feat(providers): ovpn.com support

[qdm12]

Fix #495

Run it with image tag :pr-2537.

Wireguard

docker run --cap-add=NET_ADMIN -e VPN_SERVICE_PROVIDER=ovpn -e VPN_TYPE=wireguard \
-e WIREGUARD_PRIVATE_KEY=MFDyavQNdjUhvNfVIxoeLk6azofLwJ+xiPGDtOLrQUQ= \
-e WIREGUARD_ADDRESSES="10.64.222.21/32" \
-e SERVER_CITIES=amsterdam qmcgaw/gluetun:pr-2537

OpenVPN

I need an Openvpn configuration file to know what settings they use. Right now I just know their ciphers supported, although this may be sufficient.

docker run -it --rm --cap-add=NET_ADMIN -e VPN_SERVICE_PROVIDER=ovpn \
-e VPN_TYPE=openvpn -e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e SERVER_CITIES=amsterdam qmcgaw/gluetun:pr-2537

Port forwarding

1. Set it up on the ovpn.com web ui, see https://www.ovpn.com/en/blog/port-forwarding-with-ovpn
2. Add the forwarded port with FIREWALL_VPN_INPUT_PORTS=12345 in the Gluetun config

Status

• multihop servers using MULTIHOP_ONLY=on
• use server data port as default port if it's defined (only for multihop)
• servers data update mechanism using ovpn API
• Check Wireguard works
• Check OpenVPN works

[ilikenwf]

Any movement on this?

[qdm12]

Any movement on this?

Yes, but note you can already use it, it works fine with Wireguard and should from today work fine with openvpn. See instructions in the PR body.

[ilikenwf]

Nice, I'll have to try soon. I had trouble previously where using just wireguard plain without gluetun does work for whatever reason.

[kheiner]

Currently using ovpn.com credentials with the VPN_SERVICE_PROVIDER=custom -- hoping to be able to enable VPN_PORT_FORWARDING but it doesn't look like this pull addresses OVPN's static IPv4 offering with port forwarding. I'm open to looking into how to integrate this. Can someone confirm whether or not this PR will address port forwarding for OVPN.com?

[melv-n]

This is still relevant, any intent on merging this? 🙏

[melv-n]

Also please note @qdm12 the image tag for this PR is no longer available:
https://hub.docker.com/layers/qmcgaw/gluetun/pr-2537

[Copilot]

Pull request overview

Adds support for the ovpn.com VPN provider, including an API-based servers updater and provider wiring, plus shared server-port selection/filtering enhancements to support per-server ports (notably for multihop).

Changes:

• Add new ovpn provider implementation with OpenVPN config generation and server update mechanism via ovpn API.
• Introduce per-server port fields (ports_tcp, ports_udp) and use them to pick default connection ports when present.
• Extend settings/validation/docs/metadata (providers list, templates, labels, Docker env docs) to recognize ovpn.

Reviewed changes

Copilot reviewed 29 out of 30 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
README.md	Adds Ovpn to supported providers list and Wireguard-capable list.
internal/storage/servers.json	Registers ovpn servers file path.
internal/storage/hardcoded.go	Tightens validation of embedded servers manifest; improves panic messaging.
internal/storage/hardcoded_test.go	Ensures parsing hardcoded servers does not panic.
internal/storage/formatting.go	Improves “no server found” error details by including selected endpoint port.
internal/storage/filter.go	Adds filtering by custom port against server-defined port lists.
internal/provider/utils/port.go	Uses server-defined ports as defaults when available; extends signature to accept server.
internal/provider/utils/port_test.go	Adds test cases for server-defined ports in port selection.
internal/provider/utils/connection.go	Computes port per-server using new getPort signature.
internal/provider/providers.go	Wires new ovpn provider into provider factory.
internal/provider/ovpn/updater/*	Implements ovpn API fetch/validate + server list generation and tests.
internal/provider/ovpn/provider.go	Defines provider struct and name wiring.
internal/provider/ovpn/openvpnconf.go	Adds Ovpn OpenVPN configuration settings (ciphers, CA, tls-auth/crypt handling).
internal/provider/ovpn/connection.go	Defines Ovpn connection defaults and delegates to shared connection picker logic.
internal/provider/ovpn/connection_test.go	Tests Ovpn connection selection and default ports.
internal/models/server.go	Adds PortsTCP/PortsUDP fields to Server model.
internal/constants/providers/providers.go	Adds ovpn to supported providers constants/list.
internal/configuration/settings/wireguardselection.go	Allows Ovpn Wireguard endpoint port rules consistent with other baked-in providers.
internal/configuration/settings/provider.go	Adds Ovpn to provider validation allowlist.
internal/configuration/settings/openvpnselection.go	Allows custom OpenVPN port for Ovpn.
go.mod / go.sum	Bumps gluetun-servers dependency; adjusts goservices dependency entry.
Dockerfile	Documents MULTIHOP_ONLY as applicable to Surfshark and ovpn.
.github/labels.yml	Adds “☁️ OVPN” label.
.github/ISSUE_TEMPLATE/bug.yml	Adds OVPN to provider selection list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[qdm12]

Updated the branch, can you please try:

• openvpn tcp
• openvpn udp
• openvpn tcp with MULTIHOP_ONLY
• openvpn udp with MULTIHOP_ONLY
• wireguard
• wireguard with SERVER_DEDICATED=on
• wireguard with MULTIHOP_ONLY
• wireguard with MULTIHOP_ONLY and SERVER_DEDICATED=on

OVPN's static IPv4 offering with port forwarding

If this is a dedicated Ipv4 address only via Wireguard and using a different wireguard public key (aka add-on), then it should be implemented with SERVER_DEDICATED=yes.

EDIT: or if you're lazy, send me an openvpn and wireguard config via quentin.mcgaw@protonmail.com. You can also share a more permanent config file if you want to help development, see https://github.com/qdm12/gluetun-wiki/tree/main/contributing#vpn-credentials

[TestForFunOrSo]

its working! but how can i enable port forwarding?

[qdm12]

@TestForFunOrSo

For port forwarding see description at the top I've added a section on that.

[TestForFunOrSo]

port forwarding works for .ovpn

[qdm12]

And does wireguard also work?

[qnorsten]

I have been running gluetun with ovpn.com as a custom wireguard provider for a while and for most of the time that have been working fine.

Decided to try this PR with qmcgaw/gluetun:pr-2537 and I can confirm that the ones marked below work

• openvpn tcp
• openvpn udp
• openvpn tcp with MULTIHOP_ONLY
• openvpn udp with MULTIHOP_ONLY
• wireguard
• wireguard with SERVER_DEDICATED=on
• wireguard with MULTIHOP_ONLY
• wireguard with MULTIHOP_ONLY and SERVER_DEDICATED=on

WIREGUARD with SERVER_DEDICATED=on works, but I am not sure what that setting is supposed to do (all wireguard servers seem to be marked as dedicated in the downloaded ovpn.json server list).

I do not have the public ipv4 addon https://www.ovpn.com/en/features/public-ipv4 so I can't provide any information about that.

MULTIHOP_ONLY=on does not work at all. Log spits out ERROR VPN settings: provider settings: server selection: for VPN service provider ovpn: multi hop only filter is not supported

I check the ovpn.com website how they handle multihop and you specify a ingress and egress server and they provide a custom wireguard (with an unique privatekey for each combination) or ovpn config for that combination and it is udp only

For example multihop vpn44-vie to vpn57-got

Openvpn

client
dev tun
tls-version-min 1.0
cipher CHACHA20-POLY1305
pull
nobind
reneg-sec 0
resolv-retry infinite
verb 3
persist-key
persist-tun
remote 37.120.212.227 20057
proto udp
mute-replay-warnings
replay-window 256

auth-user-pass

key-direction 1
<ca>
-----BEGIN CERTIFICATE-----
MIIEfTCCA2WgAwIBAgIJAK2aIWqpLj1/MA0GCSqGSIb3DQEBBQUAMIGFMQswCQYD
VQQGEwJTRTESMBAGA1UECBMJU3RvY2tob2xtMRIwEAYDVQQHEwlTdG9ja2hvbG0x
HDAaBgNVBAsTE0Zpcm1hIERhdmlkIFdpYmVyZ2gxEzARBgNVBAMTCm92cG4uc2Ug
Y2ExGzAZBgkqhkiG9w0BCQEWDGluZm9Ab3Zwbi5zZTAeFw0xNDA4MTcxODIxMjla
Fw0zNDA4MTIxODIxMjlaMIGFMQswCQYDVQQGEwJTRTESMBAGA1UECBMJU3RvY2to
b2xtMRIwEAYDVQQHEwlTdG9ja2hvbG0xHDAaBgNVBAsTE0Zpcm1hIERhdmlkIFdp
YmVyZ2gxEzARBgNVBAMTCm92cG4uc2UgY2ExGzAZBgkqhkiG9w0BCQEWDGluZm9A
b3Zwbi5zZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMR+aP4GTuZw
urZuOA2NYzMfqKyZi/TJcLEPlGTB/b4CWA9bTd8f0pHPrDAZsXIEayxxB58BIFND
NiybnbO15JN/QwlsqmA+aZX6mCSkScs/rRwasM6LDo8iGx+KmYEqAgzziONGbCMn
lO+OaarXte7LhZ9X6Z/bryu4xq/i1v3raak13kXsrogtu4iDzxqJE/QhbNOi0yhC
dlm5RYQjmlKGdPB9pNTgcakVI4HcngRYMzBlrGin0YkvWCdpx5FrDNeld7BSWrJM
NYyvd+buaid0Fu1T9/P/Srj/8AiabKoaDyiGFbZdTnGfK+04lWRvwAmvazpqbUt5
Omw634jJDuMCAwEAAaOB7TCB6jAdBgNVHQ4EFgQUEvJcHHcTiDtu7bAyZw+xaqg+
xdIwgboGA1UdIwSBsjCBr4AUEvJcHHcTiDtu7bAyZw+xaqg+xdKhgYukgYgwgYUx
CzAJBgNVBAYTAlNFMRIwEAYDVQQIEwlTdG9ja2hvbG0xEjAQBgNVBAcTCVN0b2Nr
aG9sbTEcMBoGA1UECxMTRmlybWEgRGF2aWQgV2liZXJnaDETMBEGA1UEAxMKb3Zw
bi5zZSBjYTEbMBkGCSqGSIb3DQEJARYMaW5mb0BvdnBuLnNlggkArZohaqkuPX8w
DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAJmID6OyBJbV7ayPPgquo
jF+FICuDdOfGVKP828cyISxcbVA04VpD0QLYVb0k9pFUx0NbgX2SvRTiFhP7LcyS
1HV9s+XLCb2WItPPsrdRTwtqU2n3TlCEzWA3WOcOCtT6JSkv1eelmx1JnP0gYJrD
vDvRYBFctwWhtE0bineSQkZwN6980zkknADLAiHpeZSu/AMx7CGTwA6SmoFvpNBm
HXDcfe/9ZqbbYfUfyPNe+0JbMrcv1elKi+6wlEkHFaEBphiZwGEbOX1CjUMcQFgW
/cIp3n50Eiyx6ktuqimhyb59P4Nw8gqH452tTtE4MM/brA5y0Q0WFBRBojfZIbGW
WQ==
-----END CERTIFICATE-----
</ca>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
<redacted_as_i_am_not_sure_if_it_is_sensitive_or_not>
-----END OpenVPN Static key V1-----
</tls-auth>


data-ciphers CHACHA20-POLY1305:AES-256-GCM:AES-256-CBC:AES-128-GCM
allow-compression asyms

Wireguard

[Interface]
PrivateKey = <redacted>
Address = 172.30.188.113/32, fd00:0000:1337:cafe:1111:1111:c200:f6e6/128
DNS = 46.227.67.134,192.165.9.158,2a07:a880:4601:10f0:cd45::1,2001:67c:750:1:cafe:cd45::1

[Peer]
PublicKey = CukQxZVavBWSOdrxBuCRYnVLapi4rx73G7nV6wo3LG0=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = 193.187.91.206:30057

So I think that need to be implemented as separate servers in the gluetun server list. I can provide configuration files for each combination if requested

Update: You probably already know this, but I looked at it again and now I understand how multihop works at least for wireguard, you connect to the ip on one server on multihoport 30079 and provide the public key of the chosen egress server.

Update 2: I think that for openvpn and multihost the port used selects the egress server.