feat(providers): ovpn.com support

[qdm12]

Fix #495

Run it with image tag :pr-2537.

Wireguard

docker run --cap-add=NET_ADMIN -e VPN_SERVICE_PROVIDER=ovpn -e VPN_TYPE=wireguard \
-e WIREGUARD_PRIVATE_KEY=MFDyavQNdjUhvNfVIxoeLk6azofLwJ+xiPGDtOLrQUQ= \
-e WIREGUARD_ADDRESSES="10.64.222.21/32" \
-e SERVER_CITIES=amsterdam qmcgaw/gluetun:pr-2537

OpenVPN

I need an Openvpn configuration file to know what settings they use. Right now I just know their ciphers supported, although this may be sufficient.

docker run -it --rm --cap-add=NET_ADMIN -e VPN_SERVICE_PROVIDER=ovpn \
-e VPN_TYPE=openvpn -e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \
-e SERVER_CITIES=amsterdam qmcgaw/gluetun:pr-2537

Status

• multihop servers using MULTIHOP_ONLY=on
• use server data port as default port if it's defined (only for multihop)
• servers data update mechanism using ovpn API
• Check Wireguard works
• Check OpenVPN works

[ilikenwf]

Any movement on this?

[qdm12]

Any movement on this?

Yes, but note you can already use it, it works fine with Wireguard and should from today work fine with openvpn. See instructions in the PR body.

[ilikenwf]

Nice, I'll have to try soon. I had trouble previously where using just wireguard plain without gluetun does work for whatever reason.

[kheiner]

Currently using ovpn.com credentials with the VPN_SERVICE_PROVIDER=custom -- hoping to be able to enable VPN_PORT_FORWARDING but it doesn't look like this pull addresses OVPN's static IPv4 offering with port forwarding. I'm open to looking into how to integrate this. Can someone confirm whether or not this PR will address port forwarding for OVPN.com?

[melv-n]

This is still relevant, any intent on merging this? 🙏

[melv-n]

Also please note @qdm12 the image tag for this PR is no longer available:
https://hub.docker.com/layers/qmcgaw/gluetun/pr-2537

[Copilot]

Pull request overview

Adds support for the ovpn.com VPN provider, including an API-based servers updater and provider wiring, plus shared server-port selection/filtering enhancements to support per-server ports (notably for multihop).

Changes:

• Add new ovpn provider implementation with OpenVPN config generation and server update mechanism via ovpn API.
• Introduce per-server port fields (ports_tcp, ports_udp) and use them to pick default connection ports when present.
• Extend settings/validation/docs/metadata (providers list, templates, labels, Docker env docs) to recognize ovpn.

Reviewed changes

Copilot reviewed 29 out of 30 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
README.md	Adds Ovpn to supported providers list and Wireguard-capable list.
internal/storage/servers.json	Registers ovpn servers file path.
internal/storage/hardcoded.go	Tightens validation of embedded servers manifest; improves panic messaging.
internal/storage/hardcoded_test.go	Ensures parsing hardcoded servers does not panic.
internal/storage/formatting.go	Improves “no server found” error details by including selected endpoint port.
internal/storage/filter.go	Adds filtering by custom port against server-defined port lists.
internal/provider/utils/port.go	Uses server-defined ports as defaults when available; extends signature to accept server.
internal/provider/utils/port_test.go	Adds test cases for server-defined ports in port selection.
internal/provider/utils/connection.go	Computes port per-server using new getPort signature.
internal/provider/providers.go	Wires new ovpn provider into provider factory.
internal/provider/ovpn/updater/*	Implements ovpn API fetch/validate + server list generation and tests.
internal/provider/ovpn/provider.go	Defines provider struct and name wiring.
internal/provider/ovpn/openvpnconf.go	Adds Ovpn OpenVPN configuration settings (ciphers, CA, tls-auth/crypt handling).
internal/provider/ovpn/connection.go	Defines Ovpn connection defaults and delegates to shared connection picker logic.
internal/provider/ovpn/connection_test.go	Tests Ovpn connection selection and default ports.
internal/models/server.go	Adds PortsTCP/PortsUDP fields to Server model.
internal/constants/providers/providers.go	Adds ovpn to supported providers constants/list.
internal/configuration/settings/wireguardselection.go	Allows Ovpn Wireguard endpoint port rules consistent with other baked-in providers.
internal/configuration/settings/provider.go	Adds Ovpn to provider validation allowlist.
internal/configuration/settings/openvpnselection.go	Allows custom OpenVPN port for Ovpn.
go.mod / go.sum	Bumps gluetun-servers dependency; adjusts goservices dependency entry.
Dockerfile	Documents MULTIHOP_ONLY as applicable to Surfshark and ovpn.
.github/labels.yml	Adds “☁️ OVPN” label.
.github/ISSUE_TEMPLATE/bug.yml	Adds OVPN to provider selection list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[qdm12]

Updated the branch, can you please try:

• openvpn tcp
• openvpn udp
• openvpn tcp with MULTIHOP_ONLY
• openvpn udp with MULTIHOP_ONLY
• wireguard
• wireguard with SERVER_DEDICATED=on
• wireguard with MULTIHOP_ONLY
• wireguard with MULTIHOP_ONLY and SERVER_DEDICATED=on

OVPN's static IPv4 offering with port forwarding

If this is a dedicated Ipv4 address only via Wireguard and using a different wireguard public key (aka add-on), then it should be implemented with SERVER_DEDICATED=yes.

EDIT: or if you're lazy, send me an openvpn and wireguard config via quentin.mcgaw@protonmail.com. You can also share a more permanent config file if you want to help development, see https://github.com/qdm12/gluetun-wiki/tree/main/contributing#vpn-credentials

[TestForFunOrSo]

its working! but how can i enable port forwarding?