[PR #1] [MERGED] Add Gluetun Gateway LXC #1

New issue

Closed

opened 2026-06-05 02:01:30 +08:00 by ivenator1 · 0 comments

ivenator1 commented

2026-06-05 02:01:30 +08:00

Owner

📋 Pull Request Information

Original PR: https://github.com/ivenator1/ProxmoxVED/pull/1
Author: @ivenator1
Created: 6/5/2026
Status: ✅ Merged
Merged: 6/5/2026
Merged by: @ivenator1

Base: main ← Head: claude/gluetun-gateway-lxc-eb7AR

📝 Commits (3)

a2f0a46 Add Gluetun Gateway LXC
47d073f Make Gluetun Gateway provider-agnostic and add post-install next steps
4c694d6 Keep ProtonVPN in example provider lists (gateway stays provider-agnostic)

📊 Changes

4 files changed (+464 additions, -0 deletions)

View changed files

➕ ct/gluetun-gateway.sh (+72 -0)
➕ ct/headers/gluetun-gateway (+6 -0)
➕ install/gluetun-gateway-install.sh (+334 -0)
➕ json/gluetun-gateway.json (+52 -0)

📄 Description

Gluetun Gateway LXC

A new, standalone app that runs Gluetun as a VPN gateway/router for other LXCs on a shared VXLAN network. It is separate from the existing default gluetun app, which is left untouched.

What it does

Routes all client internet traffic out through the VPN tunnel of any Gluetun-supported provider (WireGuard or OpenVPN).
Kill switch: if the tunnel drops, client internet is blocked; client LAN access is unaffected. Implemented via Gluetun's native /iptables/post-rules.txt hook (rules only exist while the tunnel is up).
Tunneled DNS: dnsmasq listens on the VXLAN interface and forwards to Gluetun's localhost DoT resolver → upstream through the tunnel.
NAT-PMP port forwarding: exposed via the status file and a locked-down control-server endpoint (GET /v1/portforward is public; all other control routes require an API key).
Auto-restart: Gluetun's built-in health monitor + systemd Restart=on-failure + a watchdog timer.
Single commented config at /etc/gluetun/gluetun.env documenting the gateway's net1 step and the full client two-interface setup (default route via gateway on one NIC; no default gateway + specific subnets on the other), DNS/RA suppression, and verification.
Prompted, carrier-independent eth1 addressing that converges whenever the VXLAN is wired, plus home-dir symlinks (~/config.env, ~/forwarded_port, ~/public_ip).
Post-install next-steps message guiding the operator (set provider/credentials, attach VXLAN NIC, apply config, point clients).

Files added

ct/gluetun-gateway.sh
install/gluetun-gateway-install.sh
json/gluetun-gateway.json
ct/headers/gluetun-gateway

Notes

Client LXC two-interface networking and the host-side pct set -net1 ... step are documented in the config file (the builder only provisions one NIC).
Built from source against qdm12/gluetun, reusing the existing repo idioms (setup_go, fetch_and_deploy_gh_release, check_for_gh_release).

Validated with bash -n on all scripts and jq on the JSON.

https://claude.ai/code/session_01MArGgscNi1BHQCoizeepTZ

Generated by Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/ivenator1/ProxmoxVED/pull/1 **Author:** [@ivenator1](https://github.com/ivenator1) **Created:** 6/5/2026 **Status:** ✅ Merged **Merged:** 6/5/2026 **Merged by:** [@ivenator1](https://github.com/ivenator1) **Base:** `main` ← **Head:** `claude/gluetun-gateway-lxc-eb7AR` --- ### 📝 Commits (3) - [`a2f0a46`](https://github.com/ivenator1/ProxmoxVED/commit/a2f0a465052f7a866678fc4468e9924c525d295e) Add Gluetun Gateway LXC - [`47d073f`](https://github.com/ivenator1/ProxmoxVED/commit/47d073fd5bafc09f7822415a52db095e8cf5127a) Make Gluetun Gateway provider-agnostic and add post-install next steps - [`4c694d6`](https://github.com/ivenator1/ProxmoxVED/commit/4c694d6516f5fc5b3ef338ff5af383ea269ac7a9) Keep ProtonVPN in example provider lists (gateway stays provider-agnostic) ### 📊 Changes **4 files changed** (+464 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `ct/gluetun-gateway.sh` (+72 -0) ➕ `ct/headers/gluetun-gateway` (+6 -0) ➕ `install/gluetun-gateway-install.sh` (+334 -0) ➕ `json/gluetun-gateway.json` (+52 -0) </details> ### 📄 Description ## Gluetun Gateway LXC A new, standalone app that runs Gluetun as a **VPN gateway/router** for other LXCs on a shared VXLAN network. It is separate from the existing default `gluetun` app, which is left untouched. ### What it does - Routes all client internet traffic out through the VPN tunnel of **any Gluetun-supported provider** (WireGuard or OpenVPN). - **Kill switch:** if the tunnel drops, client internet is blocked; client LAN access is unaffected. Implemented via Gluetun's native `/iptables/post-rules.txt` hook (rules only exist while the tunnel is up). - **Tunneled DNS:** `dnsmasq` listens on the VXLAN interface and forwards to Gluetun's localhost DoT resolver → upstream through the tunnel. - **NAT-PMP port forwarding:** exposed via the status file and a locked-down control-server endpoint (`GET /v1/portforward` is public; all other control routes require an API key). - **Auto-restart:** Gluetun's built-in health monitor + `systemd Restart=on-failure` + a watchdog timer. - **Single commented config** at `/etc/gluetun/gluetun.env` documenting the gateway's `net1` step and the full client two-interface setup (default route via gateway on one NIC; no default gateway + specific subnets on the other), DNS/RA suppression, and verification. - **Prompted, carrier-independent `eth1` addressing** that converges whenever the VXLAN is wired, plus home-dir symlinks (`~/config.env`, `~/forwarded_port`, `~/public_ip`). - Post-install **next-steps** message guiding the operator (set provider/credentials, attach VXLAN NIC, apply config, point clients). ### Files added - `ct/gluetun-gateway.sh` - `install/gluetun-gateway-install.sh` - `json/gluetun-gateway.json` - `ct/headers/gluetun-gateway` ### Notes - Client LXC two-interface networking and the host-side `pct set -net1 ...` step are documented in the config file (the builder only provisions one NIC). - Built from source against `qdm12/gluetun`, reusing the existing repo idioms (`setup_go`, `fetch_and_deploy_gh_release`, `check_for_gh_release`). Validated with `bash -n` on all scripts and `jq` on the JSON. https://claude.ai/code/session_01MArGgscNi1BHQCoizeepTZ --- _Generated by [Claude Code](https://claude.ai/code/session_01MArGgscNi1BHQCoizeepTZ)_ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

ivenator1

2026-06-05 02:01:30 +08:00