feat(cryptostorm): add WireGuard and OpenVPN provider support by mpatton125 · Pull Request #3164 · passteque/gluetun

mpatton125 · 2026-02-26T23:10:57Z

Description

Add cryptostorm.is as a new VPN provider with both WireGuard and OpenVPN support
Both protocols use port 443 (TCP/UDP), server data fetched from cryptostorm JSON API
Includes port forwarding support via cryptostorm's internal forwarding server

Issue

Fix #3112

🤖 Generated with Claude Code <--- Full disclosure

qdm12

Big hallucination on the updating servers code. this needs to be fixed somehow, or this PR won't be accepted
Port forwarding: I need a human to check the information returned from the port forwarding endpoint when connected
When above is done, I need a human to verify openvpn tcp, udp, wireguard and port forwarding all work fine.

qdm12 · 2026-03-06T16:25:21Z

+// their publicly available node list. If the upstream format changes,
+// update the nodeData struct and parsing logic accordingly.
+func fetchAPI(ctx context.Context, client *http.Client) (data []nodeData, err error) {
+	const url = "https://cryptostorm.is/wireguard/nodes.json"


there is no json API, this url is the same as https://cryptostorm.is/wireguard. This returns html, not json and this will fail

Now scraping endpoint data from https://cryptostorm.is/wireguard.

qdm12 · 2026-03-06T16:26:56Z

+func (p *Provider) GetConnection(selection settings.ServerSelection, ipv6Supported bool) (
+	connection models.Connection, err error,
+) {
+	defaults := utils.NewConnectionDefaults(443, 443, 443) //nolint:mnd


please double check openvpn udp tcp and wireguard all work with those 443 ports.

Definitely both work with 443 - provider says they accept OpenVPN and Wireguard connections on any port (1-65535).

qdm12 · 2026-03-06T16:30:46Z

+      }
+    ]
+  },
+  "cryptostorm": {


that was not obtained from the code in the updater, so it most likely pure hallucination; fix the updater and revert these changes.

qdm12 · 2026-03-06T16:35:18Z

+// If the port is already forwarded (e.g. from a previous session) it will appear in
+// the list regardless of whether the POST succeeded, so we treat that as success.
+// Valid port range is 30000–65535.
+// See: https://cryptostorm.is/port_forwarding


404 not found, possible hallucination? please fix

it's https://cryptostorm.is/portfwd

qdm12 · 2026-03-06T16:36:29Z

+		postBody = "port=" + strconv.FormatUint(uint64(objects.ListeningPort), 10)
+	}
+
+	pfURL := "http://" + cryptostormPFServer + "/fwd"


add a comment for IPv6 it's http://[2001:db8::7]/fwd - that will be used later.

qdm12 · 2026-03-06T16:38:23Z

+		postBody = "port=" + strconv.FormatUint(uint64(objects.ListeningPort), 10)
+	}
+
+	pfURL := "http://" + cryptostormPFServer + "/fwd"


@mpatton125 can you check what http://10.31.33.7/fwd returns when you are connected to the VPN? To confirm what the AI wrote is correct

qdm12 · 2026-03-06T16:38:50Z

+
+	const base, bitSize = 10, 16
+	for _, match := range matches {
+		portUint64, err := strconv.ParseUint(match[1], base, bitSize)


can there be multiple ports? 🤔

Yes this provider allows multiple port forwards, per endpoint.

Is there a maximum limit of ports forwarded??

Let's wait for #3208 to be merged, then this can use the new setting field PortsCount

rebase on upstream master, which supports multiple ports. What's the number of ports limit?

qdm12 · 2026-03-06T16:46:04Z

+	// ListeningPort is the port to request from the provider, used by Cryptostorm.
+	// A value of 0 means let the provider assign a port.
+	ListeningPort uint16


@mpatton125 please confirm if http://10.31.33.7/fwd tells you you can specify a port field, and if that port field can be set to 0 to let cryptostorm assign you a random port.

If this is the case:

use the VPN_PORT_FORWARDING_LISTENING_PORT value to set this. If this one is not set, try to read it from /gluetun/portforward/cryptostorm.json. If this file does not exist, leave the ListeningPort field to 0 to let cryptostorm decide.

in all cases, persist the resulting port(s) to /gluetun/portforward/cryptostorm.json

And also:

add a comment in internal/provider/privateinternetaccess/provider.go next to const jsonPortForwardPath = "/gluetun/piaportforward.json" saying TODO v4: move to /gluetun/portforward/privateinternetaccess.json

update the comment for the settings field VPN_PORT_FORWARDING_LISTENING_PORT and make sure it runs a no-op in case the forwarded port is already the value specified in VPN_PORT_FORWARDING_LISTENING_PORT

Yes you can specify a port at that URL, from 30000-65535. No, it can't be 0 for a random port - user must specify.

Got it, let's wait for #3208

note for future:

we'll then use VPN_PORT_FORWARDING_LISTENING_PORTS=8000,8001 to specify ports you want. We should then change func (p *PortForwarding) setDefaults() to func (p *PortForwarding) setDefaults(vpnProvider string) and set, if the vpnProvider is cryptostorm only, p.PortsCount = gosettings.DefaultComparable(p.PortsCount, len(p.ListeningPorts))

qdm12 · 2026-03-10T13:08:16Z

+	// is its default as well. For Cryptostorm, this also specifies the
+	// port to request for forwarding (must be between 30000 and 65535).


(no action for now) to be updated after #3208 is merged and this branch gets updated with master.

qdm12 · 2026-03-10T13:09:13Z

 		CanPortForward: s.settings.CanPortForward,
 		Username:       s.settings.Username,
 		Password:       s.settings.Password,
+		ListeningPort:  s.settings.ListeningPort,


(no action for now) to be updated after #3208 is merged - add comment stating this is only used for cryptostorm to request specific ports, for other providers, it's only used to redirect ports

qdm12 · 2026-03-10T13:10:40Z

+		}

-	err = s.onNewPorts(ctx, ports)
+		if s.settings.ListeningPort != 0 && port != s.settings.ListeningPort {


(no action for now) to be updated after #3208 is merged - update to check by index ports[i] != s.settings.ListeningPorts[i] and also we should ensure both slices are sorted

qdm12 · 2026-03-10T13:11:10Z

+type nodeData struct {
+	Location string // e.g. "Canada - Montreal", "Austria", "US - Texas - Dallas"
+	Hostname string // e.g. "austria.cstorm.is"
+	WgPubKey string // WireGuard public key


nit unneeded

Suggested change

WgPubKey string // WireGuard public key

WgPubKey string

qdm12 · 2026-03-11T13:03:27Z

+		return nil, nil, fmt.Errorf("fetching HTML: %w", err)
+	}
+
+	return parseHTML(rootNode)


Suggested change

return parseHTML(rootNode)

nodes, warnings, err = parseHTML(rootNode)

if err != nil {

return nil, nil, fmt.Errorf("parsing HTML: %w", err)

}

return nodes, warnings, nil

qdm12 · 2026-05-04T18:59:38Z

+	// Allow explicit endpoint IP override.
+	switch selection.VPN {
+	case vpn.OpenVPN:
+		if t := selection.OpenVPN.EndpointIP; t.IsValid() && !t.IsUnspecified() {


why t??? change to ip. same below

qdm12 · 2026-05-04T19:00:39Z

+
+	const base, bitSize = 10, 16
+	for _, match := range matches {
+		portUint64, err := strconv.ParseUint(match[1], base, bitSize)


rebase on upstream master, which supports multiple ports. What's the number of ports limit?

qdm12 · 2026-05-04T19:01:02Z

+	common.Fetcher
+}
+
+func New(storage common.Storage, randSource rand.Source,


rebase on upstream master, randSource is no longer needed.

qdm12 · 2026-05-04T19:01:45Z

+	client *http.Client, updaterWarner common.Warner,
+	parallelResolver common.ParallelResolver,
+) *Provider {
+	const jsonPortForwardPath = "/gluetun/portforward/cryptostorm.json"


nit rename to portForwardPath

qdm12 · 2026-05-04T19:02:23Z

 	PortsCount uint16
+	// ListeningPorts are the user-specified ports. For Cryptostorm, ListeningPorts[0]
+	// is the port to request from the forwarding server (must be 30000–65535).
+	// A nil or [0] value means fall back to the persisted port.


can there be multiple ports requested?

…and IPv6 Implements Cryptostorm as a gluetun VPN provider supporting WireGuard and OpenVPN protocols, dual-stack IPv4/IPv6 port forwarding via HTTP to the Cryptostorm forwarding servers, and a server updater that fetches node data from cryptostorm.is/wireguard. Key changes: - Provider struct using ConnectionPicker (aligned with master's pattern) - Port forwarding with IPv4 (10.31.33.7) and IPv6 (2001:db8::7) endpoints - Updater with simplified client-only struct (no parallelResolver/warner) - DNS resolution via net.DefaultResolver in the updater - setDefaults(vpnProvider) signature to set PortsCount default for Cryptostorm - Self-redirect guard in portforward service onNewPorts() - ListeningPorts support in PortForwardObjects Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…s module When a provider's JSON file is not yet in the embedded gluetun-servers module (e.g. newly added providers like Cryptostorm), start with an empty server list instead of panicking. The updater will populate servers at runtime. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…errors common.ErrPortForwardNotSupported and common.ErrHTTPStatusCodeNotOK were removed from master. Replace with inline fmt.Errorf calls matching the pattern used by other providers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…rence

Without a version, checkVersions() discards any on-disk data for the provider because version 0 never matches the file's version 1. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

mpatton125 force-pushed the claude/crazy-brahmagupta branch from c911ea8 to 7a9856f Compare February 26, 2026 23:47

qdm12 force-pushed the master branch from 53bc8fb to d8a3cc3 Compare March 4, 2026 22:54

qdm12 requested changes Mar 6, 2026

View reviewed changes

qdm12 marked this pull request as draft March 7, 2026 05:21

qdm12 mentioned this pull request Mar 9, 2026

Feature request: cryptostorm.is VPN #3112

Open

qdm12 force-pushed the master branch 2 times, most recently from 2c06921 to 9a5995f Compare March 16, 2026 13:48

qdm12 force-pushed the master branch from f4a8fc4 to 086e374 Compare March 23, 2026 14:36

mpatton125 marked this pull request as ready for review April 15, 2026 00:49

mpatton125 requested a review from qdm12 April 15, 2026 22:23

mpatton125 force-pushed the claude/crazy-brahmagupta branch from cd21991 to e79b2df Compare April 23, 2026 00:02

qdm12 force-pushed the master branch 4 times, most recently from 40f126b to 44d5104 Compare May 3, 2026 04:29

qdm12 reviewed May 4, 2026

View reviewed changes

qdm12 force-pushed the master branch from 3e64b87 to 1a25f73 Compare May 21, 2026 18:32

Michael Patton and others added 2 commits June 29, 2026 10:37

mpatton125 force-pushed the claude/crazy-brahmagupta branch from c9f07b2 to 33410b3 Compare June 29, 2026 00:40

mpatton125 mentioned this pull request Jun 29, 2026

feat: add Cryptostorm server data qdm12/gluetun-servers#5

Open

Michael Patton and others added 2 commits June 29, 2026 11:04

fix(cryptostorm): remove final common.ErrPortForwardNotSupported refe…

72533a8

…rence

mpatton125 requested a review from qdm12 June 29, 2026 01:11

fix(storage): set Version=1 for missing provider fallback

2da1180

Without a version, checkVersions() discards any on-disk data for the provider because version 0 never matches the file's version 1. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

		// is its default as well. For Cryptostorm, this also specifies the
		// port to request for forwarding (must be between 30000 and 65535).

-	return parseHTML(rootNode)
+	nodes, warnings, err = parseHTML(rootNode)
+	if err != nil {
+		return nil, nil, fmt.Errorf("parsing HTML: %w", err)
+	}
+	return nodes, warnings, nil

Uh oh!

Uh oh!

Conversation

mpatton125 commented Feb 26, 2026 • edited by qdm12 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issue

Uh oh!

qdm12 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qdm12 Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mpatton125 commented Feb 26, 2026 •

edited by qdm12

Loading

qdm12 Mar 10, 2026 •

edited

Loading