# Firewall options

## Environment variables

💁 The following environment variables are all optional.

| Variable | Default | Choices | Description |
| --- | --- | --- | --- |
| `FIREWALL_VPN_INPUT_PORTS` | | i.e. `1000,8080` | Comma separated list of ports to allow from the VPN server side |
| `FIREWALL_INPUT_PORTS` | | i.e. `1000,8000` | Comma separated list of ports to allow through the default interface. This seems needed for Kubernetes sidecars. |
| `FIREWALL_IPTABLES_LOG_LEVEL` | Global log level if not `debug`, otherwise `info` | `debug`, `info`, `warn`, `error` | Sets the log level for iptables commands. Use `debug` for detailed logging. |
| `FIREWALL_OUTBOUND_SUBNETS` | | i.e. `192.168.1.0/24,192.168.10.121/32,10.0.0.5/28` | Comma separated subnets that Gluetun and the containers sharing its network stack are allowed to access. This involves firewall and routing modifications. |

> **Note**: Make sure that `FIREWALL_OUTBOUND_SUBNETS` does **not** overlap with the VPN tunnel address range (for example a `10.x.x.x/` Wireguard network). If it overlaps, Gluetun may route traffic intended for the VPN (such as Proton VPN's NAT-PMP port forwarding to `10.x.x.1:5351`) via the outbound subnet instead, which breaks port forwarding and can cause `connection refused` errors. See also [gluetun#3013](https://github.com/qdm12/gluetun/issues/3013) for a real-world example.
> **Note**: If you access IPs in `FIREWALL_OUTBOUND_SUBNETS` through a DNS entry that points to them, they need to be in `DNS_REBINDING_PROTECTION_EXEMPT_HOSTNAMES` as gluetun blocks dns entries pointing to private IP addresses by default (DNS rebinding protection).

## Custom iptables rules

If you need to specify additional iptables rules to be run after the built-in iptables rules, you can use the file at `/iptables/post-rules.txt` with one iptables command per line and these will automatically be run on container start.
For example the `/iptables/post-rules.txt` file could contain:

```sh
iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p udp --sport 1197 -j ACCEPT
iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p tcp --sport 1197 -j ACCEPT
```