feat(server): PUT /v1/portforward route to set ports forwarded

[jagaimoworks]

First timer here. This is a somewhat working implementation of #2369. Hit me with the improvements I can take it 😅

I say somewhat working because the removal of ports from the firewall suffers from #2334 and therefore does not reliably work right now.

The way it works right now is by sending a http PUT request with a body like {ports: [1234, 3456]} to /v1/openvpn/portforwarded.

[qdm12]

That's great, thanks for the PR 💯 !
I will wait to fix the iptables removals (to create less user frustration and duplicate issues) after v3.39.0 gets released, to merge this though.

[qdm12]

(Sort of) blocked by #1785

[qdm12]

Blocked by #2238 as well.

[noctaia]

Hello!
Any news on this PR ?

[qdm12]

@jagaimoworks By the way:

• Great work! ❤️
• Sorry for the delay re-reviewing this 🕐
• Just a few minor comments ✅

[qdm12]

And @andy3469 I'm curious, what do you plan to use this PR for 😃?

[noctaia]

And @andy3469 I'm curious, what do you plan to use this PR for 😃?

I plan to use it with https://github.com/dhruvinsh/ws-ephemeral as a way to update the port every week.
I will do a PR on the other project once this one is up and running 😄

[qdm12]

@jagaimoworks All done 😉 I rebased your branch on the master branch, pushed a few commits to simplify and re-use the same setup and teardown code for both the normal service operation and this patch request. One last thing I would like to ask you (or @andy3469 ?), is to PR to https://github.com/qdm12/gluetun-wiki a section explaining how this works, why etc. in https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/control-server.md and perhaps link that section in https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/vpn-port-forwarding.md as well 😉

[noctaia]

@jagaimoworks All done 😉 I rebased your branch on the master branch, pushed a few commits to simplify and re-use the same setup and teardown code for both the normal service operation and this patch request. One last thing I would like to ask you (or @andy3469 ?), is to PR to https://github.com/qdm12/gluetun-wiki a section explaining how this works, why etc. in https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/control-server.md and perhaps link that section in https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/vpn-port-forwarding.md as well 😉

I will do it this weekend if I have the time to read and understand the changes.

[jagaimoworks]

Sorry for taking so long to respond.

@qdm12 I think commit 19a007f broke something.
Trying to PUT ports like { "ports": [1234] } hangs indefinitely and blocks the control server for any further requests.

Also, I assume that we still have to add our PUT route to the list of valid routes in the authentication code.

Lastly, if @andy3469 hasn't done so already, I will gladly provide documentation on this features usage.

Update: Here is the PR for the wiki: qdm12/gluetun-wiki#126

[noctaia]

Any news on the PR ?

[jkaberg]

This is also the final piece for me to use an custom VPN provider where the workflow is;

1. Request port forward through internal API (only accessible from within VPN tunnel, thuss needs to be done in Gluetun container or one using service_mode)
2. Take given (not choosen) port number and update actual client software so that it listens on correct port
3. ... and update the Gluetun firewall to open the assigned port

[giorgiooriani]

news on this? Would love to be able to set the port forwarding based on the ephemeral port from windscribe automatically

[cchhat01]

@qdm12 @jagaimoworks thank you both for the efforts in getting us where we are on this feature. Do you think this is close to being reviewed and being merged? I understand there are many different issues and features being worked on, but it would be a shame for this to be held up for so long given that we're so close (unless there is some discussion of going in a completely different direction implementation wise).
Thank you both once again.

[qdm12]

First of all my apologies everyone with the massive delay. Life got in the way (family, work, health etc.) and I've been halted on Gluetun work for a good part of 2025. But I should be back now 💪

I think commit 19a007f broke something.

Indeed, my apologies again, fixed in 539fdeb

Also, I assume that we still have to add our PUT route to the list of valid routes in the authentication code.

Yes. Since this is a new route, no reason to have is not secured.

Working on one last thing: moving /v1/openvpn/portfowarded -> /v1/portfoward on the master branch. Then change it here as well. The port fowarding has nothing to do with openvpn really, so it's worth separating and not cluttering more this wrong name. Should be done today.

[qdm12]

Will merge this as soon as v3.41.0 is out