIREGUARD_ALLOWED_IPS" Target="WIREGUARD_ALLOWED_IPS" Default="0.0.0.0/0,::/0" Mode="" Description="OPTIONAL: CSV of IP address ranges, only required if VPN_TYPE=wireguard. Note this is usually specific by user and the same for all servers." Type="Variable" Display="always" Required="false" Mask="false">0.0.0.0/0,::/0</Config>
  <Config Name="WIREGUARD_MTU" Target="WIREGUARD_MTU" Default="1400" Mode="" Description="OPTIONAL: Any positive value up to 65535, only required if VPN_TYPE=wireguard." Type="Variable" Display="always" Required="false" Mask="false">1400</Config>
  <Config Name="WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL" Target="WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL" Default="" Mode="" Description="OPTIONAL: Wireguard persistent keepalive interval. i.e. 25s." Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="SERVER_COUNTRIES" Target="SERVER_COUNTRIES" Default="" Mode="" Description="OPTIONAL: Comma separated list of VPN countries. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="always" Required="false" Mask="false">Canada</Config>
  <Config Name="SERVER_CITIES" Target="SERVER_CITIES" Default="" Mode="" Description="OPTIONAL: Comma separated list of VPN cities. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="always" Required="false" Mask="false">Montreal</Config>
  <Config Name="SERVER_NAMES" Target="SERVER_NAMES" Default="" Mode="" Description="OPTIONAL: (PIA ONLY) Single server hostname. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="SERVER_HOSTNAMES" Target="SERVER_HOSTNAMES" Default="" Mode="" Description="OPTIONAL: Comma separated list of server hostnames. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="VPN_PORT_FORWARDING" Target="VPN_PORT_FORWARDING" Default="off|on" Mode="" Description="OPTIONAL: Enable custom port forwarding code for supported providers. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="VPN_PORT_FORWARDING_LISTENING_PORT" Target="VPN_PORT_FORWARDING_LISTENING_PORT" Default="" Mode="" Description="OPTIONAL: Port redirection for the VPN server side port forwarded. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="FIREWALL" Target="FIREWALL" Default="on|off" Mode="" Description="Turn on or off the container built-in firewall. You should turn off for debugging purposes only." Type="Variable" Display="always" Required="false" Mask="false">on</Config>
  <Config Name="FIREWALL_VPN_INPUT_PORTS" Target="FIREWALL_VPN_INPUT_PORTS" Default="" Mode="" Description="OPTIONAL: Comma separated list of ports to allow from the VPN server side (useful for vyprvpn port forwarding)" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="FIREWALL_INPUT_PORTS" Target="FIREWALL_INPUT_PORTS" Default="" Mode="" Description="OPTIONAL: Comma separated list of ports to allow through the default interface. This seems needed for Unraid containers and Kubernetes sidecars." Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="FIREWALL_OUTBOUND_SUBNETS" Target="FIREWALL_OUTBOUND_SUBNETS" Default="" Mode="" Description="OPTIONAL: You first need to set your LAN CIDR in FIREWALL_OUTBOUND_SUBNETS. For example with FIREWALL_OUTBOUND_SUBNETS=192.168.1.0/24" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="FIREWALL_DEBUG" Target="FIREWALL_DEBUG" Default="off|on" Mode="" Description="OPTIONAL: Prints every firewall related command. You should use it for debugging purposes only." Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="LOG_LEVEL" Target="LOG_LEVEL" Default="info" Mode="" Description="OPTIONAL: Container Variable: LOG_LEVEL" Type="Variable" Display="always" Required="false" Mask="false">info</Config>
  <Config Name="DOT" Target="DOT" Default="on|off" Mode="" Description="(Recommended: on) Activate DNS over TLS with Unbound" Type="Variable" Display="always" Required="false" Mask="false">on</Config>
  <Config Name="DOT_PROVIDERS" Target="DOT_PROVIDERS" Default="cloudflare|google|quad9|quadrant|cleanbrowsing" Mode="" Description="Comma delimited list of DNS over TLS providers" Type="Variable" Display="always" Required="false" Mask="false">cloudflare</Config>
  <Config Name="DOT_PRIVATE_ADDRESS" Target="DOT_PRIVATE_ADDRESS" Default="127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff:7f00:1/104,::ffff:a00:0/104,::ffff:a9fe:0/112,::ffff:ac10:0/108,::ffff:c0a8:0/112" Mode="" Description="All private CIDRs ranges. Comma separated list of CIDRs or single IP addresses Unbound won't resolve to. Note that the default setting prevents DNS rebinding" Type="Variable" Display="always" Required="false" Mask="false">127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff:7f00:1/104,::ffff:a00:0/104,::ffff:a9fe:0/112,::ffff:ac10:0/108,::ffff:c0a8:0/112</Config>
  <Config Name="DOT_CACHING" Target="DOT_CACHING" Default="on|off" Mode="" Description="OPTIONAL: Unbound caching" Type="Variable" Display="always" Required="false" Mask="false">on</Config>
  <Config Name="DOT_IPV6" Target="DOT_IPV6" Default="on|off" Mode="" Description="OPTIONAL: DNS IPv6 resolution" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="BLOCK_MALICIOUS" Target="BLOCK_MALICIOUS" Default="on|off" Mode="" Description="OPTIONAL: Block malicious hostnames and IPs with Unbound" Type="Variable" Display="always" Required="false" Mask="false">on</Config>
  <Config Name="BLOCK_SURVEILLANCE" Target="BLOCK_SURVEILLANCE" Default="on|off" Mode="" Description="OPTIONAL: Block surveillance hostnames and IPs with Unbound" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="BLOCK_ADS" Target="BLOCK_ADS" Default="on|off" Mode="" Description="OPTIONAL: Block ads hostnames and IPs with Unbound" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="UNBLOCK" Target="UNBLOCK" Default="" Mode="" Description="OPTIONAL: Comma separated list of domain names to leave unblocked with Unbound. i.e. domain1.com,x.domain2.co.uk" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="DNS_UPDATE_PERIOD" Target="DNS_UPDATE_PERIOD" Default="24h" Mode="" Description="OPTIONAL: Period to update block lists and cryptographic files and restart Unbound. Set to 0 to deactivate updates. i.e. 0, 30s, 5m, 24h" Type="Variable" Display="always" Required="false" Mask="false">24h</Config>
  <Config Name="DNS_ADDRESS" Target="DNS_ADDRESS" Default="" Mode="" Description="OPTIONAL: IP address to use as DNS resolver if DOT is off" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="DNS_KEEP_NAMESERVER" Target="DNS_KEEP_NAMESERVER" Default="off|on" Mode="" Description="OPTIONAL: Keep the nameservers in /etc/resolv.conf untouched, but disabled DNS blocking features" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="HTTPPROXY" Target="HTTPPROXY" Default="off|on" Mode="" Description="OPTIONAL: Enable the internal HTTP proxy" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="HTTPPROXY_LOG" Target="HTTPPROXY_LOG" Default="off|on" Mode="" Description="OPTIONAL: Logs every tunnel requests" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="HTTPPROXY_PORT" Target="8888" Default="8888" Mode="tcp" Description="Internal port number for the HTTP proxy to listen on" Type="Port" Display="always" Required="true" Mask="false">8888</Config>
  <Config Name="HTTPPROXY_USER" Target="HTTPPROXY_USER" Default="" Mode="" Description="OPTIONAL: Username to use to connect to the HTTP proxy" Type="Variable" Display="always" Required="false" Mask="false"/>
  <Config Name="HTTPPROXY_PASSWORD" Target="HTTPPROXY_PASSWORD" Default="" Mode="" Description="OPTIONAL: Password to use to connect to the HTTP proxy" Type="Variable" Display="always" Required="false" Mask="true"/>
  <Config Name="ENABLE_HTTPPROXY_STEALTH" Target="HTTPPROXY_STEALTH" Default="off|on" Mode="" Description="OPTIONAL: Stealth mode means HTTP proxy headers are not added to your requests" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="SHADOWSOCKS" Target="SHADOWSOCKS" Default="off|on" Mode="" Description="OPTIONAL: Enable the internal Shadowsocks proxy" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="SHADOWSOCKS_LOG" Target="SHADOWSOCKS_LOG" Default="off|on" Mode="" Description="OPTIONAL: Enable Shadowsocks logging" Type="Variable" Display="always" Required="false" Mask="false">off</Config>
  <Config Name="SHADOWSOCKS_LISTENING_ADDRESS" Target=":8388" Default=":8388" Mode="" Description="OPTIONAL: Port number for the HTTP proxy to listen on" Type="Variable" Display="always" Required="true" Mask="false">:8388</Config>
  <Config Name="SHADOWSOCKS_PASSWORD" Target="SHADOWSOCKS_PASSWORD" Default="" Mode="" Description="OPTIONAL: Password to use to connect to Shadowsocks" Type="Variable" Display="always" Required="false" Mask="true"/>
  <Config Name="SHADOWSOCKS_CIPHER" Target="SHADOWSOCKS_CIPHER" Default="chacha20-ietf-poly1305|aes-128-gcm|aes-256-gcm" Mode="" Description="OPTIONAL: Cipher to use for Shadowsocks" Type="Variable" Display="always" Required="false" Mask="false">chacha20-ietf-poly1305</Config>
  <Config Name="UPDATER_PERIOD" Target="UPDATER_PERIOD" Default="0" Mode="" Description="OPTIONAL: Period to update all VPN servers information in memory and to /gluetun/servers.json. Set to 0 to disable. This does a burst of DNS over TLS requests, which may be blocked if you set BLOCK_MALICIOUS=on for example. Valid duration string such as 24h." Type="Variable" Display="advanced" Required="false" Mask="false">0</Config>
  <Config Name="PORT_FORWARD_ONLY" Target="PORT_FORWARD_ONLY" Default="off|on" Mode="" Description="OPTIONAL: Filter only port-forwarding enabled (aka *p2p*) servers (pia and protonvpn only)" Type="Variable" Display="advanced" Required="false" Mask="false">off</Config>
  <Config Name="VPN_PORT_FORWARDING_STATUS_FILE" Target="VPN_PORT_FORWARDING_STATUS_FILE" Default="/gluetun/forwarded_port" Mode="" Description="OPTIONAL: File path to use for writing the forwarded port obtained. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="advanced" Required="false" Mask="false">/gluetun/forwarded_port</Config>
  <Config Name="VPN_PORT_FORWARDING_UP_COMMAND" Target="VPN_PORT_FORWARDING_UP_COMMAND" Default="" Mode="" Description="OPTIONAL: Command to run when port forwarding has finished setting up (pia and protonvpn only). https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="VPN_PORT_FORWARDING_DOWN_COMMAND" Target="VPN_PORT_FORWARDING_DOWN_COMMAND" Default="" Mode="" Description="OPTIONAL: Command to run when port forwarding has finished tearing down (pia and protonvpn only). https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="VPN_PORT_FORWARDING_PROVIDER" Target="VPN_PORT_FORWARDING_PROVIDER" Default="" Mode="" Description="OPTIONAL: Choose the custom port forwarding code to use. This is useful when using the custom provider with Wireguard. For PIA, make sure you set SERVER_NAMES=xxxx. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="VPN_PORT_FORWARDING_USERNAME" Target="VPN_PORT_FORWARDING_USERNAME" Default="" Mode="" Description="OPTIONAL: This is needed when using the custom provider with Wireguard with PIA. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="VPN_PORT_FORWARDING_PASSWORD" Target="VPN_PORT_FORWARDING_PASSWORD" Default="" Mode="" Description="OPTIONAL: This is needed when using the custom provider with Wireguard with PIA. https://github.com/qdm12/gluetun-wiki" Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="HEALTH_SERVER_ADDRESS" Target="HEALTH_SERVER_ADDRESS" Default="127.0.0.1:9999" Mode="" Description="OPTIONAL: Internal Health Server Listening Addroess" Type="Variable" Display="advanced" Required="false" Mask="false">127.0.0.1:9999</Config>
  <Config Name="HEALTH_TARGET_ADDRESS" Target="HEALTH_TARGET_ADDRESS" Default="cloudflare.com:443" Mode="" Description="OPTIONAL: Address used to check tunnel health" Type="Variable" Display="advanced" Required="false" Mask="false">cloudflare.com:443</Config>
  <Config Name="HEALTH_VPN_DURATION_INITIAL" Target="HEALTH_VPN_DURATION_INITIAL" Default="6s" Mode="" Description="OPTIONAL: Initial health check duration in seconds." Type="Variable" Display="advanced" Required="false" Mask="false">6s</Config>
  <Config Name="HEALTH_VPN_DURATION_ADDITION" Target="HEALTH_VPN_DURATION_ADDITION" Default="5s" Mode="" Description="OPTIONAL: Subsequent health check duration in seconds." Type="Variable" Display="advanced" Required="false" Mask="false">5s</Config>
  <Config Name="PUBLICIP_FILE" Target="PUBLICIP_FILE" Default="/gluetun/ip" Mode="" Description="OPTIONAL: Filepath to store the public IP address assigned" Type="Variable" Display="advanced" Required="false" Mask="false">/gluetun/ip</Config>
  <Config Name="PUBLICIP_PERIOD" Target="PUBLICIP_PERIOD" Default="12h" Mode="" Description="OPTIONAL: Period to check for public IP address. Set to 0 to disable." Type="Variable" Display="advanced" Required="false" Mask="false">12h</Config>
  <Config Name="VERSION_INFORMATION" Target="VERSION_INFORMATION" Default="on|off" Mode="" Description="OPTIONAL: Filepath to store the public IP address assigned" Type="Variable" Display="advanced" Required="false" Mask="false">on</Config>
  <Config Name="HTTP_CONTROL_SERVER_PORT" Target="8000" Default="8000" Mode="tcp" Description="" Type="Port" Display="advanced" Required="true" Mask="false">8000</Config>
  <Config Name="HTTP_CONTROL_SERVER_LOG" Target="HTTP_CONTROL_SERVER_LOG" Default="on|off" Mode="" Description="OPTIONAL: Enable logging of HTTP requests" Type="Variable" Display="advanced" Required="false" Mask="false">on</Config>
  <Config Name="PUID" Target="PUID" Default="" Mode="" Description="" Type="Variable" Display="advanced" Required="false" Mask="false">1000</Config>
  <Config Name="PGID" Target="PGID" Default="" Mode="" Description="" Type="Variable" Display="advanced" Required="false" Mask="false">1000</Config>
</Container>

Answered by raph521

Sep 21, 2025

I think for PIA, you need to use the SERVER_REGIONS environment variable. That's documented on the wiki here:

https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/private-internet-access.md

Even with that, a value of Canada wouldn't work because PIA has multiple regions within Canada. You can see them all with the following command:

docker run --rm -v /tmp:/gluetun ghcr.io/qdm12/gluetun:latest format-servers -private-internet-access | column -t -s "|" -o "|" | egrep "Region|CA"

| Region                             | Hostname                               | Name             | TCP | UDP | Port forwarding |
| CA Montreal                        | `ca-montreal.privacy.network`   …

View full answer

raph521 · 2025-09-21T16:19:07Z

raph521
Sep 21, 2025

I think for PIA, you need to use the SERVER_REGIONS environment variable. That's documented on the wiki here:

https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/private-internet-access.md

Even with that, a value of Canada wouldn't work because PIA has multiple regions within Canada. You can see them all with the following command:

docker run --rm -v /tmp:/gluetun ghcr.io/qdm12/gluetun:latest format-servers -private-internet-access | column -t -s "|" -o "|" | egrep "Region|CA"

| Region                             | Hostname                               | Name             | TCP | UDP | Port forwarding |
| CA Montreal                        | `ca-montreal.privacy.network`          | montreal424      | ✅  | ✅  | ✅              |
| CA Montreal                        | `ca-montreal.privacy.network`          | montreal431      | ✅  | ✅  | ✅              |
| CA Montreal                        | `ca-montreal.privacy.network`          | montreal433      | ✅  | ✅  | ✅              |
| CA Montreal                        | `ca-montreal.privacy.network`          | montreal435      | ✅  | ✅  | ✅              |
| CA Montreal                        | `ca-montreal.privacy.network`          | montreal436      | ✅  | ✅  | ✅              |
| CA Ontario                         | `ca-ontario.privacy.network`           | ontario415       | ✅  | ✅  | ✅              |
| CA Ontario                         | `ca-ontario.privacy.network`           | ontario418       | ✅  | ✅  | ✅              |
| CA Ontario                         | `ca-ontario.privacy.network`           | ontario443       | ✅  | ✅  | ✅              |
| CA Ontario Streaming Optimized     | `ca-ontario-so.privacy.network`        | ontario416       | ✅  | ✅  | ✅              |
| CA Toronto                         | `ca-toronto.privacy.network`           | toronto401       | ✅  | ✅  | ✅              |
| CA Toronto                         | `ca-toronto.privacy.network`           | toronto415       | ✅  | ✅  | ✅              |
| CA Toronto                         | `ca-toronto.privacy.network`           | toronto416       | ✅  | ✅  | ✅              |
| CA Toronto                         | `ca-toronto.privacy.network`           | toronto420       | ✅  | ✅  | ✅              |
| CA Toronto                         | `ca-toronto.privacy.network`           | toronto422       | ✅  | ✅  | ✅              |
| CA Toronto                         | `ca-toronto.privacy.network`           | toronto423       | ✅  | ✅  | ✅              |
| CA Toronto                         | `ca-toronto.privacy.network`           | toronto424       | ✅  | ✅  | ✅              |
| CA Toronto                         | `ca-toronto.privacy.network`           | toronto426       | ✅  | ✅  | ✅              |
| CA Vancouver                       | `ca-vancouver.privacy.network`         | vancouver422     | ✅  | ✅  | ✅              |
| CA Vancouver                       | `ca-vancouver.privacy.network`         | vancouver423     | ✅  | ✅  | ✅              |
| CA Vancouver                       | `ca-vancouver.privacy.network`         | vancouver432     | ✅  | ✅  | ✅              |
| CA Vancouver                       | `ca-vancouver.privacy.network`         | vancouver433     | ✅  | ✅  | ✅              |
| CA Vancouver                       | `ca-vancouver.privacy.network`         | vancouver434     | ✅  | ✅  | ✅              |

1 reply

LouisChoiniere Sep 22, 2025
Author

Thank you! That was the solution I could not find that in the docs

For others, the solution was to set SERVER_REGIONS to 'CA Montreal' or whichever you want

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Cannot select a valid country #2904

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Cannot select a valid country #2904

Uh oh!

LouisChoiniere Sep 21, 2025

Replies: 1 comment · 1 reply

Uh oh!

raph521 Sep 21, 2025

Uh oh!

LouisChoiniere Sep 22, 2025 Author

LouisChoiniere
Sep 21, 2025

Replies: 1 comment 1 reply

raph521
Sep 21, 2025

LouisChoiniere Sep 22, 2025
Author