VPN — traffic leaving the tunnel
Raised by the VPN checks. Is my VPN hiding me? explains how each is established.
| Code | Severity | Exit | What it means | What to do |
|---|---|---|---|---|
VPN-1 | critical | 1 | The download client's traffic is not going through the VPN: its public address does not match the tunnel's, or it has connectivity the tunnel does not. Peers in every swarm can see your home address. This is the one failure whose consequences reach outside your machine. | Stop torrent transfers now, then confirm the client shares the VPN's network — network_mode: service:<gateway> in the stack. |
VPN-2 | error | 1 | The VPN container that should carry traffic is not running. Nothing routes through a tunnel that is not up, so torrents cannot transfer — though nothing is leaking while it is down. | Start the form that includes it, then read its logs: lemonfiber logs <gateway>. |
VPN-3 | warning | 1 | The tunnel is up and the client could not reach the internet through it. Nothing is leaking, and torrents will not transfer until it can. | Confirm the client uses the VPN container's network. |
VPN-4 | warning | 1 | The tunnel is up and no port was forwarded, so peers cannot open connections to your client: download connectivity and seeding are both reduced. It cannot be fixed while the stack is running. | Regenerate the VPN credentials with port forwarding enabled. On ProtonVPN that means enabling NAT-PMP and picking a P2P server when the WireGuard configuration is generated. |
VPN-5 | error | 1 | The tunnel was dropped on purpose and the download client still reached the internet. Every torrent would continue in the open the moment the VPN fails, and a VPN that never fails is not a thing. | Enable the tunnel container's own killswitch. For gluetun that is FIREWALL=on, which is its default. |
VPN-6 | error | 1 | The killswitch test dropped the tunnel and could not confirm putting it back. The stack is left without one, and whether traffic is flowing outside it is exactly what is now unknown. | Restart the tunnel container now. |
VPN-7 | warning | 1 | The provider forwards one port and the download client is listening on another. Downloads still arrive, so nothing looks wrong — but no peer can reach the client, so it cannot seed and connects to fewer sources. | Run lemonfiber up to move the client onto the forwarded port. |
VPN-8 | warning | 1 | The stack declares torrents and no VPN-contained client to run them through, so every torrent is visible under this connection's own address — to the network it is on, and to every peer in the swarm. | Put the torrent client behind a VPN container in the stack. Where this is deliberate, answer it once with lemonfiber doctor --accept vpn.unprotected. |
What each severity and each exit means is on every error by code, beside every other family.