v3.40.3

Fixes

• Fixed previous fix on ProtonVPN: credentials are not required to be set.

v3.40.2

Fixes

• DNS: fix DNS_KEEP_NAMESERVER behavior
  • no longer hangs the code when establishing the VPN connection
  • no longer makes Gluetun panic when exiting
• ProtonVPN:
  • updater authentication fixed for some accounts
    • If updating servers data periodically, use UPDATER_PROTONVPN_EMAIL instead of UPDATER_PROTONVPN_USERNAME (retrocompatibility maintained)
    • If using the CLI, use -proton-email instead of -proton-username (retrocompatibility maintained)
  • ProtonVPN servers data updated to include paid servers
• Servers storage: do not crash the container but log a warning if flushing merged servers to file fails

v3.40.1

Bug-fix-only release on top of v3.40.0.

v3.41.0 coming soon 🎉 If you have any issues with v3.40.0 please report it rather soon please 🙏 !

Fixes

• Wireguard: specify IP family for new route (#2629)
• PUBLICIP_ENABLED is now respected
• Port forwarding: clear port file instead of removing it (see why)
• Control server: log out full URL path not just bottom request URI
• cli openvpnconfig command no longer panics due to missing SetDefaults call
• Providers specific:
  • Cyberghost: log warnings from updater resolver
  • ExpressVPN: update hardcoded servers data (#2888) My mistake, the commit was forgotten. It will be part of v3.40.4. For now use the latest image.
  • ProtonVPN: authenticated servers data updating (#2878)
  • VPN Unlimited: update certificates value (#2835)

PS: sorry for the double notification, CI failed on the first release try

v3.40.0

Happy holidays release time 🎄 🎅 🎁

💁 If anything doesn't work compared to previous release, please create an issue and revert to using v3.39.1 😉

ℹ️ Life is pretty busy all around currently (moving soon, new job, ill parent) so I might be even slower than usual until summer 2025, I'll do my best!

Features

• VPN: run WaitForDNS before querying the public ip address (partly address #2325)
• DNS: replace unbound with qdm12/[email protected] (#1742 & later commits)
  • Faster start up
  • Clearer error messages
  • Allow for more Gluetun-specific customization
• Port forwarding:
  • VPN_PORT_FORWARDING_UP_COMMAND option (#2399)
  • VPN_PORT_FORWARDING_DOWN_COMMAND option
• Config allow irrelevant server filters to be set (see #2337)
  • Disallow setting a server filter when there is no choice available
  • Allow setting an invalid server filter when there is at least one choice available
  • Log at warn level when an invalid server filter is set
• Firewall: support custom ICMP rules
• Healthcheck:
  • log out last error when auto healing VPN
  • run TLS handshake after TCP dial if address has 443 port
• Public IP:
  • retry fetching information when connection refused error is encountered (partly address #2325)
  • support custom API url echoip#https://... (#2529)
  • resilient public ip fetcher with backup sources (#2518)
  • add ifconfigco option and cloudflare option (#2502)
  • PUBLICIP_ENABLED replaces PUBLICIP_PERIOD
    • PUBLICIP_ENABLED (on, off) can be set to enable or not public ip data fetching on VPN connection
    • PUBLICIP_PERIOD=0 still works to indicate to disable public ip fetching
    • PUBLICIP_PERIOD != 0 means to enable public ip fetching
    • Warnings logged when using PUBLICIP_PERIOD
• STORAGE_FILEPATH option (#2416)
  • STORAGE_FILEPATH= disables storing to and reading from a local servers.json file
  • STORAGE_FILEPATH defaults to /gluetun/servers.json
• Netlink: debug rule logs contain the ip family
• internal/tun: mention in 'operation not permitted' error the user should specify --device /dev/net/tun (resolves #2606)
• Control server role based authentication system (#2434) (part of v3.39.1 as a bugfix)
  • Parse toml configuration file, see https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/control-server.md#authentication
  • Retro-compatible with existing AND documented routes, until after this release
  • Log a warning if an unprotected-by-default route is accessed unprotected
  • Authentication methods: none, apikey, basic
  • genkey command to generate API keys
• FastestVPN: add aes-256-gcm to OpenVPN ciphers list
• Private Internet Access updater: use v6 API to get servers data
• IPVanish: update servers data
• PrivateVPN: native port forwarding support (#2285)
• Privado: update servers data
• format-servers command supports the json format option

Fixes

• Wireguard: change default WIREGUARD_MTU from 1400 to 1320 (partially address #2533)
• OpenVPN: set default mssfix to 1320 for all providers with no default already set (partially address #2533)
• Control server: fix logged wiki authentication section link
• Firewall:
  • iptables list uses -n flag for testing iptables path (#2574)
  • deduplicate VPN address accept rule for multiple default routes with the same network interface
  • deduplicate ipv6 multicast output accept rules
  • ipv6 multicast output address value fixed
  • log warning if ipv6 nat filter is not supported instead of returning an error (allow to port forward redirect for IPv4 and not IPv6 if IPv6 NAT is not supported and fixed #2503)
• Wireguard:
  • Point to Kubernetes wiki page when encountering IP rule add file exists error (#2526)
• IPVanish:
  • fix openvpn configuration by updating CA value and add comp-lzo option
  • update openvpn zip file url for updater
• Perfect Privacy: update openvpn expired certificates (#2542)
• Public IP: lock settings during entire update to prevent race conditions

Documentation

• Dockerfile
  • add missing OPENVPN_MSSFIX environment variable
  • add missing option definitions
    • STREAM_ONLY
    • FREE_ONLY
  • Document PORT_FORWARD_ONLY is for both PIA and ProtonVPN

Maintenance

Code quality

• Remove github.com/qdm12/golibs dependency
  • Implement friendly duration formatting locally
  • implement github.com/qdm12/golibs/command locally (#2418)
• internal/natpmp: fix determinism for test Test_Client_ExternalAddress
• let system handle OS signals after first one to request a program stop
• internal/routing: remove redundant rule ip rule in error messages
• internal/netlink debug log ip rule commands in netlink instead of routing package
• internal/server: move log middleware to internal/server/middlewares/log
• use gofumpt for code formatting
• Fix gopls govet errors
• Upgrade linter from v1.56.2 to v1.61.0
  • Remove no longer needed exclude rules
  • Add new exclude rules for printf govet errors
  • Remove deprecated linters execinquery and exportloopref
  • Rename linter goerr113 to err113 and gomnd to mnd
  • Add new linters and update codebase: canonicalheader, copyloopvar, fatcontext, intrange

Dependencies

• Upgrade Go from 1.22 to 1.23
• Bump vishvananda/netlink from v1.2.1-beta.2 to v1.2.1
• Bump github.com/qdm12/gosettings from v0.4.3 to v0.4.4
  • Better support for quote expressions especially for commands such as VPN_PORT_FORWARDING_UP_COMMAND
• Bump github.com/breml/rootcerts from 0.2.18 to 0.2.19 (#2601)
• Bump golang.org/x/net from 0.25.0 to 0.31.0 (#2401, #2578)
• Bump golang.org/x/sys from 0.260.0 to 0.27.0 (#2404, #2573)
• Bump golang.org/x/text from 0.15.0 to 0.17.0 (#2400)
• Bump github.com/klauspost/compress from 1.17.8 to 1.17.11 (#2319, #2550)
• Bump github.com/pelletier/go-toml/v2 from 2.2.2 to 2.2.3 (#2549)
• Bump google.golang.org/protobuf from 1.30.0 to 1.33.0 (#2428)
• Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#2600)

CI

• Linting: remove canonicalheader since it's not reliable
• Use --device /dev/net/tun for test container
• Bump DavidAnson/markdownlint-cli2-action from 16 to 18 (#2588)
• Bump docker/build-push-action from 5 to 6 (#2324)

Development setup

• dev container
  • pin godevcontainer image to tag :v0.20-alpine
  • drop requirement for docker-compose and use devcontainer.json settings directly
  • readme update
    • remove Windows without WSL step
    • update 'remote containers extension' to 'dev containers extension'
    • remove invalid warning on directories creation
    • simplify customizations section
      • remove "publish a port" since it can be done at runtime now
      • remove "run other services" since it's rather unneeded in this case
      • expand documentation on custom welcome script and where to specify the bind mount
        • use bullet points instead of subsections headings
• Github labels
  • change "config problem" to "user error"
  • add "performance", "investigation", "servers storage" and "nearly resolved" categories

v3.39.1

🎥 https://youtu.be/O09rP1DlcFU?si=qPdzWUWnzciNxAc7

Fixes

• Firewall: delete chain rules by line number (#2411)
• Control server: require authentication for vulnerable routes (#2434)
• NordVPN: remove commas from region values
• IVPN: split city into city and region
  • Fix bad city values containing a comma
  • update ivpn servers data
• Private Internet Access: support port forwarding using custom Wireguard (#2420)
• ProtonVPN: prevent using FREE_ONLY and PORT_FORWARD_ONLY together (see #2470)
• internal/storage: add missing selection fields to build noServerFoundError (see #2470)

v3.39.0

🎥 Youtube video explaining all this

Features

• OpenVPN: default version changed from 2.5 to 2.6
• Alpine upgraded from 3.18 to 3.20 (3.19 got skipped due to buggy iptables)
• Healthcheck: change timeout mechanism
  • Healthcheck timeout is no longer fixed to 3 seconds
  • Healthcheck timeout increases from 2s to 4s, 6s, 8s, 10s
  • No 1 second wait time between check retries after failure
  • VPN internal restart may be delayed by a maximum of 10 seconds
• Firewall:
  • Query iptables binary variants to find which one to use depending on the kernel
  • Prefer using iptables-nft over iptables-legacy (Alpine new default is nft backend iptables)
• Wireguard:
  • WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL option
  • read configuration file without case sensitivity
• VPN Port forwarding: only use port forwarding enabled servers if VPN_PORT_FORWARDING=on (applies only to PIA and ProtonVPN for now)
• FastestVPN:
  • Wireguard support (#2383 - Credits to @Zerauskire for the initial investigation and @jvanderzande for an initial implementation as well as reviewing the pull request)
  • use API instead of openvpn zip file to fetch servers data
  • add city filter SERVER_CITY
  • update built-in servers data
• Perfect Privacy: port forwarding support with VPN_PORT_FORWARDING=on (#2378)
• Private Internet Access: port forwarding options VPN_PORT_FORWARDING_USERNAME and VPN_PORT_FORWARDING_PASSWORD (retro-compatible with OPENVPN_USER and OPENVPN_PASSWORD)
• ProtonVPN:
  • Wireguard support (#2390)
  • feature filters SECURE_CORE_ONLY, TOR_ONLY and PORT_FORWARD_ONLY (#2182)
  • determine "free" status using API tier value
  • update built-in servers data
• Surfshark: servers data update
• VPNSecure: servers data update
• VPN_ENDPOINT_IP split into OPENVPN_ENDPOINT_IP and WIREGUARD_ENDPOINT_IP
• VPN_ENDPOINT_PORT split into OPENVPN_ENDPOINT_PORT and WIREGUARD_ENDPOINT_PORT

Fixes

• VPN_PORT_FORWARDING_LISTENING_PORT fixed
• IPv6 support detection ignores loopback route destinations
• Custom provider:
  • handle port option line for OpenVPN
  • ignore comments in an OpenVPN configuration file
  • assume port forwarding is always supported by a custom server
• VPN Unlimited:
  • change default UDP port from 1194 to 1197
  • allow OpenVPN TCP on port 1197
• Private Internet Access Wireguard and port forwarding
  • Set server name if names filter is set with the custom provider (see #2147)
• PrivateVPN: updater now sets openvpn vpn type for the no-hostname server
• Torguard: update OpenVPN configuration
  • add aes-128-gcm and aes-128-cbc ciphers
  • remove mssfix, sndbuf, rcvbuf, ping and reneg options
• VPNSecure: associate N / A with no data for servers
• AirVPN: set default mssfix to 1320-28=1292
• Surfshark: remove outdated hardcoded retro servers
• Public IP echo:
  • ip2location parsing for latitude and longitude fixed
  • abort ip data fetch if vpn context is canceled (prevents requesting the public IP address N times after N VPN failures)
• internal/server: /openvpn route status get and put
  • get status return stopped if running Wireguard
  • put status changes vpn type if running Wireguard
• Log out if PORT_FORWARD_ONLY is enabled in the server filtering tree of settings
• Log last Gluetun release by tag name alphabetically instead of by release date
• format-servers fixed missing VPN type header for providers supporting Wireguard: NordVPN and Surfshark
• internal/tun: only create tun device if it does not exist, do not create if it exists and does not work

Documentation

• readme:
  • clarify shadowsocks proxy is a server, not a client
  • update list of providers supporting Wireguard with the custom provider
  • add protonvpn as custom port forwarding implementation
• disable Github blank issues
• Bump github.com/qdm12/gosplash to v0.2.0
  • Add /choose suffix to github links in logs
• add Github labels: "Custom provider", "Category: logs" and "Before next release"
• rename FIREWALL_ENABLED to FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT due to the sheer amount of users misusing it. FIREWALL_ENABLED won't do anything anymore. At least you've been warned not to use it...

Maintenance

• Code health
  • PIA port forwarding:
    • remove dependency on storage package
    • return an error to port forwarding loop if server cannot port forward
  • internal/config:
    • upgrade to github.com/qdm12/gosettings v0.4.2
      • drop github.com/qdm12/govalid dependency
      • upgrade github.com/qdm12/ss-server to v0.6.0
      • do not un-set sensitive config settings anymore
    • removed bad/invalid retro-compatible keys CONTROL_SERVER_ADDRESS and CONTROL_SERVER_PORT
    • OpenVPN protocol field is now a string instead of a TCP boolean
    • Split server filter validation for features and subscription-tier
    • provider name field as string instead of string pointer
  • internal/portforward: support multiple ports forwarded
  • Fix typos in code comments (#2216)
  • internal/tun: fix unit test for unprivileged user
• Development environment
  • fix source.organizeImports vscode setting value
  • linter: remove now invalid skip-dirs configuration block
• Dependencies
  • Bump Wireguard Go dependencies
  • Bump Go from 1.21 to 1.22
  • Bump golang.org/x/net from 0.19.0 to 0.25.0 (#2138, #2208, #2269)
  • Bump golang.org/x/sys from 0.15.0 to 0.18.0 (#2139)
  • Bump github.com/klauspost/compress from 1.17.4 to 1.17.8 (#2178, #2218)
  • Bump github.com/fatih/color from 1.16.0 to 1.17.0 (#2279)
  • Bump github.com/stretchr/testify to v1.9.0
  • Do not upgrade busybox since vulnerabilities are fixed now with Alpine 3.19+
• CI
  • Bump DavidAnson/markdownlint-cli2-action from 14 to 16 (#2214)
  • Bump peter-evans/dockerhub-description from 3 to 4 (#2075)
• Github
  • remove empty label description fields
  • add /choose suffix to issue and discussion links
  • review all issue labels: add closed labels, add category labels, rename labels, add label category prefix, add emojis for each label
  • Add issue labels: Popularity extreme and high, Closed cannot be done, Categories kernel and public IP service

v3.38.1

ℹ️ This is a bugfix release for v3.38.0. If you can, please instead use release v3.39.0

Fixes

• VPN_PORT_FORWARDING_LISTENING_PORT fixed
• IPv6 support detection ignores loopback route destinations
• Custom provider:
  • handle port option line for OpenVPN
  • ignore comments in an OpenVPN configuration file
  • assume port forwarding is always supported by a custom server
• VPN Unlimited:
  • change default UDP port from 1194 to 1197
  • allow OpenVPN TCP on port 1197
• Private Internet Access Wireguard and port forwarding
  • Set server name if names filter is set with the custom provider (see #2147)
• PrivateVPN: updater now sets openvpn vpn type for the no-hostname server
• Torguard: update OpenVPN configuration
  • add aes-128-gcm and aes-128-cbc ciphers
  • remove mssfix, sndbuf, rcvbuf, ping and reneg options
• VPNSecure: associate N / A with no data for servers
• AirVPN: set default mssfix to 1320-28=1292
• Surfshark: remove outdated hardcoded retro servers
• Public IP echo:
  • ip2location parsing for latitude and longitude fixed
  • abort ip data fetch if vpn context is canceled (prevents requesting the public IP address N times after N VPN failures)
• internal/server: /openvpn route status get and put
  • get status return stopped if running Wireguard
  • put status changes vpn type if running Wireguard
• Log out if PORT_FORWARD_ONLY is enabled in the server filtering tree of settings
• Log last Gluetun release by tag name alphabetically instead of by release date
• format-servers fixed missing VPN type header for providers supporting Wireguard: NordVPN and Surfshark
• internal/tun: only create tun device if it does not exist, do not create if it exists and does not work

v3.37.1

ℹ️ This is a bugfix release for v3.37.0. If you can, please instead use the newer v3.39.0 release.

Fixes

• VPN_PORT_FORWARDING_LISTENING_PORT fixed
• IPv6 support detection ignores loopback route destinations
• STREAM_ONLY behavior fixed (#2126)
• Custom provider:
  • handle port option line for OpenVPN
  • ignore comments in an OpenVPN configuration file
  • assume port forwarding is always supported by a custom server
• VPN Unlimited:
  • change default UDP port from 1194 to 1197
  • allow OpenVPN TCP on port 1197
• Private Internet Access Wireguard and port forwarding
  • Set server name if names filter is set with the custom provider (see #2147)
• PrivateVPN: updater now sets openvpn vpn type for the no-hostname server
• Torguard: update OpenVPN configuration
  • add aes-128-gcm and aes-128-cbc to the ciphers option
  • remove mssfix, sndbuf, rcvbuf, ping and reneg options
  • set HTTP user agent to be allowed to download zip files
• VPNSecure: associate N / A with no data for servers
• AirVPN: set default mssfix to 1320-28=1292
• Surfshark:
  • remove outdated hardcoded retro servers
  • Remove no longer valid multi hop regions
  • Fail validation for empty string region
  • Clearer error message for surfshark regions: only log possible 'new' server regions, do not log old retro-compatible server regions
• Privado: update OpenVPN zip file URL
• internal/server: /openvpn route status get and put
  • get status return stopped if running Wireguard
  • put status changes vpn type if running Wireguard
• Log out last Gluetun release by semver tag name instead of by date
• format-servers fixed missing VPN type header for providers supporting Wireguard: NordVPN and Surfshark
• internal/tun: only create tun device if it does not exist, do not create if it exists and does not work
• Bump github.com/breml/rootcerts from 0.2.14 to 0.2.17

PS: sorry for re-releasing this one 3 times, CI has been capricious with passing

v3.38.0

Features

• Public IP fetching:
  • Add PUBLICIP_API_TOKEN variable
  • PUBLICIP_API variable supporting ipinfo and ip2location
• Private Internet Access: PORT_FORWARD_ONLY variable (#2070)
• NordVPN:
  • update mechanism uses v2 NordVPN web API
  • Filter servers with SERVER_CATEGORIES (#1806)
• Wireguard:
  • Read config from secret file, defaults to /run/secrets/wg0.conf which can be changed with variable WIREGUARD_CONF_SECRETFILE
  • Read private key, preshared key and addresses from individual secret files (#1348)
• Firewall: disallow the unspecified address (0.0.0.0/0 or ::/0) for outbound subnets
• Built-in servers data updated:
  • NordVPN
  • Privado
  • Private Internet Access
  • VPN Unlimited
  • VyprVPN
• Healthcheck: change unhealthy log from info to debug level

Fixes

• Privado: update OpenVPN zip file URL
• STREAM_ONLY behavior fixed (#2126)
• Torguard: set user agent to be allowed to download zip files
• Surfshark:
  • Remove no longer valid multi hop regions
  • Fail validation for empty string region
  • Clearer error message for surfshark regions: only log possible 'new' server regions, do not log old retro-compatible server regions

Maintenance

• Healthcheck: more explicit log to go read the Wiki health guide
• NAT-PMP: RPC error contain all failed attempt messages
• Github:
  • add closed issue workflow stating comments are not monitored
  • add opened issue workflow
• Dependencies
  • Bump github.com/breml/rootcerts from 0.2.14 to 0.2.16 (#2094)
• CI
  • Pin docker/build-push-action to v5 (without minor version)
  • Upgrade linter to v1.56.2