Skip to content

VPN Provider Research

Reference for which providers alle can support and how, given that the engine is sing-box, verified against provider documentation.

sing-box speaks WireGuard today (what alle uses for every implemented and planned provider below) and gains an OpenVPN Client endpoint in v1.14 (currently a prerelease/beta; stable is still v1.13.x), compatible with standard OpenVPN servers (TLS mode, username/password or certificate auth, tls-auth/tls-crypt control-channel wrapping — the same fields a provider's .ovpn file carries). Once that release stabilizes and alle integrates an OpenVPN provider archetype (not yet started — new engine-integration work), the OpenVPN-only providers section below becomes buildable too. See .localonly/Backlog.md (item 9's exclusion list and the "non-WireGuard protocols out of scope" guardrail) for the implementation-side status — this document is research, not a shipped feature.

Key conclusions

  1. The provider bar is protocol-exportable, not protocol-specific. A provider qualifies if either its WireGuard config/keys are self-service extractable today, or its OpenVPN username/password + config will be once alle can speak OpenVPN. SOCKS5 is excluded outright (unencrypted); Shadowsocks is niche among commercial VPNs.
  2. alle is encrypted-only. No unencrypted SOCKS5, ever. Credentials come from the provider API where one exists, else from importing the provider's config (WireGuard .conf today; OpenVPN .ovpn-equivalent planned).
  3. "Supports [protocol]" is not the bar — exporting it is. Several providers run WireGuard inside their own apps only (sometimes as a customized, non-interoperable variant) with no config download or key API. Those are just as unsupportable as protocol-absent providers. As IPVanish's own announcement put it: "most VPN providers only offer WireGuard connections through their apps rather than allowing manual configuration options." The disqualifier is apps-only lockdown, not protocol absence — and it applies the same way to OpenVPN: a provider whose only OpenVPN path is inside their app doesn't qualify either, even once alle can speak OpenVPN.

Provider archetypes

All supportable commercial VPN providers fall into one of two categories:

Token/API — you provide an account credential; the provider's API derives WireGuard keys and resolves servers. No manual config download.

Config/portal — you download a WireGuard .conf from the provider's web portal (usually a config generator) and import it.

MVP providers

NordVPN and ProtonVPN are the two MVP targets — one per archetype.

Provider Archetype Credential Status
NordVPN Token/API access token Implemented
ProtonVPN Config/portal n/a — import .conf Implemented

Post-MVP token/API providers

Same archetype as NordVPN: a new provider definition and credential flow — no core architecture changes.

Provider Credential shape Notes
Mullvad 16-digit account number Clean API, pubkey registration; also has a portal config generator
IVPN account id Clean API, pubkey registration
Private Internet Access p-number username & password per-server addKey endpoint (pia-foss/manual-connections, official)
VyprVPN email & password Official VyprVPN WireGuard API — their open Go client authenticates and drives standard wg-quick. No portal .conf

Post-MVP config/portal providers

Same .conf import archetype as ProtonVPN — zero core changes. All verified to offer standard WireGuard config download/generation from their portal:

Provider Config source Notes
AirVPN airvpn.org/generator Mature generator
Windscribe Config Generators feature
Surfshark Manual WireGuard setup in account dashboard Official router/Windows guides
PrivateVPN Portal "Generate Config" → download
VPN Unlimited KeepSolid User Office generator Official guides incl. GL.iNet
IPVanish WireGuard Configuration Generator in Account Portal (Dec 2024) Custom pubkey/port options
TorGuard Config generator; guides target the official WireGuard app No Shadowsocks needed — plain WireGuard works
PrivadoVPN Portal generator for WireGuard/OpenVPN manual setups
VPN.ac WireGuard key-management tool (vpn.ac/wgmanager) → .conf

Supportable with caveats (works, but document the friction):

Provider Caveat
PureVPN Portal generates WireGuard configs, but they expire ("activate within 30 minutes… or redownload") — hostile to alle's stored-config model; expect frequent re-imports
FastestVPN WireGuard .conf provided only via support email — no self-service generator; provisioning is manual and slow

OpenVPN-only providers (planned, gated on sing-box 1.14)

These providers have no exportable WireGuard (apps-only, or no WireGuard at all), which is why the "Excluded providers" section below used to rule them out entirely. Each does, however, publish a genuinely self-service OpenVPN username/password + config outside their own app — no app-only lockdown, the same disqualifier the WireGuard providers above are held to. They become supportable once sing-box 1.14 stabilizes and alle adds an OpenVPN provider archetype:

Provider Credential shape Config source Notes
ExpressVPN Username & password (ExpressVPN+ dashboard) "Manual Configuration" page — per-region .ovpn, credentials shown on screen Same account that's WireGuard-apps-only; manual OpenVPN setup is fully self-service and is their only published manual path (routers, Linux, pfSense)
CyberGhost Account username & password "Configure Device" portal generates .ovpn The same portal that's OpenVPN-only for WireGuard purposes now qualifies it directly
HideMyAss (HMA) Main HMA account username & password VPN Control Panel; manual OpenVPN via Terminal/NetworkManager, no app needed Router-specific integration reportedly discontinued (FlashRouters), but manual OpenVPN using the account password is still current per HMA's own support docs
SlickVPN Main account username & password (same as app login) Public .ovpn download (slickvpn.com/tutorials/using-openvpn-configuration-files) + Linux CLI / QNAP guides Explicitly documented as distinct from the separate IPSec password — OpenVPN uses the main account password
VPNSecure.me Account username & password Manual OpenVPN config download + "regenerate key files" from the account portal Router/pfSense guides are self-service, no app dependency

Permanently excluded regardless of protocol:

  • Perfect Privacy — the service shut down entirely around 2026-01-30 (website stopped loading, support unreachable, server count had collapsed to 6 in the prior months). This is a business-continuity fact, not a protocol gap — irrelevant whether sing-box speaks OpenVPN or not.
  • Giganews — a Usenet service whose VPN is a VyprVPN white-label, not an independent provider. It rides whichever protocol VyprVPN's own path uses (WireGuard today, via VyprVPN's WireGuard API — see the post-MVP token/API table above) if that's ever implemented; it does not need its own entry.

Coverage vs. gluetun

gluetun supports 23 providers (OpenVPN for all of them, WireGuard for a subset — see docs/gluetun-comparison.md): AirVPN, CyberGhost, ExpressVPN, FastestVPN, Giganews, HideMyAss, IPVanish, IVPN, Mullvad, NordVPN, Perfect Privacy, Privado (gluetun's name for PrivadoVPN — same service as elsewhere in this document), Private Internet Access, PrivateVPN, ProtonVPN, PureVPN, SlickVPN, Surfshark, TorGuard, VPNSecure.me, VPN Unlimited, VyprVPN, Windscribe.

Combining every WireGuard-plannable provider above with the five OpenVPN-planned ones gives alle a 22-provider target list — identical to gluetun's 23 minus the two that aren't real, distinct, live providers: Perfect Privacy (defunct) and Giganews (a VyprVPN white-label, tracked under VyprVPN). Every provider gluetun supports that is still an operating, independent business is on alle's plan too — alle additionally plans VPN.ac, which gluetun does not support. Getting there still requires: shipping the post-MVP WireGuard providers (Backlog item 2/9), sing-box 1.14 reaching a stable release, and alle adding an OpenVPN provider archetype (not started — see .localonly/Backlog.md).

IPv6 support (planned providers)

Checked against each provider's own support/knowledge-base articles. Scope is the post-MVP providers above (NordVPN and ProtonVPN are already implemented, not "planned", and are omitted). For alle, what matters is whether the provider's WireGuard config/API actually assigns a routable IPv6 address — a generic "IPv6 leak protection" feature just blocks IPv6 outside the tunnel and is not IPv6 support.

Provider IPv6 status Notes
Mullvad Supported (dual-stack) WireGuard tunnels carry IPv6 as well as IPv4 (native since 2014); IPv6 is off by default in the app and Mullvad's own guidance leans toward leaving it off.
AirVPN Supported (dual-stack, entry + exit) Servers are reachable over both IPv4 and IPv6 entry-IPs; WireGuard configs assign an IPv6 ULA address (fd7d:76ee:e68f:a993::/64) alongside the IPv4 one.
IVPN Partial WireGuard gives IPv6-over-IPv4 egress (access the IPv6 internet through an IPv4 tunnel); native IPv6 to their servers has been "under development" 2+ years.
Windscribe Partial (WireGuard, select Pro locations only) IPv6 egress works when "IP Stack" is set to Auto over WireGuard, but only on enabled Pro server locations — not fleet-wide.
Private Internet Access Not supported (blocked, not routed) IPv4-only by design; the app actively blocks/leak-protects IPv6 rather than tunneling it.
VyprVPN Not supported Official support: VyprVPN "will only route a VPN connection using IPv4"; recommends disabling IPv6 locally.
Surfshark Not supported Official support: "Surfshark does not support the IPv6 protocol"; recommends disabling IPv6 locally.
IPVanish Not supported (yet) Official article: "IPVanish currently only supports IPv4"; company says IPv6 support is planned "absolutely" but with no ETA.
PureVPN Not supported (leak-protected only) Public IPv6 page is "IPv6 Leak Protection" — blocks IPv6 outside the tunnel, does not route it.
TorGuard Not supported (leak-protected only) Only public IPv6 material is a 2015 "IPv6 Leak Protection" blog post (blocking); forum ETA requests are unanswered.
PrivateVPN Undocumented — likely unsupported No official IPv6-support statement; only "disable IPv6" troubleshooting guides exist.
VPN Unlimited Undocumented — likely unsupported KB has only a generic "what is IPv6" glossary entry; no statement of support anywhere.
PrivadoVPN Undocumented — likely unsupported No support article confirms tunneling; only "disable IPv6" troubleshooting guides.
VPN.ac Undocumented — likely unsupported No KB article confirms IPv6; the app-options doc doesn't mention IPv6 addressing.
FastestVPN Undocumented — likely unsupported Only "disable IPv6" troubleshooting guides found; no support statement either way.

Bottom line: of the planned providers, only Mullvad and AirVPN hand out a real dual-stack IPv6 address in their WireGuard config today. IVPN and Windscribe are conditional/partial. Everything else is IPv4-only (either by explicit statement or by the absence of any documented support) — an IPv6-capable client on those providers would need to fall back to IPv4 (or disable IPv6 locally, per their own guidance) to avoid leaking outside the tunnel.

Excluded providers

Only two providers are excluded outright now (no protocol unlocks them) — see "Permanently excluded regardless of protocol" under OpenVPN-only providers above for Perfect Privacy (defunct) and Giganews (VyprVPN white-label). Every other provider excluded on WireGuard alone (ExpressVPN, CyberGhost, HideMyAss, SlickVPN, VPNSecure.me — all apps-only or absent on WireGuard) now has an OpenVPN path instead; see that same section for credential shape and sources.

Sources