Gluetun with expressvpn requires the use of a .ovpn file
Posted by silverace_71
I pasted my logs into Gemini, and it spat out this response The Root Cause: TLS Handshake Failure The logs show a WARN [openvpn] TLS Error: TLS key negotiation failed to occur within 60 seconds. This is a known, documented issue that frequently occurs between Gluetun and ExpressVPN. Here is what is going wrong: -ExpressVPN frequently rotates their server IP addresses. -Gluetun relies on an internal database file called servers.json which contains hardcoded IPs for provider locations. -When ExpressVPN updates their IPs, the old addresses that Gluetun attempts to dial (such as the 45.132.226.116 and 85.203.45.28 addresses in your logs) become unresponsive, causing the connection to time out. -Furthermore, ExpressVPN servers may require a specific TLS credential embedded in their manually downloaded configuration files, which is absent from Gluetun's built-in ExpressVPN parameters. The Fix To bypass the stale IP addresses and missing TLS credentials, you need to stop using the automated ExpressVPN provider setting. -Log into your ExpressVPN dashboard and navigate to the manual OpenVPN configuration section. -Download the .ovpn file for your target location. This manual file will contain a live endpoint IP and the correct TLS keys required for the handshake. -In your Portainer stack configuration, change your VPN provider environment variable from expressvpn to custom. -Mount the downloaded .ovpn file into your Gluetun container so it can connect using the current, active credentials. Honestly thinking about dropping 35$ on a vps in Switzerland, and just making my own vpn. BUT, someone I know is already paying for expressvpn and I like saving money so if there was a way to input a .ovpn file while setting up the vpn that would be awesome, because Im just now figuring out how to work portainer lol.
2 replies
Chris wrote:
Yes—SparkBox already supports a custom .ovpn file, but that option is not in the setup form yet. Put the ExpressVPN file at /opt/sparkbox/modules/media/config/gluetun/custom.ovpn, then set VPNPROVIDER=custom, VPNTYPE=openvpn, and OPENVPNCUSTOMCONFIG=/gluetun/custom.ovpn in /opt/sparkbox/.env; keep your ExpressVPN manual OpenVPN username and password in the existing VPN fields, then run sudo sparkbox restart media. Do not edit the Portainer stack because SparkBox regenerates it on updates. One Gluetun requirement: the remote line in the file should use an IP address, not a hostname.
Chris wrote:
Correcting myself on one point: that option IS in the dashboard, so skip the hand-placed file. Go to Settings, open the Network tab, and click "Edit VPN settings". Set Provider to "Other / Custom", then use the "Custom OpenVPN Profile (.ovpn)" picker to upload your ExpressVPN file. Keep your manual OpenVPN username and password in the existing fields, then save. Worth taking that route rather than mine: Tom hardened this in v1.6.432, so an uploaded profile is checked over and staged safely instead of being written straight onto the live one. Run sudo sparkbox upgrade first — upgrade, not update. The one requirement stands: the first remote line must be an IP address, not a hostname.