OmaProton VPN 1.4.0

Port forwarding for torrent clients, Secure Core drawn on the map, notifications that look like they belong to the widget, and a hardening pass over all of it.

Port forwarding

A new switch on the Protection tab, under Always On. Turn it on, connect to a P2P server, and a Forwarded port row appears in the connection details. Click it and the number is on your clipboard, ready for your torrent client. Turning it on asks first, the same way the Kill Switch does, because it opens an inbound port on your VPN address.

Proton hands the port out over NAT-PMP and drops it unless something keeps renewing it, which is why Proton's own guide has you run a natpmpc loop in a terminal. The switch is that loop. While it's on and the tunnel is up the widget renews the port every 45 seconds with a small script of its own, nothing to install. It's the one network request the widget makes, to the VPN gateway inside the tunnel and nowhere else, and the README's Security section says so.

Thanks to @CJKaufman and @r8tten for the push on this one.

Secure Core, drawn

On a Secure Core connection the map draws the route: a dashed arc from the entry country (Switzerland, Iceland or Sweden, ringed) to the city you exit from, the way the Proton app does. The header reads Secure Core · CH → US#3, entry country then exit server, the Server row says the same, and the Secure Core quick-connect row shows ACTIVE while you're on it.

After a P2P connect the header and the Server row say P2P too, so you can tell the click landed. Most Proton servers permit P2P, so the panel only makes a point of it when that's what you asked for.

Notifications

The connect and disconnect toasts had a purple and black checkerboard where an icon should be, because the icon name they asked for doesn't exist in most icon themes. Reported and diagnosed by @CJKaufman, thanks CJ. They now show the Proton mark in your theme's accent colour, read VPN Connected with the server and protocol, or VPN Disconnected when the tunnel drops on its own, and stay quiet while the panel is open, since the panel already tells you.

Hardening

A review of everything new in this release. Nothing serious came up; the small things were fixed anyway:

• Notification text that came from the CLI is escaped before the shell renders it.
• The port script only accepts replies from the VPN gateway.
• The forwarded port is checked to be a number before it's shown or copied.
• The README's Security section matches the code again: two files in the state directory, the settings allow-list includes port forwarding, and the notification wording is exact.

README

New Protection tab screenshot, a Port forwarding chapter, the Secure Core and P2P cues, and the notification rules.

Upgrade

omarchy plugin update io.github.grichard99.omaproton-vpn