Bug: ProtonVPN server list is incomplete

[bobobo1618]

Is this urgent?

No

Host OS

No response

CPU arch

None

VPN service provider

ProtonVPN

What are you using to run the container

docker run

What is the version of Gluetun

Running version latest built on 2025-12-29T05:33:29.822Z (commit 9b9b723)

What's the problem 🤔

This repo lists substantially more ProtonVPN servers than Gluetun. The repo readme explains why:

UPDATE on 2025-11-08: Just found that the web version list is not complete so that this list is not the full list.
The trick is to use a different x-pm-appversion value to not use the web-vpn-settings.

I found that when I took the HTTP request from the web portal, it used x-pm-appversion: web-vpn-settings@5.0.286.0. The response contents were consistent with Gluetun.

However when I changed the header to 'x-pm-appversion: linux-vpn@4.14.1', I got substantially more servers (a few hundred more).

Share your logs (at least 10 lines)

> sudo docker exec -it <REDACTED> /gluetun-entrypoint format-servers -protonvpn | grep Switzerland | grep wireguard
| Switzerland |  | Zurich | `ch-09-tor.protonvpn.net` | wireguard | ❌ | ❌ |  |  |
| Switzerland |  | Zurich | `node-ch-17.protonvpn.net` | wireguard | ❌ | ❌ |  |  |
| Switzerland |  | Zurich | `node-ch-07.protonvpn.net` | wireguard | ❌ | ✅ |  |  |
| Switzerland |  | Zurich | `node-ch-14.protonvpn.net` | wireguard | ❌ | ✅ |  |  |
| Switzerland |  | Zurich | `node-ch-26.protonvpn.net` | wireguard | ❌ | ✅ |  |  |
| Switzerland |  | Zurich | `node-ch-29.protonvpn.net` | wireguard | ❌ | ✅ |  |  |
| Switzerland |  | Zurich | `node-ch-30.protonvpn.net` | wireguard | ❌ | ✅ |  |  |
| Switzerland |  | Zurich | `node-ch-33.protonvpn.net` | wireguard | ❌ | ✅ |  |  |
| Switzerland |  | Zurich | `node-ch-37.protonvpn.net` | wireguard | ❌ | ✅ |  |  |
| Switzerland |  | Zurich | `node-ch-38.protonvpn.net` | wireguard | ❌ | ✅ |  |  |
| Switzerland |  | Zurich | `node-ch-03.protonvpn.net` | wireguard | ❌ | ✅ |  |  |
| Switzerland |  | Zurich | `node-ch-11.protonvpn.net` | wireguard | ✅ | ❌ |  |  |
| Switzerland |  | Zurich | `node-ch-21.protonvpn.net` | wireguard | ✅ | ❌ |  |  |

> curl -H 'x-pm-appversion: linux-vpn@4.14.1' <REDACTED> 'https://account.protonvpn.com/api/vpn/v1/logicals' | jq -r '[.LogicalServers[] | select(.ExitCountry == "CH" and .EntryCountry == "CH") | .Domain] | sort | unique | .[]'
ch-09-tor.protonvpn.net
node-ch-02.protonvpn.net
node-ch-03.protonvpn.net
node-ch-05.protonvpn.net
node-ch-06.protonvpn.net
node-ch-07.protonvpn.net
node-ch-08.protonvpn.net
node-ch-10.protonvpn.net
node-ch-13.protonvpn.net
node-ch-14.protonvpn.net
node-ch-16.protonvpn.net
node-ch-17.protonvpn.net
node-ch-18.protonvpn.net
node-ch-20.protonvpn.net
node-ch-24.protonvpn.net
node-ch-25.protonvpn.net
node-ch-26.protonvpn.net
node-ch-27.protonvpn.net
node-ch-28.protonvpn.net
node-ch-29.protonvpn.net
node-ch-30.protonvpn.net
node-ch-31.protonvpn.net
node-ch-32.protonvpn.net
node-ch-33.protonvpn.net
node-ch-34.protonvpn.net
node-ch-35.protonvpn.net
node-ch-36.protonvpn.net
node-ch-37.protonvpn.net
node-ch-38.protonvpn.net
node-ch-39.protonvpn.net
node-ch-40.protonvpn.net
node-ch-41.protonvpn.net
node-ch-42.protonvpn.net
node-ch-43.protonvpn.net
node-ch-44.protonvpn.net
node-ch-47.protonvpn.net
node-ch-48.protonvpn.net
node-ch-49.protonvpn.net
node-ch-50.protonvpn.net

Share your configuration

[github-actions]

@qdm12 is more or less the only maintainer of this project and works on it in his free time.
Please:

• do not ask for updates, be patient
• 👍 the issue to show your support instead of commenting
  @qdm12 usually checks issues at least once a week, if this is a new urgent bug,
  revert to an older tagged container image

[SMAW]

I think they’re (gluetun) not using the same API endpoint that you’re using (because your also using an endpoint part). I just found that out as well — those servers could be their secure config servers (double hops). However, @qdm12, even when you request the API with a paid account, it still doesn’t show all the servers. For example, there used to be hundreds of servers in the Netherlands before the recent changes on Proton’s side. Now, there are only around 15 (for NL), even when requesting the API with a paid account. So, the list is still incomplete.

The API seems to return the same data that you see in the portal, which now only shows these 15 servers. You can also search for a server in the UI, but this is limited to 5 searches per day (a support rep told me). It looks like they have quite effectively restricted access, and a complete server list isn’t obtainable anymore.

The best solution would be something like a community-driven API where everyone submits IPs, so we can build the most complete list possible. Because right now, everyone sees a different set of servers through their respective API endpoints.

[qdm12]

@bobobo1618 gluetun uses the web-account instead of web-vpn-settings

https://github.com/qdm12/gluetun/blob/9b9b723887af1f87d6e9beda06e35cfaabf3f0ea/internal/provider/protonvpn/updater/version.go#L17

Are you sure the linux-vpn does give more/all vpn servers consistently? Happy to do the (small) code change for that if that's the case.

Note to self: versioning can be obtained from https://github.com/ProtonVPN/proton-vpn-gtk-app/tags

---

@SMAW

Gluetun uses the same api endpoint

https://github.com/qdm12/gluetun/blob/9b9b723887af1f87d6e9beda06e35cfaabf3f0ea/internal/provider/protonvpn/updater/api.go#L586

even when you request the API with a paid account, it still doesn’t show all the servers
You can also search for a server in the UI, but this is limited to 5 searches per day (a support rep told me).

I hate protonvpn 😓

Now, there are only around 15 (for NL), even when requesting the API with a paid account. So, the list is still incomplete.

Is this actually a problem? If even protonvpn doesn't show these on their ui/website 🤔

The best solution would be something like a community-driven API where everyone submits IPs, so we can build the most complete list possible.

Not going this route because I don't want to maintaim or code yet another thing for protonvpn's own stupid decisions. Let's keep it simple and functional even if the list isn't conplete, I don't think it's that important (at least we can have updated servers data, even if not all their gazillions of hostnames).

It might also be interesting to understand why they hide some servers? Maybe these are meant to go offline for example?

[bobobo1618]

Are you sure the linux-vpn does give more/all vpn servers consistently? Happy to do the (small) code change for that if that's the case.

Based on what I've been able to do with cURL, yes, it's very consistent. I get 996 with linux-vpn@4.14.1 and only 681 with web-account@5.0.287.0.

Comparing the two sets of servers shows that linux-vpn returns all of the servers in web-account except one for some reason, plus 316 other servers:

# Count the servers in web-account but not linux-vpn
> comm -23 /tmp/webaccount.txt /tmp/vpn.txt | wc -l
       1
# Count the servers in linux-vpn but not web-account
> comm -13 /tmp/webaccount.txt /tmp/vpn.txt | wc -l
     316

[SMAW]

@qdm12 they hide because their UX is getting to slow for all servers, so they only show a selection of servers. All other servers are still active and working, and you can search on them, but they hide the rest for "abuse" and UX reasons
They only say on the support, more info here : https://protonvpn.com/support/streamlined-server-lists

[qdm12]

except one for some reason

😆 typical!

I got code ready, but both my paid and free accounts no longer work with the update mechanism now, with error updating server information: getting protonvpn servers: authentifying with Proton: getting auth information: HTTP status code not OK: Bad Request: Invalid input (code 2001 with details: ); @bobobo1618 do you have it working on your side with the current code?

[qdm12]

Code is at #3099

[bobobo1618]

No, I was running into that bug weeks ago but nobody else seemed to be reporting it, so I figured it was something related to my account specifically.

That's what got me playing around with cURL in the first place – I was trying to figure out why gluetun wasn't able to update the server list. I was never able to reproduce the same issue with cURL, though I wasn't able to get it working from scratch with cURL. I had to do the login with a browser and use the "Copy as cURL" from Firefox dev tools to get me started.

[KptCheeseWhiz]

I have the the issue as @qdm12 when trying to update the servers in the latest image:

/ # /gluetun-entrypoint update -enduser -providers protonvpn -proton-email $UPDATER_PROTONVPN_EMAIL -proton-password $UPDATER_PROTONVPN_PASSWORD
2026-02-06T15:06:20Z INFO merging by most recent 20717 hardcoded servers and 20717 servers read from /gluetun/servers.json
2026-02-06T15:06:20Z INFO updating Protonvpn servers...
2026-02-06T15:06:24Z ERROR updating server information: getting protonvpn servers: authentifying with Proton: getting auth information: HTTP status code not OK: Bad Request: Invalid input (code 2001 with details: )
2026-02-06T15:06:24Z INFO Shutdown successful

I tried using the version with #3099 but another error is shown:

/ # /gluetun-entrypoint update -enduser -providers protonvpn -proton-email $UPDATER_PROTONVPN_EMAIL -proton-password $UPDATER_PROTONVPN_PASSWORD
2026-02-06T15:08:19Z INFO creating /gluetun/servers.json with 20901 hardcoded servers
2026-02-06T15:08:19Z INFO updating Protonvpn servers...
2026-02-06T15:08:21Z ERROR updating server information: getting protonvpn servers: authentifying with Proton: getting unauthenticated session data: HTTP status code not OK: Unprocessable Entity: Operation not allowed (code 8004 with details: )
2026-02-06T15:08:21Z INFO Shutdown successful

I created a branch that implements "cookie-only" authentication here KptCheeseWhiz@c363642
I know it is a bit less user friendly, but it gets the work done haha. I could create a wiki page on how to retrieve the cookies.

The new usage would be:

/gluetun-entrypoint update -enduser -providers protonvpn \
  -proton-cookies 'AUTH-X=XXXXX;' \
  -proton-appversion 'linux-vpn@4.14.0' -proton-uid 'ktbna3hsdgja6c4mi6e2anmpsrz5rlzi'

From my tests, only the AUTH- cookie is required to fetch the endpoint.

Let me know if you want to re-use the code or if I should make a PR.

[jgeorgeson]

@qdm12 @bobobo1618 @KptCheeseWhiz could the 20001 error be due to OTP?

[huzky-v]

The proton list repo owner here.

Not just the web ui have the truncated list, the browser extension is also suffering the same case
And I have tested some combinations of headers and params, that the x-pm-appversion is the only differentiator to make the response look different.
They probably did it because the size of the api response is too large for them to handle(The full list is 13MB at this moment, where truncated sized at 2MB only, which cause long loading time if you load that full list).

So that the app client and web client behaves differently like others said.

I personally think that the list should be cached and I am testing to curl the endpoint If-Modified-Since header.

That's just hell handling for proton. 🥲
May be I have to create some sort of automated logical list for that