Feature request: ProtonVPN Port Forwarding

[tazz4843]

What's the feature 🧐

The current method of port forwarding appears to be unsupported by gluetun. ProtonVPN has a guide on their site to set up port forwarding: https://protonvpn.com/support/port-forwarding-manual-setup/. This requires the binary natpmpc which currently does not exist in the container image.

Extra information and references

No response

[BraveLilToaster]

I fell down a rabbit hole looking for a solution and stumbled onto this repo. I just tested it and it seems to work.

config example:

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    network_mode: bridge
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8000:8000/tcp # Built-in HTTP control server
        # other containers ports
      - 6881:6881     # qBittorrent
      - 6881:6881/udp # qBittorrent
      - 8080:8080     # qBittorrent
    environment:
      - VPN_SERVICE_PROVIDER=custom
      - VPN_TYPE=wireguard
      - VPN_ENDPOINT_IP=${VPN_ENDPOINT_IP}
      - VPN_ENDPOINT_PORT=${VPN_ENDPOINT_PORT}
      - WIREGUARD_PUBLIC_KEY=${WIREGUARD_PUBLIC_KEY}
      - WIREGUARD_PRIVATE_KEY=${WIREGUARD_PRIVATE_KEY}
      # - WIREGUARD_PRESHARED_KEY={WIREGUARD_PRESHARED_KEY}
      - WIREGUARD_ADDRESSES=${WIREGUARD_ADDRESSES}
      - VPN_DNS_ADDRESS=${VPN_DNS_ADDRESS}
      # - FIREWALL_OUTBOUND_SUBNETS=192.168.178.0/24
    restart: unless-stopped

  qbittorrent:
    container_name: qbittorrent
    image: lscr.io/linuxserver/qbittorrent:latest
    environment:
      - PUID=1000
      - PGID=1000
      - UMASK=002
      - TZ=${SERVARR_TIMEZONE}
      - WEBUI_PORT=8080
    network_mode: "service:gluetun"
    volumes:
      - /docker/appdata/qbittorrent:/config
      - /data:/downloads
    restart: unless-stopped

  qbittorrent_natmap:
    container_name: qbittorrent_natmap
    image: ghcr.io/soxfor/qbittorrent-natmap:latest
    environment:
      - QBITTORRENT_SERVER=10.2.0.2 
      - VPN_GATEWAY=10.2.0.1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
      qbittorrent: 
        condition: service_started
    restart: unless-stopped

[tazz4843]

I did stumble upon that repo before opening this issue, but given I'm using Deluge, that wasn't really an option for me.

[qdm12]

I'm working on a custom implementation of the natpmp protocol in Go, I'll comment back once I have a test image to try it with (2-3 days from my guesstimate)

[pvanryn]

I'm using soxfor's method to open a port with Transmission and ProtonVPN, but it would be awesome if it was native to Gluetun.

[qdm12]

It's like 95% done, but I'm struggling to find the time to get on a keyboard currently 😸 I think this weekend is the right weekend to start testing something!

[pvanryn]

If you want any beta testers, let me know.

[qdm12]

Try with image qmcgaw/gluetun:pr-1543 (being built here), and with env variable PORT_FORWARDING=on, does it work? I didn't try at all and it might not work at all, I'll try to test it more locally tomorrow/Tuesday.

[pvanryn]

Not working with ProtonVPN and PORT_FORWARDING=on. I get this in the log:

gluetun    | 2023-04-23T22:44:29Z WARN You are using the old environment variable PORT_FORWARDING, please consider changing it to PRIVATE_INTERNET_ACCESS_VPN_PORT_FORWARDING
gluetun    | 2023-04-23T22:44:29Z INFO [routing] default route found: interface eth0, gateway 172.27.0.1 and assigned IP 172.27.0.2
gluetun    | 2023-04-23T22:44:29Z INFO [routing] local ethernet link found: eth0
gluetun    | 2023-04-23T22:44:29Z INFO [routing] local ipnet found: 172.27.0.0/16
gluetun    | 2023-04-23T22:44:29Z INFO [firewall] enabling...
gluetun    | 2023-04-23T22:44:29Z INFO [firewall] enabled successfully
gluetun    | 2023-04-23T22:44:30Z INFO [storage] creating /gluetun/servers.json with 13056 hardcoded servers
gluetun    | 2023-04-23T22:44:30Z ERROR VPN settings: provider settings: port forwarding: port forwarding cannot be enabled: for provider custom, it is only available for private internet access
gluetun    | 2023-04-23T22:44:30Z INFO Shutdown successful
gluetun exited with code 1

[ahatdude]

Just commenting to follow this topic closely, since I'm very interested :-)

[qdm12]

Can you try re-pulling that image docker pull qmcgaw/gluetun:pr-1543 and set VPN_PORT_FORWARDING=on and see what the logs say? 🤔 Even if it works, I would be curious to see what logs we get.

[pvanryn]

First I tried "custom" for provider, and I got:

Running version pr-1543 built on 2023-04-27T10:30:25.876Z (commit d96995b)
2023-04-27T17:28:35Z INFO [routing] default route found: interface eth0,  gateway 172.24.0.1 and assigned IP 172.24.0.2
2023-04-27T17:28:35Z INFO [routing] local ethernet link found: eth0
2023-04-27T17:28:35Z INFO [routing] local ipnet found: 172.24.0.0/16
2023-04-27T17:28:36Z INFO [firewall] enabling...
2023-04-27T17:28:36Z INFO [firewall] enabled successfully
2023-04-27T17:28:36Z INFO [storage] creating /gluetun/servers.json with 13056 hardcoded servers
2023-04-27T17:28:36Z ERROR VPN settings: provider settings: port forwarding: port forwarding cannot be enabled: for provider custom, it is only available for private internet access, protonvpn
2023-04-27T17:28:36Z INFO Shutdown successful

And then I tried with protonvpn as the provider:

Running version pr-1543 built on 2023-04-27T10:30:25.876Z (commit d96995b)
2023-04-27T17:30:36Z INFO [routing] default route found: interface eth0, gateway 172.25.0.1 and assigned IP 172.25.0.2
2023-04-27T17:30:36Z INFO [routing] local ethernet link found: eth0
2023-04-27T17:30:36Z INFO [routing] local ipnet found: 172.25.0.0/16
2023-04-27T17:30:36Z INFO [firewall] enabling...
2023-04-27T17:30:36Z INFO [firewall] enabled successfully
2023-04-27T17:30:36Z INFO [storage] creating /gluetun/servers.json with 13056 hardcoded servers
2023-04-27T17:30:36Z ERROR VPN settings: provider settings: VPN provider name is not valid: "protonvpn" can only be one of airvpn, custom, ivpn, mullvad, surfshark or windscribe
2023-04-27T17:30:36Z INFO Shutdown successful
gluetun exited with code 1

[tazz4843]

2023-04-30T09:42:36-06:00 WARN You are using the old environment variable VPNSP, please consider changing it to VPN_SERVICE_PROVIDER
2023-04-30T09:42:36-06:00 WARN You are using the old environment variable WIREGUARD_ADDRESS, please consider changing it to WIREGUARD_ADDRESSES
2023-04-30T09:42:36-06:00 INFO [routing] default route found: interface eth0, gateway 172.25.0.1 and assigned IP 172.25.0.4
2023-04-30T09:42:36-06:00 INFO [routing] local ethernet link found: eth0
2023-04-30T09:42:36-06:00 INFO [routing] local ipnet found: 172.25.0.0/16
2023-04-30T09:42:36-06:00 INFO [firewall] enabling...
2023-04-30T09:42:36-06:00 INFO [firewall] enabled successfully
2023-04-30T09:42:37-06:00 INFO [storage] merging by most recent 13056 hardcoded servers and 13056 servers read from /gluetun/servers.json
2023-04-30T09:42:37-06:00 ERROR VPN settings: provider settings: port forwarding: port forwarding cannot be enabled: for provider custom, it is only available for private internet access, protonvpn
2023-04-30T09:42:37-06:00 INFO Shutdown successful

Same issue, VPN_PORT_FORWARDING and PORT_FORWARDING are both set to on

I'm using Wireguard since I notice a massive speed and CPU use improvement over OpenVPN.

[qdm12]

So you are mixing different problems here...

• @pvanryn Wireguard is for now (natively) unsupported for Protonvpn, explaining the error VPN settings: provider settings: VPN provider name is not valid: "protonvpn" can only be one of airvpn, custom, ivpn, mullvad, surfshark or windscribe - note this error string got improved in the latest image to be VPN provider name is not valid for Wireguard since that was indeed obscured.
• @pvanryn and @tazz4843 VPN settings: provider settings: port forwarding: port forwarding cannot be enabled: for provider custom, it is only available for private internet access, protonvpn - related to the point above, you need to use protonvpn as provider and openvpn as protocol. The custom provider has no associated custom code to get the port forwarded, however I might work on this to allow the user to select a custom port forwarding code (from pia, protonvpn for now), although please verify it works with openvpn first.

Side note referring to Protonvpn (link), do they still have a unique private key + peer address for each of their server? I would love to natively support it but this makes it highly unpractical for the user (better to use the custom provider directly, and soon wireguard conf files).