Wireguard on ProtonVPN

[pvanryn]

This may be common knowledge, but I did not see any posts about it.

ProtonVPN subscribers can now run Wireguard in their gluetun container. I noticed the other day that Proton is providing a Linux wireguard client now, and after a bit of reading, I spun up a container with it. I have not been using it for long, but it seems to be very stable and fast.

Go to the ProtonVPN page and create your configuration, name it, and then download it into the directory where you intend to create your VPN container. Then, go to Quentin's custom provider page for Wireguard, and copy his template. Fill in all of the particulars as required from the configuration file that you downloaded. Mine looks like this:

version: '3.7'
services:
   protonvpn:
     image: qmcgaw/gluetun:latest
     container_name: protonvpn
     cap_add:
       - NET_ADMIN
     network_mode: bridge
     ports:
       - 8000:8000 # HTTP Control Server
       - 8888:8888/tcp # HTTP Proxy
     volumes:
       - ./protonvpn:/gluetun
       - ./myProtonVPN.conf:/gluetun/config.conf:ro
     environment:
       - VPN_SERVICE_PROVIDER=custom
       - VPN_TYPE=wireguard
       - VPN_ENDPOINT_IP=92.17.63.9
       - VPN_ENDPOINT_PORT=51820
       - WIREGUARD_PUBLIC_KEY=MyVeryPublicKey
       - WIREGUARD_PRIVATE_KEY=MyVeryPrivateKey
       - WIREGUARD_ADDRESSES=10.2.0.2/24
       - HTTPPROXY=on
       - HTTPPROXY_USER=
       - HTTPPROXY_PASSWORD=
       - HTTPPROXY_STEALTH=off

Thanks to Quentin for his hard work.

[qdm12]

Awesome! Does your private key and address stay the same for all their servers? I'm asking since if this is the case (like mullvad, ivpn) I can add native support for it. Otherwise you're better off using the custom provider as you did.

[pvanryn]

Unfortunately, the private and public keys change for each generated configuration, so it looks like custom .conf only for now.

I used your speed test to do a very casual comparison of wireguard with openvpn. It is not possible to do an apples to apples comparison, because I can't connect both to the same server, but if I connect to servers in the same city, wireguard is significantly faster. I want to check them over a longer period of time.

[qdm12]

Nice, are you running on a low power device perhaps?

I'll document that on the protonvpn page then!

[pvanryn]

I have a Ryzen 3 with plenty of memory.

The protonvpn config generator looks like this:

With wireguard, do all of the options (like VPN Accelerator) work natively, or do they need to be configured in the docker-compose environment?

[qdm12]

I have been trying to understand how their vpn accelerator works and what it is, but it's still unclear. It might be something they did on the server side.
What difference do you see in the config generated?
If it is just a different ip address endpoint, yes it will work in Gluetun (since Wireguard is wireguard really 😉).

[pvanryn]

The configuration files for accelerated and non-accelerated are exactly the same, except the private keys are different. For whatever it's worth, the VPN accelerator is on by default, you have to switch it off if you don't want it.

I tested from inside the container so that I could pick the same speedtest server each time, and my docker configurations were the same, except for name and port assignments. The accelerated containers are significantly faster for downloading, less so for upload speeds.

I did several tests, but here is a sample of my results.

Test 1	Accelerated	Non-Accelerated
Down	526.40	420.62
Up	35.11	13.86
---	---	---
Test 2	Accelerated	Non-Accelerated
Down	374.86	326.40
Up	20.86	25.74
---	---	---
Test 3	Accelerated	Non-Accelerated
Down	313.93	119.21
Up	28.31	27.37

[qdm12]

Ok it should work too if it's just the private key changing. I guess it's a fully server side optimization, although I don't see why they don't just enable it everywhere and allow the user to disable it, seems rather odd 🤔

[evanrich]

2 years late to the party, just foudn this out. two questions if anyone sees this:

1.) Is port forwarding required? I'm using https://bjw-s.github.io/helm-charts/docs/app-template/examples/qbittorrent-gluetun/ as a start, but with the wireguard config, and I'm not sure if the portforwarding is required with wireguard

2.) how can you test that everything works? I see that a proton vpn ip shows up, but QBT shows that its firewalled and I don't seem to connect to any peers

[blakedaniel]

2.) how can you test that everything works? I see that a proton vpn ip shows up, but QBT shows that its firewalled and I don't seem to connect to any peers

1. when Gluetun runs, check the logs for the port forwardingport using docker compose logs <name-of-gluetun-container> - let's say that the port forward port is 6888
2. configure qbittorrent with port 6888 by adding TORRENTING_PORT=6888 to env variables in qbittorrent
3. For added security click on Advanced in the settings panel, and select tun0 under the Network Interface drop down (optional)

[qdm12]

DO NOT do this. That means traffic will come from the Internet to your public IP address directly, without the VPN, and that for torrenting traffic. You really don't want to do that. Please think twice!

Just do step 1 and then configure qbitorrent to use that port, that's it. It's automatically forwarded by the VPN server and allowed through the gluetun firewall and routing.

[blakedaniel]

@qdm12 - thank you for correcting me with this. You saved me some headache and some bad advice I got.