feat(cryptostorm): add WireGuard and OpenVPN provider support by mpatton125 · Pull Request #3164 · passteque/gluetun

mpatton125 · 2026-02-26T23:10:57Z

Description

Add cryptostorm.is as a new VPN provider with both WireGuard and OpenVPN support
Both protocols use port 443 (TCP/UDP), server data fetched from cryptostorm JSON API
Includes port forwarding support via cryptostorm's internal forwarding server

Issue

Fix #3112

🤖 Generated with Claude Code <--- Full disclosure

qdm12

Big hallucination on the updating servers code. this needs to be fixed somehow, or this PR won't be accepted
Port forwarding: I need a human to check the information returned from the port forwarding endpoint when connected
When above is done, I need a human to verify openvpn tcp, udp, wireguard and port forwarding all work fine.

qdm12 · 2026-03-06T16:25:21Z

+// their publicly available node list. If the upstream format changes,
+// update the nodeData struct and parsing logic accordingly.
+func fetchAPI(ctx context.Context, client *http.Client) (data []nodeData, err error) {
+	const url = "https://cryptostorm.is/wireguard/nodes.json"


there is no json API, this url is the same as https://cryptostorm.is/wireguard. This returns html, not json and this will fail

Now scraping endpoint data from https://cryptostorm.is/wireguard.

qdm12 · 2026-03-06T16:26:56Z

+func (p *Provider) GetConnection(selection settings.ServerSelection, ipv6Supported bool) (
+	connection models.Connection, err error,
+) {
+	defaults := utils.NewConnectionDefaults(443, 443, 443) //nolint:mnd


please double check openvpn udp tcp and wireguard all work with those 443 ports.

Definitely both work with 443 - provider says they accept OpenVPN and Wireguard connections on any port (1-65535).

Really ? Can they accept both openvpn udp and wireguard (udp) on the same port ?? That seems odd 🤔 Or do you pick the port on their web ui for example ?

qdm12 · 2026-03-06T16:30:46Z

+      }
+    ]
+  },
+  "cryptostorm": {


that was not obtained from the code in the updater, so it most likely pure hallucination; fix the updater and revert these changes.

qdm12 · 2026-03-06T16:35:18Z

+// If the port is already forwarded (e.g. from a previous session) it will appear in
+// the list regardless of whether the POST succeeded, so we treat that as success.
+// Valid port range is 30000–65535.
+// See: https://cryptostorm.is/port_forwarding


404 not found, possible hallucination? please fix

it's https://cryptostorm.is/portfwd

qdm12 · 2026-03-06T16:36:29Z

+		postBody = "port=" + strconv.FormatUint(uint64(objects.ListeningPort), 10)
+	}
+
+	pfURL := "http://" + cryptostormPFServer + "/fwd"


add a comment for IPv6 it's http://[2001:db8::7]/fwd - that will be used later.

qdm12 · 2026-03-06T16:38:23Z

+		postBody = "port=" + strconv.FormatUint(uint64(objects.ListeningPort), 10)
+	}
+
+	pfURL := "http://" + cryptostormPFServer + "/fwd"


@mpatton125 can you check what http://10.31.33.7/fwd returns when you are connected to the VPN? To confirm what the AI wrote is correct

qdm12 · 2026-03-06T16:38:50Z

+
+	const base, bitSize = 10, 16
+	for _, match := range matches {
+		portUint64, err := strconv.ParseUint(match[1], base, bitSize)


can there be multiple ports? 🤔

Yes this provider allows multiple port forwards, per endpoint.

Is there a maximum limit of ports forwarded??

Let's wait for #3208 to be merged, then this can use the new setting field PortsCount

rebase on upstream master, which supports multiple ports. What's the number of ports limit?

qdm12 · 2026-03-06T16:46:04Z

+	// ListeningPort is the port to request from the provider, used by Cryptostorm.
+	// A value of 0 means let the provider assign a port.
+	ListeningPort uint16


@mpatton125 please confirm if http://10.31.33.7/fwd tells you you can specify a port field, and if that port field can be set to 0 to let cryptostorm assign you a random port.

If this is the case:

use the VPN_PORT_FORWARDING_LISTENING_PORT value to set this. If this one is not set, try to read it from /gluetun/portforward/cryptostorm.json. If this file does not exist, leave the ListeningPort field to 0 to let cryptostorm decide.

in all cases, persist the resulting port(s) to /gluetun/portforward/cryptostorm.json

And also:

add a comment in internal/provider/privateinternetaccess/provider.go next to const jsonPortForwardPath = "/gluetun/piaportforward.json" saying TODO v4: move to /gluetun/portforward/privateinternetaccess.json

update the comment for the settings field VPN_PORT_FORWARDING_LISTENING_PORT and make sure it runs a no-op in case the forwarded port is already the value specified in VPN_PORT_FORWARDING_LISTENING_PORT

Yes you can specify a port at that URL, from 30000-65535. No, it can't be 0 for a random port - user must specify.

Got it, let's wait for #3208

note for future:

we'll then use VPN_PORT_FORWARDING_LISTENING_PORTS=8000,8001 to specify ports you want. We should then change func (p *PortForwarding) setDefaults() to func (p *PortForwarding) setDefaults(vpnProvider string) and set, if the vpnProvider is cryptostorm only, p.PortsCount = gosettings.DefaultComparable(p.PortsCount, len(p.ListeningPorts))

qdm12 · 2026-03-10T13:10:40Z

+		}

-	err = s.onNewPorts(ctx, ports)
+		if s.settings.ListeningPort != 0 && port != s.settings.ListeningPort {


(no action for now) to be updated after #3208 is merged - update to check by index ports[i] != s.settings.ListeningPorts[i] and also we should ensure both slices are sorted

qdm12 · 2026-05-04T19:00:39Z

+
+	const base, bitSize = 10, 16
+	for _, match := range matches {
+		portUint64, err := strconv.ParseUint(match[1], base, bitSize)


rebase on upstream master, which supports multiple ports. What's the number of ports limit?

qdm12 · 2026-05-04T19:01:45Z

+	client *http.Client, updaterWarner common.Warner,
+	parallelResolver common.ParallelResolver,
+) *Provider {
+	const jsonPortForwardPath = "/gluetun/portforward/cryptostorm.json"


nit rename to portForwardPath

qdm12 · 2026-05-04T19:02:23Z

 	PortsCount uint16
+	// ListeningPorts are the user-specified ports. For Cryptostorm, ListeningPorts[0]
+	// is the port to request from the forwarding server (must be 30000–65535).
+	// A nil or [0] value means fall back to the persisted port.


can there be multiple ports requested?

From some preliminary testing, I don't think you can request multiple ports in one POST request, but you can have multiple ports open if you request them one by one. You can close them all at once though:

➜ curl --request POST --data 'port=80808,80809' http://10.31.33.7/fwd INVALID_PARAM_RECEIVED Add a port: wget -qO- http://10.31.33.7/fwd --post-data="port=31337" curl -sS http://10.31.33.7/fwd -d port=31337 Delete one port: wget -qO- http://10.31.33.7/fwd --post-data="delfwd=31337" curl -sS http://10.31.33.7/fwd -d delfwd=31337 Delete all ports: wget -qO- http://10.31.33.7/fwd --post-data="delallfwd=1" curl -sS http://10.31.33.7/fwd -d delallfwd=1

Leaving the parameter empty, setting it to 0, or trying ports instead of port are all invalid. It seems you have to explicitly request one specific port at a time.

I'd like to see this merged, so let me know if there's anything else you'd like me to test.

Interesting, something we can add later (or now up to you) for multiple ports

…and IPv6 Implements Cryptostorm as a gluetun VPN provider supporting WireGuard and OpenVPN protocols, dual-stack IPv4/IPv6 port forwarding via HTTP to the Cryptostorm forwarding servers, and a server updater that fetches node data from cryptostorm.is/wireguard. Key changes: - Provider struct using ConnectionPicker (aligned with master's pattern) - Port forwarding with IPv4 (10.31.33.7) and IPv6 (2001:db8::7) endpoints - Updater with simplified client-only struct (no parallelResolver/warner) - DNS resolution via net.DefaultResolver in the updater - setDefaults(vpnProvider) signature to set PortsCount default for Cryptostorm - Self-redirect guard in portforward service onNewPorts() - ListeningPorts support in PortForwardObjects Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…s module When a provider's JSON file is not yet in the embedded gluetun-servers module (e.g. newly added providers like Cryptostorm), start with an empty server list instead of panicking. The updater will populate servers at runtime. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…errors common.ErrPortForwardNotSupported and common.ErrHTTPStatusCodeNotOK were removed from master. Replace with inline fmt.Errorf calls matching the pattern used by other providers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…rence

Without a version, checkVersions() discards any on-disk data for the provider because version 0 never matches the file's version 1. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

amarevite · 2026-09-17T20:40:58Z

What work remains before this can be merged? Is it's just linting and git tree management or are code changes needed before it can be merged?

mpatton125 · 2026-09-17T21:54:51Z

I'm not sure what needs to be done for it to be merged. It works - I've been using it for months.

qdm12 · 2026-09-17T22:26:09Z

I'll review this post v3.42.0 release which I'm trying to get out soon - I'm still playing catchup with PRs these days, but I'll get to it !
You can use code from the fork/branch in the meantime.

Edit : I'll try to review it tomorrow fingers crossed !

qdm12 · 2026-09-17T22:45:25Z

+	// the corresponding listening port. For Cryptostorm, ListeningPorts[0]
+	// also specifies the port to request from the forwarding server (30000–65535).


since cryptostorm appears to support multiple ports, I think it would be nice to support it here. That way that comment can be changed to:

Suggested change

// the corresponding listening port. For Cryptostorm, ListeningPorts[0]

// also specifies the port to request from the forwarding server (30000–65535).

// the corresponding listening port. For VPN providers supporting requesting

// specific ports (Cryptostorm), this is used to request ports.

qdm12 · 2026-09-17T22:48:08Z

+	// For Cryptostorm, default PortsCount to the number of listening ports
+	// specified, since each listening port maps directly to a requested port.
+	defaultPortsCount := uint16(1)
+	if vpnProvider == providers.Cryptostorm &&
+		len(p.ListeningPorts) > 0 && p.ListeningPorts[0] != 0 {
+		defaultPortsCount = uint16(len(p.ListeningPorts))
+	}
+	p.PortsCount = gosettings.DefaultComparable(p.PortsCount, defaultPortsCount)


since the Validate method already takes the vpn provider string as argument, let's just validate that the user sets the ports count to the same number of listening ports, and revert the changes to setDefaults here.
By the way, can a user request a random port instead of a specific port?

qdm12 · 2026-09-17T22:53:27Z

+	seen := make(map[string]struct{}, len(hts))
+	hosts = make([]string, 0, len(hts))
+	for key := range hts {
+		host := extractHost(key)
+		if _, ok := seen[host]; !ok {
+			seen[host] = struct{}{}
+			hosts = append(hosts, host)
+		}
+	}
+	return hosts


nit a tiny bit shorter

Suggested change

seen := make(map[string]struct{}, len(hts))

hosts = make([]string, 0, len(hts))

for key := range hts {

host := extractHost(key)

if _, ok := seen[host]; !ok {

seen[host] = struct{}{}

hosts = append(hosts, host)

}

}

return hosts

hosts := slices.Collect(maps.Keys(hts))

for i, h := range hosts {

hosts[i] = extractHost(h)

}

slices.Sort(hosts)

return slices.Compact(hosts)

qdm12 · 2026-09-17T23:10:45Z

+	for _, url := range portForwardURLs {
+		found, err := p.registerPort(ctx, objects.Client, url, postBody, listeningPort, objects)
+		if err != nil {
+			if url == portForwardURLs[0] {
+				// IPv4 failure is fatal.
+				return nil, err
+			}
+			// IPv6 failure is a warning only.
+			objects.Logger.Warn("IPv6 port forward registration failed (" + url + "): " + err.Error())
+			continue
+		}


nit do it outside a for loop, this is a bit confusing that index 0 is ipv4 and index 1 is ipv6. Just have two code blocks following each-other, and ideally enable the ipv6 block in an if block if ipv6 is in fact supported.

qdm12 · 2026-09-17T23:12:06Z

+		matches = regexForwardHTML.FindAllStringSubmatch(bodyStr, -1)
+	}
+	if len(matches) == 0 {
+		return false, fmt.Errorf("port forwarding not supported: no active port forwards found in response")


Suggested change

return false, fmt.Errorf("port forwarding not supported: no active port forwards found in response")

return false, fmt.Errorf("port forwarding not supported: no active port forwards found in response: %s", bodyStr)

qdm12 · 2026-09-17T23:13:24Z

+// registerPort POSTs the port to a single forwarding endpoint and returns
+// whether the requested port was confirmed in the response.
+func (p *Provider) registerPort(ctx context.Context, client *http.Client,


nit move this below KeepPortForward and above deletePortFromURL

qdm12 · 2026-09-17T23:17:42Z

+
+	// Best-effort deregister on teardown. Use a fresh context since the
+	// original is already cancelled.
+	if p.forwardedPort != 0 {


can forwardedPort be ever 0 when we call .KeepPortForward? I don't think so 🤔

qdm12 · 2026-09-17T23:20:31Z

+			// Provider not yet in the gluetun-servers module; start with an empty list.
+			// The updater can still populate servers at runtime.
+			const serversPath = "/gluetun/servers/"
+			allServers.ProviderToServers[provider] = models.Servers{
+				Version:  1,
+				Filepath: filepath.Join(serversPath, filename),
+			}
+			continue


Remove this and in go.mod, add a replace github.com/qdm12/gluetun-servers github.com/mpatton125/gluetun-servers#main (or something of that nature) to get cryptostorm data from the PR? Typing from my phone but I'm curious if this works, since that would be useful for future VPN provider PRs!

mpatton125 force-pushed the claude/crazy-brahmagupta branch from c911ea8 to 7a9856f Compare February 26, 2026 23:47

qdm12 force-pushed the master branch from 53bc8fb to d8a3cc3 Compare March 4, 2026 22:54

qdm12 requested changes Mar 6, 2026

View reviewed changes

qdm12 marked this pull request as draft March 7, 2026 05:21

qdm12 mentioned this pull request Mar 9, 2026

Feature request: cryptostorm.is VPN #3112

Open

qdm12 force-pushed the master branch 2 times, most recently from 2c06921 to 9a5995f Compare March 16, 2026 13:48

qdm12 force-pushed the master branch from f4a8fc4 to 086e374 Compare March 23, 2026 14:36

mpatton125 marked this pull request as ready for review April 15, 2026 00:49

mpatton125 requested a review from qdm12 April 15, 2026 22:23

mpatton125 force-pushed the claude/crazy-brahmagupta branch from cd21991 to e79b2df Compare April 23, 2026 00:02

qdm12 force-pushed the master branch 4 times, most recently from 40f126b to 44d5104 Compare May 3, 2026 04:29

qdm12 reviewed May 4, 2026

View reviewed changes

qdm12 force-pushed the master branch from 3e64b87 to 1a25f73 Compare May 21, 2026 18:32

Michael Patton and others added 2 commits June 29, 2026 10:37

mpatton125 force-pushed the claude/crazy-brahmagupta branch from c9f07b2 to 33410b3 Compare June 29, 2026 00:40

mpatton125 mentioned this pull request Jun 29, 2026

feat: add Cryptostorm server data qdm12/gluetun-servers#5

Open

Michael Patton and others added 2 commits June 29, 2026 11:04

fix(cryptostorm): remove final common.ErrPortForwardNotSupported refe…

72533a8

…rence

mpatton125 requested a review from qdm12 June 29, 2026 01:11

fix(storage): set Version=1 for missing provider fallback

2da1180

Without a version, checkVersions() discards any on-disk data for the provider because version 0 never matches the file's version 1. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

qdm12 force-pushed the master branch from 17c553c to 9408b39 Compare September 12, 2026 17:39

qdm12 requested changes Sep 17, 2026

View reviewed changes

		// the corresponding listening port. For Cryptostorm, ListeningPorts[0]
		// also specifies the port to request from the forwarding server (30000–65535).

	return false, fmt.Errorf("port forwarding not supported: no active port forwards found in response")
	return false, fmt.Errorf("port forwarding not supported: no active port forwards found in response: %s", bodyStr)

Uh oh!

Conversation

mpatton125 commented Feb 26, 2026 • edited by qdm12 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issue

Uh oh!

qdm12 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qdm12 Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

amarevite commented Sep 17, 2026

Uh oh!

mpatton125 commented Sep 17, 2026

Uh oh!

qdm12 commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qdm12 Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

mpatton125 commented Feb 26, 2026 •

edited by qdm12

Loading

qdm12 Mar 10, 2026 •

edited

Loading

qdm12 commented Sep 17, 2026 •

edited

Loading

qdm12 Sep 17, 2026 •

edited

Loading