PureVPN provider revamp by reedog117 · Pull Request #3165 · passteque/gluetun

reedog117 · 2026-02-27T08:59:58Z

Description

PureVPN provider revamp:

integrates PureVPN inventory-driven server selection and OpenVPN template ingestion by extracting this from the PureVPN Linux client
removes legacy fallback port behavior in OpenVPN config generation and uses inventory-provided ports
aligns filtering behavior around stable location fields and inventory tags (including p2p/category/type filtering updates)

Issue

Closes Bug: gluetun is always trying port 53 for connection when downloaded OpenVPN files from PureVPN reference port 1194. #3148

Assertions

I am aware that we do not accept manual changes to the servers.json file
I am aware that any changes to settings should be reflected in the wiki

…iner start - prevent leaks for connections made the first ~10 milliseconds when Gluetun starts - seems critical, but in practice this very rarely happen and it very hard to reproduce

reedog117 · 2026-02-27T09:07:16Z

This PR is more comprehensive but addresses much of the shortcomings of #3149 by finding a better avenue to get an updated server list and parsing accepted protocols, port numbers, and other attributes directly from the same source used by PureVPN's GUI clients.

reedog117 · 2026-02-27T09:26:54Z

Test results summary for the PureVPN provider revamp branch.

Branch / commit

Branch: codex/purevpn-deb-updater
Head: 9c634605

1) Targeted validation on host (macOS)

go build ./cmd/gluetun
go test ./internal/provider/purevpn/... ./internal/provider/purevpn/updater/...

Result: ✅ pass

2) Targeted validation in Linux amd64 container

docker run --rm --platform linux/amd64 \
  -v "$PWD":/src -w /src golang:1.25-alpine3.22 \
  sh -lc '/usr/local/go/bin/go build ./cmd/gluetun && /usr/local/go/bin/go test ./internal/provider/purevpn/... ./internal/provider/purevpn/updater/...'

Result: ✅ pass

3) Full suite on host (informational)

go test ./...

Result: ⚠️ not fully green in this local macOS environment due unrelated/platform-sensitive tests:

internal/natpmp (UDP/rpc timeout expectation mismatch)
internal/netlink (wireguard support panic on unspecified platform)
internal/tun (operation not permitted on TUN node creation)

PureVPN-related packages are green in all runs above.

reedog117 · 2026-02-27T20:58:00Z

This potentially also closes #1501 #1725 and #1653

qdm12 · 2026-02-28T17:17:12Z

 1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list

-2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS


Addressed. I reverted this message change and restored SERVER_REGIONS in internal/openvpn/logs.go (and corresponding test).

qdm12 · 2026-02-28T17:17:40Z

+	_ = ss
+	_ = warner


??????

Also we want to maintain retro-compatibility

Addressed. I removed the placeholder _ = ss / _ = warner edits and restored the Surfshark retro-compatibility branch in getLocationFilterChoices.

qdm12 · 2026-02-28T17:19:35Z

+	// PureVPNLocationCodes filters PureVPN servers by deterministic
+	// location code parsed from the hostname prefix (for example usca, ukm).
+	PureVPNLocationCodes []string `json:"purevpn_location_codes"`


sounds like we could use the Hostnames field then

Addressed by removing PureVPNLocationCodes from this PR. Deterministic per-host selection remains available through the existing Hostnames field.

qdm12 · 2026-02-28T17:21:28Z

 		return fmt.Errorf("%w: %w", ErrCountryNotValid, err)
 	}

-	err = atLeastOneIsOneOfCaseInsensitive(settings.Regions, filterChoices.Regions, warner)


regions is used for nordvpn. I get AI makes it easier to rewrite stuff, but please at the very least read changes made and verify a bit. Otherwise it adds excessive load for me to review these, especially with the increasing amount of AI generated PRs.

Hey sorry I was a bit moody on the AI-generated PR; if you're not a Go developer, then I 100% appreciate the gesture, and I'll comment on what's to change and the AI can then adapt it. However if you're a Go dev, I would definitely appreciate you reading up on the changes first 😉 !

No worries - I'm def not a Go dev - my specialty in infra bash/terraform/NodeJS. My understanding was that I stopped using the regions field for PureVPN, but it was still being used for any other provider. Currently doing another scan to doublecheck, but unfortunately I don't have another set of creds with another provider other than PureVPN to confirm.

I'm trying to figure out a way to populate regions for PureVPN but I think I end up getting ratelimited by the IP geolocation APIs due to the sheer number of servers that need to be looked up.

Addressed. Region validation remains for non-PureVPN providers (including NordVPN) and the broader region logic has been restored. For PureVPN specifically, I now ignore SERVER_REGIONS at validation time to avoid impacting PureVPN selection.

Appreciate it. I went through each requested change line-by-line, restored the non-PureVPN region behavior, and split out the extra PureVPN filtering feature work from this PR.

qdm12 · 2026-02-28T17:23:21Z


-	const url = "https://d11a57lttb2ffq.cloudfront.net/heartbleed/router/Recommended-CA2.zip"
-	contents, err := u.unzipper.FetchAndExtract(ctx, url)
+	debContent, err := fetchURL(ctx, http.DefaultClient, debURL)


use the u.client instead of http.DefaultClient. If not present, inject it into the Updater New function

Addressed. I injected the HTTP client into the PureVPN updater (Updater now has client *http.Client), defaulting to http.DefaultClient only if nil. .deb URL/content and inventory fetches now use u.client.

Do not default it, it is never nil.

reedog117 · 2026-03-03T03:22:33Z

[Generated by Codex]

Summary of review feedback addressed:

Reverted OpenVPN TLS help text change and restored SERVER_REGIONS wording in:
- internal/openvpn/logs.go
- internal/openvpn/logs_test.go
Restored Surfshark retro-compatibility logic in getLocationFilterChoices.
Restored region validation/filtering behavior for non-PureVPN providers (including NordVPN).
Kept SERVER_REGIONS parsing in read() for compatibility, and now ignore regions only when provider is PureVPN during validation.
Removed the extra PureVPN filtering feature set (PureVPNServerTypes, PureVPNCountryCodes, PureVPNLocationCodes) from this PR so it can be split separately.
Updated PureVPN updater networking to use injected client (u.client) instead of direct http.DefaultClient calls:
- Added client *http.Client to updater
- Default to http.DefaultClient only if nil
- Switched .deb and inventory fetches to u.client

Validation done locally:

go test ./internal/configuration/settings ./internal/provider/purevpn/... ./internal/provider/utils ./internal/storage ./internal/openvpn
go build ./cmd/gluetun
Real containerized PureVPN UDP connect test with credentials:
- OpenVPN reached Initialization Sequence Completed
- In-container egress IP checks confirmed VPN-routed traffic (distinct from host IP)

reedog117 · 2026-03-03T03:30:16Z

[Generated by Codex]\n\nI split the selector work into a dedicated stacked PR based on :\n- https://github.com/reedog117/gluetun/pull/1\n\nThis contains the PureVPN selector functionality (, , , , country/location code selectors) separated from the base updater changes.

reedog117 · 2026-03-03T03:30:27Z

[Generated by Codex]

I split the selector work into a dedicated stacked PR based on codex/purevpn-deb-updater:

purevpn: split selector filters into dedicated PR reedog117/gluetun#1

This contains the PureVPN selector functionality (p2p, quantumresistant, obfuscation, portforwarding, and country/location code selectors) separated from the base updater changes.

reedog117 · 2026-03-03T04:58:59Z

[Generated by Codex]

I split the selector work into a dedicated stacked PR based on codex/purevpn-deb-updater:

purevpn: split selector filters into dedicated PR reedog117/gluetun#1

This contains the PureVPN selector functionality (p2p, quantumresistant, obfuscation, portforwarding, and country/location code selectors) separated from the base updater changes.

This PR #3165 needs to be merged in before I can bring the selector functionality in as a separate PR as it's dependent on the new server inventory selection methods from here.

reedog117 · 2026-03-26T17:45:14Z

@qdm12 what additional steps are needed at this point to merge this and then i can bring in the newer selector functionality?

qdm12

Thanks! More comments to address, I'll review one last time after that. It's a bit of a huge PR, so it takes time to review 😉

qdm12 · 2026-04-23T20:03:34Z

+			if testCase.err == nil {
+				require.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			assert.ErrorIs(t, err, testCase.err)


same thing as

Suggested change

if testCase.err == nil {

require.NoError(t, err)

return

}

require.Error(t, err)

assert.ErrorIs(t, err, testCase.err)

assert.ErrorIs(t, err, testCase.err)

qdm12 · 2026-04-23T20:04:15Z

+		provider  string
+		err       error
+	}{
+		"purevpn default selection is valid": {


nit for all test cases, use underscores instead of spaces, because Go tooling replaces spaces with underscores in its logs, so it's easier to find the subtest name failing with copy and paste.

qdm12 · 2026-04-23T20:05:18Z

+		// Keep parsing SERVER_REGIONS for retro-compatibility, but
+		// do not apply it to PureVPN filtering.
+		ss.Regions = nil


Why not? It should still be applied somehow, otherwise it breaks compatibility.

qdm12 · 2026-04-23T20:07:41Z

+				Hostname:         "hostname",
+				TCP:              true,
+				UDP:              true,
+				OvpnX509:         "x509",


add TCPPorts and UDPPorts fields. Make sure order of the elements in each slice does not matter when comparing two servers.

qdm12 · 2026-04-23T20:08:34Z

+		return nil, fmt.Errorf("decompressing %s: %w", dataTarName, err)
+	}
+
+	asarContent, err = extractFileFromTar(dataTar, pureVPNAsarPath)


inline the constant pureVPNAsarPath right above this line, there is no need to have at global scope if it's used only here.

qdm12 · 2026-04-23T21:15:53Z

 	connection models.Connection, err error,
 ) {
-	defaults := utils.NewConnectionDefaults(80, 53, 0) //nolint:mnd
+	defaults := utils.NewConnectionDefaults(80, 15021, 0)


RE-ADD //nolint:mnd

qdm12 · 2026-04-23T21:17:31Z

+		}
+	}
+
+	return portForward, quantumResistant, obfuscated, p2p


what's the difference between portForward and p2p?

qdm12 · 2026-04-23T21:18:14Z

+
+	// Pulling from the largest geographies first tends to recover all active
+	// configuration versions with fewer requests.
+	prioritized := []string{"us", "uk", "de", "fr", "nl", "sg", "jp", "au", "ca"}


supernit

Suggested change

prioritized := []string{"us", "uk", "de", "fr", "nl", "sg", "jp", "au", "ca"}

prioritized := [...]string{"us", "uk", "de", "fr", "nl", "sg", "jp", "au", "ca"}

qdm12 · 2026-04-24T14:26:08Z

+func enrichLocationBlanks(ctx context.Context, ipFetcher common.IPFetcher, warner common.Warner, servers []models.Server) {
+	if ipFetcher == nil || !ipFetcher.CanFetchAnyIP() {
+		return
 	}


Keep the check as it was in the calling function:

if !u.ipFetcher.CanFetchAnyIP() { return nil, fmt.Errorf("%w: %s", common.ErrIPFetcherUnsupported, u.ipFetcher.String()) }

qdm12 · 2026-04-24T14:27:00Z

-		parsedCountry, parsedCity, warnings := parseHostname(servers[i].Hostname)
-		for _, warning := range warnings {
-			u.warner.Warn(warning)
+		if !needsGeolocationEnrichment(servers[i]) || len(servers[i].IPs) == 0 {


does this trigger often? Asking because ideally I would like to get rid of the ipFetcher entirely, purevpn is the only provider using it for its updater. Hopefully we can figure out enough data without it.

reedog117 · 2026-04-25T20:04:38Z

Thanks! More comments to address, I'll review one last time after that. It's a bit of a huge PR, so it takes time to review 😉

Awesome - will work on this in the next few days

qdm12 · 2026-05-10T02:48:23Z

I actually need this rather fast, this is blocking #3301 which I would like to finish soon (because purevpn is the only one using the public ip fetcher and this makes package imports shitty basically)
I'll circle back in a few days and comment here, I will pick up the PR if you didn't get the time to plunge back by then

qdm12 · 2026-06-11T22:24:50Z

FYI working on it now

qdm12 and others added 17 commits February 21, 2026 19:40

fix(firewall): flush conntrack table after enabling firewall at conta…

40812fc

…iner start - prevent leaks for connections made the first ~10 milliseconds when Gluetun starts - seems critical, but in practice this very rarely happen and it very hard to reproduce

purevpn: switch updater to linux deb local-data and protocol ports

ee8d62e

purevpn: improve resolver fallback and update OpenVPN port defaults

2a49d27

purevpn updater: fetch live inventory from app-derived URL

388e628

purevpn: add hostname-trait server type selection

dbe31bc

purevpn: add deterministic hostname-code location filters

32ff15d

purevpn: add template ingestion and p2p server type support

f81d061

purevpn: merge app local data and add multi-trait filter tests

6838917

purevpn: switch to city-only filters and match-all tags

2e88ef2

chore: remove local purevpn test harness scripts from repo

f7b0e54

purevpn: add OpenVPN fallback remote lines for port 1194

5a6b7c9

Merge origin/master into codex/purevpn-deb-updater

57662fc

chore: remove CSV/TSV PureVPN export tests from repo

f9ec7ba

purevpn: expand city code mappings and tighten inventory-port tests

a4afbe4

purevpn: remove atom secret env override and related tests

eac0f01

purevpn: remove fallback ports and reseller uid parsing test

bfe558d

chore(deps): tidy purevpn module dependencies

9c63460

reedog117 mentioned this pull request Feb 27, 2026

PureVPN provider revamp docs qdm12/gluetun-wiki#181

Open

This was referenced Feb 27, 2026

Bug: PureVPN port forwarding not working #1653

Open

Bug: PureVPN obf servers missing #1501

Open

Feature request: add custom port options for Purevpn #1725

Open

reedog117 mentioned this pull request Feb 28, 2026

Bug: gluetun is always trying port 53 for connection when downloaded OpenVPN files from PureVPN reference port 1194. #3148

Open

qdm12 reviewed Feb 28, 2026

View reviewed changes

purevpn: apply review feedback and split selector features out

b89cbbf

reedog117 mentioned this pull request Mar 3, 2026

purevpn: split selector filters into dedicated PR reedog117/gluetun#1

Open

Merge upstream/master into codex/purevpn-deb-updater

7253ec1

qdm12 force-pushed the master branch from 53bc8fb to d8a3cc3 Compare March 4, 2026 22:54

qdm12 added ☁️ PureVPN Category: Label missing ❗ labels Mar 7, 2026

qdm12 marked this pull request as draft March 7, 2026 05:22

qdm12 force-pushed the master branch 2 times, most recently from 2c06921 to 9a5995f Compare March 16, 2026 13:48

Merge branch 'master' into codex/purevpn-deb-updater

f0247ff

qdm12 force-pushed the master branch from f4a8fc4 to 086e374 Compare March 23, 2026 14:36

Merge branch 'master' into codex/purevpn-deb-updater

164d724

reedog117 requested a review from qdm12 March 28, 2026 21:43

qdm12 reviewed Apr 24, 2026

View reviewed changes

qdm12 mentioned this pull request Apr 24, 2026

Bug: wrong server for purevpn #3293

Open

qdm12 force-pushed the master branch 4 times, most recently from 40f126b to 44d5104 Compare May 3, 2026 04:29

qdm12 mentioned this pull request May 11, 2026

chore(storage): storage file structure changes #3301

Merged

qdm12 force-pushed the master branch from 3e64b87 to 1a25f73 Compare May 21, 2026 18:32

Merge branch 'master' into codex/purevpn-deb-updater

4ed9152

	prioritized := []string{"us", "uk", "de", "fr", "nl", "sg", "jp", "au", "ca"}
	prioritized := [...]string{"us", "uk", "de", "fr", "nl", "sg", "jp", "au", "ca"}

Uh oh!

Conversation

reedog117 commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issue

Assertions

Uh oh!

reedog117 commented Feb 27, 2026

Uh oh!

reedog117 commented Feb 27, 2026

Branch / commit

1) Targeted validation on host (macOS)

2) Targeted validation in Linux amd64 container

3) Full suite on host (informational)

Uh oh!

reedog117 commented Feb 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

reedog117 commented Mar 3, 2026

Uh oh!

reedog117 commented Mar 3, 2026

Uh oh!

reedog117 commented Mar 3, 2026

Uh oh!

reedog117 commented Mar 3, 2026

Uh oh!

reedog117 commented Mar 26, 2026

Uh oh!

qdm12 left a comment

Choose a reason for hiding this comment

Uh oh!

qdm12 Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qdm12 Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

reedog117 commented Feb 27, 2026 •

edited

Loading

qdm12 Apr 23, 2026 •

edited

Loading

qdm12 Apr 23, 2026 •

edited

Loading

qdm12 commented May 10, 2026 •

edited

Loading