v3.37.0

passteque/gluetunv3.37.0Jan 1, 2024by qdm12

AI Summary

New Year release featuring port redirection for port forwarding, TCP client protocol support for custom providers, and various OpenVPN/Wireguard fixes including Shadowsocks bump.

Key Highlights

Port forwarding now supports port redirection with `VPN_PORT_FORWARDING_LISTENING_PORT`
Custom provider added support for `tcp-client` proto
Shadowsocks bumped from v0.5.0-rc1 to v0.5.0
NordVPN added access token warning if used as wireguard private key

New Features

Port redirection for port forwarding
Custom provider OpenVPN: Default TCP port for any tcp protocol
Wireguard: Load preshared key from toml file and peer selection
Updated Windscribe servers data

Full Release Notes

🎉 🎆 Happy new year **2024** 🎉 🎆  *Personal note at the bottom* 😉 

## Features

- Port forwarding: port redirection with `VPN_PORT_FORWARDING_LISTENING_PORT`
- Custom provider: support tcp-client proto for OpenVPN
- NordVPN: add access token warning if used as wireguard private key
- Windscribe: update servers data

## Fixes

- Shadowsocks: bump from v0.5.0-rc1 to v0.5.0
  - treat udp read error as non critical
  - log out crash error for tcpudp combined server
- Wireguard:
  - Load preshared key from toml file correctly and from peer selection
- Custom provider OpenVPN:
  - Default TCP port for any tcp protocol
- Firewall:
  - Handle OpenVPN `tcp-client` protocol as `tcp`
- PureVPN: fix update url and update servers (#1992)
- VPN Unlimited OpenVPN:
  - Update CA certificate and add new second certificate
  - Remove `DEFAULT:@SECLEVEL=0`
  - Specify cipher as AES-256-CBC and auth as SHA512
- Format-servers command:
  - Fix for providers with dashes
  - Add missing `server name` header for PIA

## Maintenance

- Bump github.com/breml/rootcerts from 0.2.11 to 0.2.14 (#1800, #1981)
- Bump github.com/fatih/color from 1.15.0 to 1.16.0 (#1950)
- Bump github.com/klauspost/compress from 1.16.7 to 1.17.4 (#1922, #1993)
- Bump golang.org/x/crypto from 0.16.0 to 0.17.0 (#2012)
- Bump golang.org/x/net from 0.12.0 to 0.19.0 (#1907, #1953, #1985)
- Bump golang.org/x/sys from 0.11.0 to 0.13.0 (#1897)
- Bump golang.org/x/text from 0.11.0 to 0.14.0 (#1845, #1946)
- CI:
  - Bump actions/checkout from 3 to 4 (#1847)
  - Bump crazy-max/ghaction-github-labeler from 4 to 5 (#1858)
  - Bump DavidAnson/markdownlint-cli2-action from 11 to 14 (#1871, #1982)
  - Bump docker/build-push-action from 4.1.1 to 5.1.0 (#1860, #1969)
  - Bump docker/login-action from 2 to 3 (#1936)
  - Bump docker/metadata-action from 4 to 5 (#1937)
  - Bump docker/setup-buildx-action from 2 to 3 (#1938)
  - Bump docker/setup-qemu-action from 2 to 3 (#1861)
  - Bump github/codeql-action from 2 to 3 (#2002)

---

#### Personal note on the state of Gluetun

I have been focusing my effort since mid November on [a DNSSEC validator](https://github.com/qdm12/dns/commits/dnssec/) to finalize a Go library on par with the usage we have of Unbound, in order to replace Unbound in Gluetun and add DNS special features for Gluetun. For example:

- automatically diverting local hostnames questions to the local Docker DNS server (a long overdued problem) - already implemented
- allow resolution of VPN endpoint hostname to ips in a very restricted DNS server + firewall to only allow a specific hostname to resolve (not implemented yet)

This is a tough problem not so well documented with few complete and valid implementations, so it's taking some time. There is likely 2 more weeks of work left before finalization.