Commit Graph

  • 763c5be119 fix(server/portforward): use port and ports for both single port and multiple ports forwarded Quentin McGaw 2026-03-29 01:20:13 +00:00
  • 5b88c76a14 fix(openvpn): bundle provider CA certificates in one block (#3258) Michael Bisbjerg 2026-03-26 22:32:43 +01:00
  • 086e3740f3 fix(firewall/iptables): shared mutex for both iptables and ip6tables Quentin McGaw 2026-03-23 14:09:26 +00:00
  • 57cf276d31 chore(firewall/iptables): log restore data on failure to restore Quentin McGaw 2026-03-23 14:03:30 +00:00
  • 405a6f699d hotfix(dns): always run and use built-in DNS server - start DNS server before healthcheck - do not fallback to plaintext anymore - allow to use plain addresses with a port different than 53, system-wide - do not wait for the DNS server and rely on healtcheck only Quentin McGaw 2026-03-23 13:40:27 +00:00
  • 72af17cc91 hotfix(dns): fix behavior for DNS_UPSTREAM_PLAIN_ADDRESSES Quentin McGaw 2026-03-21 23:37:25 +00:00
  • 8a2e8bda0f hotfix(amneziawg): fix errors (#3240) Zhurik 2026-03-22 01:24:03 +03:00
  • 5e6c11b045 feat(dns): add leak check report log Quentin McGaw 2026-03-16 13:57:14 +00:00
  • 85d2917e8e chore(dns): refactor loop code Run to have less indentation Quentin McGaw 2026-03-16 13:53:14 +00:00
  • 9a5995fa72 hotfix(dns): DNS_UPSTREAM_RESOLVERS defaults to empty if DNS_UPSTREAM_PLAIN_ADDRESSES is not empty Quentin McGaw 2026-03-16 12:55:19 +00:00
  • 2438fc2c3a chore!(firewall): iptables logger level is set at FIREWALL_IPTABLES_LOG_LEVEL - firewall log level is still fully controlled by LOG_LEVEL - iptables log level defaults to info even if global log level is debug to minimize the amount of debug logs - iptables log level is only set to debug if retro-compatible FIREWALL_DEBUG=on or if FIREWALL_IPTABLES_LOG_LEVEL=debug Quentin McGaw 2026-03-13 18:26:48 +00:00
  • 8aaf998fa1 chore!(firewall): FIREWALL_DEBUG no longer affects the routing logger log level Quentin McGaw 2026-03-13 17:56:39 +00:00
  • f0cbcbb60d chore(ci): bump timeout from 30s to 60s Quentin McGaw 2026-03-13 17:52:48 +00:00
  • 4e5d4f7793 feat(docker): bump Alpine from 3.22 to 3.23 Quentin McGaw 2026-03-13 15:39:25 +00:00
  • 460ffb637a fix(ci): set hash of PR commit instead of synthetic commit in docker build argument Quentin McGaw 2026-03-13 15:12:54 +00:00
  • c83d4b0926 Chore(deps): Bump golang.org/x/text from 0.34.0 to 0.35.0 (#3227) dependabot[bot] 2026-03-13 15:57:47 +01:00
  • 00d1592899 hotfix(sources/secrets): fix wireguard/amnezia mixup - Fix #3228 Quentin McGaw 2026-03-13 14:48:11 +00:00
  • b5b0e01376 Chore(deps): Bump github.com/mdlayher/netlink from 1.7.2 to 1.9.0 (#3199) dependabot[bot] 2026-03-11 21:43:10 +01:00
  • b04529c380 chore!(amneziawg): refactor to be separate from wireguard - amneziawg is now a VPN protocol and no longer a Wireguard implementation - Use it with VPN_TYPE=amneziawg - document AMNEZIAWG_* options in Dockerfile - document amneziawg support in readme - separate amneziawg settings and code from wireguard - re-use code from wireguard whenever possible Quentin McGaw 2026-03-11 16:35:18 +00:00
  • efea169495 hotfix(vpn): fix vpn stop when down command is empty Quentin McGaw 2026-03-11 16:26:13 +00:00
  • ba9fcb5b89 hotfix(amnezia): fix settings reading (nil pointer panic) Quentin McGaw 2026-03-11 16:23:50 +00:00
  • 97ccadfd33 chore(vpn): moved wireguard settings helpers from provider/utils to vpn as unexported functions Quentin McGaw 2026-03-11 14:05:55 +00:00
  • e6fc792f4f feat(wireguard): amneziawg implementation (#3150) Zhurik 2026-03-11 16:55:28 +03:00
  • f4eeffe79a Chore(deps): Bump docker/metadata-action from 5 to 6 (#3213) dependabot[bot] 2026-03-11 14:40:32 +01:00
  • 0394e31fe2 Chore(deps): Bump docker/setup-buildx-action from 3 to 4 (#3214) dependabot[bot] 2026-03-11 14:40:19 +01:00
  • 27b8e83aa5 Use ErrKernelModuleMissing when missing kernel module string is detected conntrack Quentin McGaw 2026-03-11 13:35:56 +00:00
  • e557971ae8 hotfix(dns): allow to use plain upstream type with selected builtin providers Quentin McGaw 2026-03-11 13:20:27 +00:00
  • a98b39a03f Chore(deps): Bump golang.org/x/sys from 0.41.0 to 0.42.0 (#3212) dependabot[bot] 2026-03-10 13:50:57 +01:00
  • 760fefd890 Chore(deps): Bump docker/setup-qemu-action from 3 to 4 (#3211) dependabot[bot] 2026-03-10 13:50:36 +01:00
  • 543d3fa95e fix(dns): correct error wrapping for DNS listening address validation - Fix #3216 Quentin McGaw 2026-03-10 12:38:56 +00:00
  • 93999062e4 hotfix(publicip): increase client timeouts from 5s to 15s Quentin McGaw 2026-03-10 12:26:40 +00:00
  • 853f4601a5 chore(ci): fix golangci-lint config exclusion Quentin McGaw 2026-03-10 11:58:49 +00:00
  • 1d29f1f517 hotfix(pmtud): only set MSS on non-local VPN routes Quentin McGaw 2026-03-10 11:51:59 +00:00
  • d790e3385c Revert "chore(expressvpn): remove old invalid certificate to prevent confusion" Quentin McGaw 2026-03-09 14:26:59 +00:00
  • 069cde8a85 hotfix(pmtud): set mss on all VPN routes - fix behavior for OpenVPN splitting default route in multiple routes - fix behavior for Wireguard if user specifies AllowedIPs Quentin McGaw 2026-03-08 23:27:04 +00:00
  • d98afce793 hotfix(vpn): inject cmder object for up/down commands and fix cleanup panic Quentin McGaw 2026-03-08 23:06:32 +00:00
  • 57c53bc19e feat(vpn): VPN_UP_COMMAND and VPN_DOWN_COMMAND options Quentin McGaw 2026-03-08 16:06:16 +00:00
  • c0af198155 chore(dockerfile); re-arrange port forwarding env location in Dockerfile Quentin McGaw 2026-03-08 15:34:25 +00:00
  • 3d53cea0f6 chore(expressvpn): bump max fails for updater resolver Quentin McGaw 2026-03-08 13:33:45 +00:00
  • f7a9ddc48b chore(expressvpn): remove old invalid certificate to prevent confusion Quentin McGaw 2026-03-08 13:29:19 +00:00
  • 02a186c145 hotfix(boringpoll): fix debug log to log out last error Quentin McGaw 2026-03-07 16:04:57 +00:00
  • 724cd3a15e feat(server): PUT /v1/portforward route to set ports forwarded (#2392) Rubyn Angelo Stark 2026-03-07 18:06:03 +01:00
  • 199ad77ec9 chore(dns): remove DNS_SERVER, DNS_KEEP_NAMESERVER and replace DNS_ADDRESS with DNS_UPSTREAM_PLAIN_ADDRESSES (#2988) Quentin McGaw 2026-03-07 14:07:57 +01:00
  • dd0edafbb1 Chore(ci): Bump peter-evans/dockerhub-description from 4 to 5 (#2928) dependabot[bot] 2026-03-07 00:48:28 -05:00
  • 9be2fc827b Chore(ci): Bump docker/build-push-action from 6 to 7 (#3197) dependabot[bot] 2026-03-07 00:20:51 -05:00
  • b63702cf63 Chore(ci): Bump peter-evans/create-pull-request from 7 to 8 (#3175) dependabot[bot] 2026-03-07 00:19:12 -05:00
  • ede2509132 Chore(deps): Bump gopkg.in/ini.v1 from 1.67.0 to 1.67.1 (#3090) dependabot[bot] 2026-03-07 00:16:20 -05:00
  • 100124e8b8 Chore(github): Bump crazy-max/ghaction-github-labeler from 5 to 6 (#3174) dependabot[bot] 2026-03-07 00:15:46 -05:00
  • 850a91b35f Chore(deps): Bump github.com/klauspost/compress from 1.18.1 to 1.18.4 (#3198) dependabot[bot] 2026-03-07 00:14:23 -05:00
  • 4a40f0fdee chore(deps): Bump DavidAnson/markdownlint-cli2-action from 21 to 22 (#3041) dependabot[bot] 2026-03-07 00:13:52 -05:00
  • b7735ecc00 fix(updater): only uses DoH to cloudflare+google - prevent dns plaintext manipulation both the periodic update and when running in cli mode - possibly higher reliability on poor connections versus UDP - drop -dns flag in update command - for now no configuration allowed since it makes everything rather complex Quentin McGaw 2026-03-06 21:01:52 +00:00
  • 457e5597bb feat(others): optional BORINGPOLL_GLUETUNCOM to fight AI slop scammy gluetun[dot]com Quentin McGaw 2026-03-06 16:27:16 +00:00
  • 2460b56c2b chore(github): make closed issue message cleaner Quentin McGaw 2026-03-06 16:05:17 +00:00
  • 5b2f86f4e7 fix(expressvpn): remove pakistan server Quentin McGaw 2026-03-06 14:01:00 +00:00
  • 49317ecb8a Chore(deps): Bump golang.org/x/net from 0.49.0 to 0.51.0 (#3200) dependabot[bot] 2026-03-06 14:56:57 +01:00
  • bd275aaea8 chore(github): add MTU discovery category label Quentin McGaw 2026-03-05 17:03:17 +00:00
  • 39bd9854f7 chore(vpn): find VPN route earlier in MTU update function Quentin McGaw 2026-03-05 16:56:42 +00:00
  • c2c9504e94 hotfix(pmtud): set TCP MSS before changing MTU, and revert to original MTU if TCP MSS route set fails Quentin McGaw 2026-03-05 16:53:26 +00:00
  • 48317a0d55 feat(main): log out OS, kernel version and architecture on start Quentin McGaw 2026-03-05 16:49:27 +00:00
  • 6c3f519c62 Chore(deps): Bump docker/login-action from 3 to 4 (#3189) dependabot[bot] 2026-03-05 17:15:36 +01:00
  • b7cbea1ce6 fix(expressvpn): fix missing characters in CA string (#3192) Dennis Nienhuis 2026-03-05 17:15:07 +01:00
  • d8a3cc3dfa hotfix(constants/providers): remove TestWorkflowHasAll to decouple CI files from tests Quentin McGaw 2026-03-04 22:09:36 +00:00
  • b1da4c4b86 hotfix(lint): fix lint errors introduced with expressvpn commit Quentin McGaw 2026-03-04 22:02:29 +00:00
  • 579bd8e416 feat(airvpn): update servers data (#3186) github-actions[bot] 2026-03-04 20:53:28 +01:00
  • 7bf59ebfb4 chore(ci): set PR title and description for updating servers workflow PR Quentin McGaw 2026-03-04 19:51:40 +00:00
  • eb0938ad81 [create-pull-request] automated change bot/update-servers-list-1772653494 qdm12 2026-03-04 19:44:54 +00:00
  • 4ac25b9dd1 hotfix(ci): fix file changes detection in update servers workflow Quentin McGaw 2026-03-04 19:43:39 +00:00
  • 4bcbd29fb9 chore(ci): allow to specify provider to update servers data on dispatch Quentin McGaw 2026-03-04 19:24:53 +00:00
  • a8ee1d7a63 fix(expressvpn): add new CA3 certificate to fix TLS handshake failure (#3184) Dennis Nienhuis 2026-03-04 20:01:24 +01:00
  • c6c3a2bf1b fix(openvpn/extract): restrict custom openvpn config protocol to tcp or udp internally - Fix #3179 - I believe specifying tcp4, tcp6 or tcp-client does not change anything versus tcp + remote ip address - I believe specifying udp4 or udp6 does not change anything versus tcp + remote ip address - Simplify firewall code to not account for tcp-client etc. Quentin McGaw 2026-03-04 18:58:33 +00:00
  • e7b25a0d5e chore(mod): simplify code and add more kernel config constants Quentin McGaw 2026-03-02 23:20:47 +00:00
  • 11cd62f6b1 feat(ci): periodic workflow to update the maintainers servers list with pull requests (#3010) shwoop 2026-03-03 01:32:05 +01:00
  • eb9f1b4e36 Revert mod changes Quentin McGaw 2026-03-02 23:19:53 +00:00
  • a62220d7b6 give up on kernel modules checks Quentin McGaw 2026-03-02 23:17:08 +00:00
  • ed26957a1a fix(privado): allow additional OpenVPN ports 443, 8080 and 8443 for both tcp and udp Quentin McGaw 2026-03-01 11:59:03 +00:00
  • 54b55c594f fix(privado): allow OpenVPN TCP protocol Quentin McGaw 2026-03-01 11:58:16 +00:00
  • cd9ba54b37 wip Quentin McGaw 2026-02-28 22:38:52 +00:00
  • 781e74f77a chore: merge iptables SetIPv4AllPolicies and SetIPv6AllPolicies together Quentin McGaw 2026-02-28 15:25:15 +00:00
  • fa0941a529 add nftables to dev container Quentin McGaw 2026-02-28 15:24:37 +00:00
  • e87d915f15 chore(firewall/iptables): modprobe and cache support for xt_mark and nf_tables Quentin McGaw 2026-02-26 12:28:09 +00:00
  • 594b1db98b Require xt_CONNMARK and define its kernel config values Quentin McGaw 2026-02-28 15:13:23 +00:00
  • ec24ffdfd8 hotfix(firewall): save and restore behavior fixed - restore if IPv4 set all policies fails - fix deadlock when using iptables custom rules - fix setting ipv6 rules when running runMixedIptablesInstruction Quentin McGaw 2026-02-28 14:37:58 +00:00
  • bfc8136bc9 Fourth fallback, use DROP temporarily instead of REJECT Quentin McGaw 2026-02-27 12:17:12 +00:00
  • 1fd4cc511a Fix kernel module names Quentin McGaw 2026-02-27 12:16:54 +00:00
  • b9d49e0661 Chore(deps): Bump github.com/breml/rootcerts from 0.3.3 to 0.3.4 (#3128) dependabot[bot] 2026-02-27 02:16:31 +01:00
  • af0bc3e224 allow custom chain name targets Quentin McGaw 2026-02-26 23:18:44 +00:00
  • 302f1f11f7 only use kernel modules error as context to an actual error, not as a requirement since some systems don't show what they support reliably Quentin McGaw 2026-02-26 20:49:28 +00:00
  • f654dece66 Reject output public ip traffic for 1s as another fallback Quentin McGaw 2026-02-26 18:04:23 +00:00
  • a37354426b Fallback to accepting only NEW output public traffic if conntrack netlink isn't supported Quentin McGaw 2026-02-26 15:53:07 +00:00
  • dfac2b2f1a Flush conntrack on every firewall enabling Quentin McGaw 2026-02-25 22:08:23 +00:00
  • 6467f3b4ad Flush using AF_UNSPEC and netfilter package Quentin McGaw 2026-02-25 22:03:01 +00:00
  • 2bb4deccd5 feat(firewall): atomic iptables operations - all operations rollback on failure - disabling the firewall means rolling back to its state before enabling it - aligns with nftables atomicity feature Quentin McGaw 2026-02-26 22:58:52 +00:00
  • 0d0c0fb143 feat(dns): update block files after DNS server is up for a faster bootup Quentin McGaw 2026-02-26 18:40:19 +00:00
  • 885e491bb7 chore(dns): clarify "ready" dns message when DNS server is up and being used Quentin McGaw 2026-02-26 18:39:56 +00:00
  • e75ae21dcd fix(mod): probe searches for features built-in the kernel Quentin McGaw 2026-02-26 16:24:30 +00:00
  • 4b8dc8ded7 fix(privado): update servers data using JSON API - Fixes #3159 - Fixes #2118 - Fixes #2657 Quentin McGaw 2026-02-25 16:02:52 +00:00
  • 0eeee5c496 chore(pmtud): clarify debug logs and fix log error message Quentin McGaw 2026-02-25 04:07:27 +00:00
  • d21953f62e chore(firewall): split apart iptables specific code in internal/firewall/iptables Quentin McGaw 2026-02-25 03:45:17 +00:00
  • 034f8f6331 hotfix(netlink): specify IP family for conntrack calls and make conntrack failure a warning Quentin McGaw 2026-02-25 02:40:44 +00:00
  • 01487b5caf feat(protonvpn): add suggestions on some port forwarding errors Quentin McGaw 2026-02-23 21:19:08 +00:00