PureVPN provider revamp by reedog117 · Pull Request #3165 · qdm12/gluetun

reedog117 · 2026-02-27T08:59:58Z

Description

PureVPN provider revamp:

integrates PureVPN inventory-driven server selection and OpenVPN template ingestion by extracting this from the PureVPN Linux client
removes legacy fallback port behavior in OpenVPN config generation and uses inventory-provided ports
aligns filtering behavior around stable location fields and inventory tags (including p2p/category/type filtering updates)

Issue

Closes Bug: gluetun is always trying port 53 for connection when downloaded OpenVPN files from PureVPN reference port 1194. #3148

Assertions

I am aware that we do not accept manual changes to the servers.json file
I am aware that any changes to settings should be reflected in the wiki

…iner start - prevent leaks for connections made the first ~10 milliseconds when Gluetun starts - seems critical, but in practice this very rarely happen and it very hard to reproduce

reedog117 · 2026-02-27T09:07:16Z

This PR is more comprehensive but addresses much of the shortcomings of #3149 by finding a better avenue to get an updated server list and parsing accepted protocols, port numbers, and other attributes directly from the same source used by PureVPN's GUI clients.

reedog117 · 2026-02-27T09:26:54Z

Test results summary for the PureVPN provider revamp branch.

Branch / commit

Branch: codex/purevpn-deb-updater
Head: 9c634605

1) Targeted validation on host (macOS)

go build ./cmd/gluetun
go test ./internal/provider/purevpn/... ./internal/provider/purevpn/updater/...

Result: ✅ pass

2) Targeted validation in Linux amd64 container

docker run --rm --platform linux/amd64 \
  -v "$PWD":/src -w /src golang:1.25-alpine3.22 \
  sh -lc '/usr/local/go/bin/go build ./cmd/gluetun && /usr/local/go/bin/go test ./internal/provider/purevpn/... ./internal/provider/purevpn/updater/...'

Result: ✅ pass

3) Full suite on host (informational)

go test ./...

Result: ⚠️ not fully green in this local macOS environment due unrelated/platform-sensitive tests:

internal/natpmp (UDP/rpc timeout expectation mismatch)
internal/netlink (wireguard support panic on unspecified platform)
internal/tun (operation not permitted on TUN node creation)

PureVPN-related packages are green in all runs above.

reedog117 · 2026-02-27T20:58:00Z

This potentially also closes #1501 #1725 and #1653

qdm12 · 2026-02-28T17:17:12Z

internal/openvpn/logs.go

 1. The VPN server IP address you are trying to connect to is no longer valid 🔌
   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list

-2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS


Addressed. I reverted this message change and restored SERVER_REGIONS in internal/openvpn/logs.go (and corresponding test).

qdm12 · 2026-02-28T17:17:40Z

internal/configuration/settings/serverselection.go

+	_ = ss
+	_ = warner


??????

Also we want to maintain retro-compatibility

Addressed. I removed the placeholder _ = ss / _ = warner edits and restored the Surfshark retro-compatibility branch in getLocationFilterChoices.

qdm12 · 2026-02-28T17:19:01Z

internal/configuration/settings/serverselection.go

+	// PureVPNCountryCodes filters PureVPN servers by deterministic
+	// 2-letter country code parsed from the hostname prefix.
+	PureVPNCountryCodes []string `json:"purevpn_country_codes"`


Use the Countries field and do a lookup country->country-code to maintain retro-compatibility and simplify code.

Addressed by removing the PureVPNCountryCodes feature from this PR. PureVPN now uses the existing selection fields (including Countries) for compatibility; the extra country-code filter knobs are no longer part of this PR.

qdm12 · 2026-02-28T17:19:35Z

internal/configuration/settings/serverselection.go

+	// PureVPNLocationCodes filters PureVPN servers by deterministic
+	// location code parsed from the hostname prefix (for example usca, ukm).
+	PureVPNLocationCodes []string `json:"purevpn_location_codes"`


sounds like we could use the Hostnames field then

Addressed by removing PureVPNLocationCodes from this PR. Deterministic per-host selection remains available through the existing Hostnames field.

qdm12 · 2026-02-28T17:21:28Z

internal/configuration/settings/serverselection.go

 		return fmt.Errorf("%w: %w", ErrCountryNotValid, err)
 	}

-	err = atLeastOneIsOneOfCaseInsensitive(settings.Regions, filterChoices.Regions, warner)


regions is used for nordvpn. I get AI makes it easier to rewrite stuff, but please at the very least read changes made and verify a bit. Otherwise it adds excessive load for me to review these, especially with the increasing amount of AI generated PRs.

Hey sorry I was a bit moody on the AI-generated PR; if you're not a Go developer, then I 100% appreciate the gesture, and I'll comment on what's to change and the AI can then adapt it. However if you're a Go dev, I would definitely appreciate you reading up on the changes first 😉 !

No worries - I'm def not a Go dev - my specialty in infra bash/terraform/NodeJS. My understanding was that I stopped using the regions field for PureVPN, but it was still being used for any other provider. Currently doing another scan to doublecheck, but unfortunately I don't have another set of creds with another provider other than PureVPN to confirm.

I'm trying to figure out a way to populate regions for PureVPN but I think I end up getting ratelimited by the IP geolocation APIs due to the sheer number of servers that need to be looked up.

Addressed. Region validation remains for non-PureVPN providers (including NordVPN) and the broader region logic has been restored. For PureVPN specifically, I now ignore SERVER_REGIONS at validation time to avoid impacting PureVPN selection.

Appreciate it. I went through each requested change line-by-line, restored the non-PureVPN region behavior, and split out the extra PureVPN filtering feature work from this PR.

qdm12 · 2026-02-28T17:21:49Z

internal/configuration/settings/serverselection.go

 	ss.Countries = r.CSV("SERVER_COUNTRIES", reader.RetroKeys(countriesRetroKeys...))

-	ss.Regions = r.CSV("SERVER_REGIONS", reader.RetroKeys("REGION"))
+	ss.Regions = nil


Addressed. I reverted ss.Regions = nil in read() so SERVER_REGIONS is still parsed normally. PureVPN-specific behavior is now handled later in validation (regions are ignored only when provider is PureVPN).

qdm12 · 2026-02-28T17:22:26Z

internal/openvpn/logs_test.go

   Check out https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list

-2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_REGIONS
+2. The VPN server crashed 💥, try changing your VPN servers filtering options such as SERVER_CITIES


unneeded change, revert

Addressed. Reverted this test change so it matches the restored SERVER_REGIONS log message.

qdm12 · 2026-02-28T17:23:21Z

internal/provider/purevpn/updater/servers.go


-	const url = "https://d11a57lttb2ffq.cloudfront.net/heartbleed/router/Recommended-CA2.zip"
-	contents, err := u.unzipper.FetchAndExtract(ctx, url)
+	debContent, err := fetchURL(ctx, http.DefaultClient, debURL)


use the u.client instead of http.DefaultClient. If not present, inject it into the Updater New function

Addressed. I injected the HTTP client into the PureVPN updater (Updater now has client *http.Client), defaulting to http.DefaultClient only if nil. .deb URL/content and inventory fetches now use u.client.

reedog117 · 2026-03-03T03:22:33Z

[Generated by Codex]

Summary of review feedback addressed:

Reverted OpenVPN TLS help text change and restored SERVER_REGIONS wording in:
- internal/openvpn/logs.go
- internal/openvpn/logs_test.go
Restored Surfshark retro-compatibility logic in getLocationFilterChoices.
Restored region validation/filtering behavior for non-PureVPN providers (including NordVPN).
Kept SERVER_REGIONS parsing in read() for compatibility, and now ignore regions only when provider is PureVPN during validation.
Removed the extra PureVPN filtering feature set (PureVPNServerTypes, PureVPNCountryCodes, PureVPNLocationCodes) from this PR so it can be split separately.
Updated PureVPN updater networking to use injected client (u.client) instead of direct http.DefaultClient calls:
- Added client *http.Client to updater
- Default to http.DefaultClient only if nil
- Switched .deb and inventory fetches to u.client

Validation done locally:

go test ./internal/configuration/settings ./internal/provider/purevpn/... ./internal/provider/utils ./internal/storage ./internal/openvpn
go build ./cmd/gluetun
Real containerized PureVPN UDP connect test with credentials:
- OpenVPN reached Initialization Sequence Completed
- In-container egress IP checks confirmed VPN-routed traffic (distinct from host IP)

reedog117 · 2026-03-03T03:30:16Z

[Generated by Codex]\n\nI split the selector work into a dedicated stacked PR based on :\n- https://github.com/reedog117/gluetun/pull/1\n\nThis contains the PureVPN selector functionality (, , , , country/location code selectors) separated from the base updater changes.

reedog117 · 2026-03-03T03:30:27Z

[Generated by Codex]

I split the selector work into a dedicated stacked PR based on codex/purevpn-deb-updater:

purevpn: split selector filters into dedicated PR reedog117/gluetun#1

This contains the PureVPN selector functionality (p2p, quantumresistant, obfuscation, portforwarding, and country/location code selectors) separated from the base updater changes.

reedog117 · 2026-03-03T04:58:59Z

[Generated by Codex]

I split the selector work into a dedicated stacked PR based on codex/purevpn-deb-updater:

purevpn: split selector filters into dedicated PR reedog117/gluetun#1

This contains the PureVPN selector functionality (p2p, quantumresistant, obfuscation, portforwarding, and country/location code selectors) separated from the base updater changes.

This PR #3165 needs to be merged in before I can bring the selector functionality in as a separate PR as it's dependent on the new server inventory selection methods from here.

reedog117 · 2026-03-26T17:45:14Z

@qdm12 what additional steps are needed at this point to merge this and then i can bring in the newer selector functionality?

qdm12 and others added 17 commits February 21, 2026 19:40

fix(firewall): flush conntrack table after enabling firewall at conta…

40812fc

…iner start - prevent leaks for connections made the first ~10 milliseconds when Gluetun starts - seems critical, but in practice this very rarely happen and it very hard to reproduce

purevpn: switch updater to linux deb local-data and protocol ports

ee8d62e

purevpn: improve resolver fallback and update OpenVPN port defaults

2a49d27

purevpn updater: fetch live inventory from app-derived URL

388e628

purevpn: add hostname-trait server type selection

dbe31bc

purevpn: add deterministic hostname-code location filters

32ff15d

purevpn: add template ingestion and p2p server type support

f81d061

purevpn: merge app local data and add multi-trait filter tests

6838917

purevpn: switch to city-only filters and match-all tags

2e88ef2

chore: remove local purevpn test harness scripts from repo

f7b0e54

purevpn: add OpenVPN fallback remote lines for port 1194

5a6b7c9

Merge origin/master into codex/purevpn-deb-updater

57662fc

chore: remove CSV/TSV PureVPN export tests from repo

f9ec7ba

purevpn: expand city code mappings and tighten inventory-port tests

a4afbe4

purevpn: remove atom secret env override and related tests

eac0f01

purevpn: remove fallback ports and reseller uid parsing test

bfe558d

chore(deps): tidy purevpn module dependencies

9c63460

reedog117 mentioned this pull request Feb 27, 2026

PureVPN provider revamp docs qdm12/gluetun-wiki#181

Open

This was referenced Feb 27, 2026

Bug: PureVPN port forwarding not working #1653

Open

Bug: PureVPN obf servers missing #1501

Open

Feature request: add custom port options for Purevpn #1725

Open

reedog117 mentioned this pull request Feb 28, 2026

Bug: gluetun is always trying port 53 for connection when downloaded OpenVPN files from PureVPN reference port 1194. #3148

Open

qdm12 reviewed Feb 28, 2026

View reviewed changes

purevpn: apply review feedback and split selector features out

b89cbbf

reedog117 mentioned this pull request Mar 3, 2026

purevpn: split selector filters into dedicated PR reedog117/gluetun#1

Open

Merge upstream/master into codex/purevpn-deb-updater

7253ec1

qdm12 force-pushed the master branch from 53bc8fb to d8a3cc3 Compare March 4, 2026 22:54

qdm12 added ☁️ PureVPN Category: Label missing ❗ labels Mar 7, 2026

qdm12 marked this pull request as draft March 7, 2026 05:22

qdm12 force-pushed the master branch 2 times, most recently from 2c06921 to 9a5995f Compare March 16, 2026 13:48

Merge branch 'master' into codex/purevpn-deb-updater

f0247ff

qdm12 force-pushed the master branch from f4a8fc4 to 086e374 Compare March 23, 2026 14:36

Merge branch 'master' into codex/purevpn-deb-updater

164d724

reedog117 requested a review from qdm12 March 28, 2026 21:43

Uh oh!

Conversation

reedog117 commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issue

Assertions

Uh oh!

reedog117 commented Feb 27, 2026

Uh oh!

reedog117 commented Feb 27, 2026

Branch / commit

1) Targeted validation on host (macOS)

2) Targeted validation in Linux amd64 container

3) Full suite on host (informational)

Uh oh!

reedog117 commented Feb 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

reedog117 commented Mar 3, 2026

Uh oh!

reedog117 commented Mar 3, 2026

Uh oh!

reedog117 commented Mar 3, 2026

Uh oh!

reedog117 commented Mar 3, 2026

Uh oh!

reedog117 commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

reedog117 commented Feb 27, 2026 •

edited

Loading