Bug: Gluetun not working with Hotspot shield VPN

[LorenzoZappa]

Is this urgent?

No

Host OS

Ubuntu Server

CPU arch

x86_64

VPN service provider

Custom

What are you using to run the container

docker run

What is the version of Gluetun

Running version latest built on 2025-11-22T15:26:51.882Z (commit 0fad44f)

What's the problem 🤔

I have been using gluetun with Hotspot Shield Vpn for a couple of years now. Until some months ago when all broke.
I have been using gluetun in a docker compose file, which is the following:

  gluetun:
    container_name: gluetun
    image: qmcgaw/gluetun:latest
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - /home/myname/prowlarr/vpn.ovpn:/gluetun/custom.conf:ro
    environment:
      #- FIREWALL=off 
      - VPN_SERVICE_PROVIDER=custom
      - VPN_TYPE=openvpn
      - OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
      - OPENVPN_USER=REDUCTED
      - OPENVPN_PASSWORD=REDUCTED
    ports:
      - 9696:9696 #Prowlarr
      - 8989:8989 #Sonarr
      - 8580:8580 #QBitTorrent
      - 6881:6881 #QBitTorrent
      - 6881:6881/udp
      - 7878:7878 #Radarr
      - 8686:8686 #Lidarr
    networks:
      - vpn_network
    healthcheck:
      start_period: 120s
      interval: 60s           # Check every 60s
      timeout: 10s
      retries: 3

I have also run it (to try and see if it was working this way) using the docker run command:

sudo docker run -it --rm --cap-add=NET_ADMIN --device /dev/net/tun -e VPN_SERVICE_PROVIDER=custom -e OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf -v /home/myname/prowlarr/vpn.ovpn:/gluetun/custom.conf:ro -e OPENVPN_USER="REDUCTED" -e OPENVPN_PASSWORD="REDUCTED" qmcgaw/gluetun

But nothing is working, with neither methods.
I have the vpn.ovpn file correctly downloaded from hotspot shield vpn and I have modified the remote penshop.us 8041 into remote 108.181.49.131 8041. Here is the beginning of such file:

client
dev tun
proto udp
remote 108.181.49.131 8041
verify-x509-name penshop.us name
resolv-retry infinite
remote-random
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ping 15
ping-restart 0
reneg-sec 0
remote-cert-tls server
comp-noadapt
auth-user-pass
auth sha256
cipher AES-128-CBC
verb 3

<cert>
-----BEGIN CERTIFICATE-----
REDUCTED

What can I do?

Share your logs (at least 10 lines)

Here is the error log (it is the same error both for docker-compose file and docker run):

2025-11-23T09:59:10Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1, assigned IP 172.17.0.3 and family v4
2025-11-23T09:59:10Z INFO [routing] adding route for 0.0.0.0/0
2025-11-23T09:59:10Z INFO [firewall] setting allowed subnets...
2025-11-23T09:59:10Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1, assigned IP 172.17.0.3 and family v4
2025-11-23T09:59:10Z INFO [dns] filter updated: 0 hostnames, 0 IPs, 0 IP prefixes blocked
2025-11-23T09:59:10Z INFO [dns] using plaintext DNS at address 1.1.1.1
2025-11-23T09:59:10Z INFO [healthcheck] listening on 127.0.0.1:9999
2025-11-23T09:59:10Z INFO [http server] http server listening on [::]:8000
2025-11-23T09:59:10Z INFO [firewall] allowing VPN connection...
2025-11-23T09:59:10Z INFO [openvpn] DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations. 
2025-11-23T09:59:10Z INFO [openvpn] OpenVPN 2.6.16 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2025-11-23T09:59:10Z INFO [openvpn] library versions: OpenSSL 3.5.4 30 Sep 2025, LZO 2.10
2025-11-23T09:59:10Z WARN [openvpn] --ping should normally be used with --ping-restart or --ping-exit
2025-11-23T09:59:10Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]108.181.49.131:8041
2025-11-23T09:59:10Z INFO [openvpn] UDPv4 link local: (not bound)
2025-11-23T09:59:10Z INFO [openvpn] UDPv4 link remote: [AF_INET]108.181.49.131:8041
2025-11-23T10:00:10Z WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
That error usually happens because either:

1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list

2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS

3. Your Internet connection is not working 🤯, ensure it works

4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose

2025-11-23T10:00:10Z INFO [openvpn] TLS Error: TLS handshake failed
2025-11-23T10:00:10Z INFO [openvpn] SIGUSR1[soft,tls-error] received, process restarting
2025-11-23T10:00:20Z WARN [openvpn] --ping should normally be used with --ping-restart or --ping-exit
2025-11-23T10:00:20Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]108.181.49.131:8041
2025-11-23T10:00:20Z INFO [openvpn] UDPv4 link local: (not bound)
2025-11-23T10:00:20Z INFO [openvpn] UDPv4 link remote: [AF_INET]108.181.49.131:8041
2025-11-23T10:01:21Z WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
🚒🚒🚒🚒🚒🚨🚨🚨🚨🚨🚨🚒🚒🚒🚒🚒
That error usually happens because either:

1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list

2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS

3. Your Internet connection is not working 🤯, ensure it works

4. Something else ➡️ https://github.com/qdm12/gluetun/issues/new/choose

2025-11-23T10:01:21Z INFO [openvpn] TLS Error: TLS handshake failed
2025-11-23T10:01:21Z INFO [openvpn] SIGUSR1[soft,tls-error] received, process restarting
2025-11-23T10:01:31Z WARN [openvpn] --ping should normally be used with --ping-restart or --ping-exit
2025-11-23T10:01:31Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]108.181.49.131:8041
2025-11-23T10:01:31Z INFO [openvpn] UDPv4 link local: (not bound)
2025-11-23T10:01:31Z INFO [openvpn] UDPv4 link remote: [AF_INET]108.181.49.131:8041

Share your configuration

[github-actions[bot]]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[qdm12]

The hostname changed ip address to 108.181.49.134 so try using that?

[REFUZIION]

I am also experiencing problems with my hotspot shield setup.
Seems however that this issue has nothing to do with Gluetun, I have just confirmed with Hotspot shield support that they have ended support for Linux and Routers according to this agent.

Unfortunately, I must inform you that we have recently discontinued support for Linux and routers. The Hotspot Shield application does not work on routers or Linux.

However, you can continue to use the service on the following compatible devices: Windows, Mac, iOS, Android, Android TV, and FireTV.

[LorenzoZappa]

The hostname changed ip address to 108.181.49.134 so try using that?

No, the hostnames are from 108.181.49.131 to 108.181.49.134. It depends on the load on each server, if you try again you will see that the ip changes continuously

$ dig penshop.us

;; ANSWER SECTION:
penshop.us.		30	IN	A	108.181.49.132

$ dig penshop.us

;; ANSWER SECTION:
penshop.us.		25	IN	A	108.181.49.134

I also tried .134 just to be sure but same error indeed.

[LorenzoZappa]

I am also experiencing problems with my hotspot shield setup. Seems however that this issue has nothing to do with Gluetun, I have just confirmed with Hotspot shield support that they have ended support for Linux and Routers according to this agent.

Unfortunately, I must inform you that we have recently discontinued support for Linux and routers. The Hotspot Shield application does not work on routers or Linux.
However, you can continue to use the service on the following compatible devices: Windows, Mac, iOS, Android, Android TV, and FireTV.

Thank you, I did not received any emails from them. At least they should inform their customers if they end support for a service like routers, I will write to them. Thanks again!

[REFUZIION]

I agree, them silently dropping openvpn protocol like that is a good way to lose customers. I already moved away from them to airvpn.

[LorenzoZappa]

They told me the same, they stopped supporting Linux and routers. The issue is that it is not written anywhere on the site and the page to create the vpn.ovpn file, name and password is still there and working! What a terrible company

[qdm12]

That's odd, it should work cross platform. I get it they don't want to support linux customers or maintain a linux client, that's fine. But openvpn/wireguard work no matter what OS is on the client device, it's just a protocol.
Maybe you need to find another vpn server or something?
Or did they drop support for Openvpn entirely, in which case, yes that would make sense.
Converting this to a discussion since I can't really help and don't have an account with them,

[LorenzoZappa]

I got this back from customer support:
"Unfortunately, as part of our updated device support policy, we are no longer able to provide native Linux support or router configuration files, including WireGuard configurations. We understand that this may disrupt your setup, and we truly appreciate your understanding."

I think I will have to switch vpn operator...

[REFUZIION]

Yep..