[BUG] HTTP Error 422 when running command

[robertharris-xyz]

Describe the bug
Proton VPN CLI returns a HTTP error 422 when attempting to run a command.

To Reproduce
Run command: protonvpn c -f

Expected behavior
Connects to protonvpn server.

Program Output

ProtonVPN now offers an official Linux app which includes a graphical user interface.
Visit https://protonvpn.com/support/official-linux-client to upgrade.
[!] There was an error with accessing the ProtonVPN API.
[!] Please make sure your connection is working properly!
[!] HTTP Error Code: 422
[!] This version of the app is no longer supported, please update to continue using the app

Desktop:

• OS: Arch
• Python Version: 3.11.1
• ProtonVPN-CLI Version: 2.2.12

[jonasjancarik]

Try my fork: https://github.com/jonasjancarik/protonvpn-cli-community. I updated the API calls and the .ovpn file template, and I had added some new features earlier as well.

[xing0r]

Hello jonasjancarik,

Thank you for your fork, but unfortunately I'm still experiencing issues with it. When I try to run protonvpn init, the process starts correctly (asks for credentials, plan, protocol), but then it fails with this error:

Pulling server configuration...
Error: Failed to pull server configuration.
Please check your credentials and network connection.

My credentials are definitely correct (I receive email notifications from ProtonVPN about login attempts when I run the command). I've tried both UDP and TCP protocols, and I've verified that my network connection is working properly.

The API seems unable to pull the server list, which might be due to recent changes in the ProtonVPN API. Is there any fix or workaround for this issue?

I'm running this on a Gentoo server with Python 3.12 in a virtual environment.

Any help would be greatly appreciated!

best regards

[jonasjancarik]

Hi, I tried reproducing that using Gentoo in a Docker container (docker run -it gentoo/stage3 /bin/bash) and after installing git, pip3 and openvpn I could run protonvpn init successfully. I then had a problem with the connection itself (protonvpn c --fastest produced 2025-05-16 14:10:28 ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2) in /root/.pvpn-cli/ovpn.log) but that's probably a different issue.

Is it possible you have 2FA enabled for your account? I am not sure it is supported at the moment (I don't think it is)

[xing0r]

Yes, I do have 2FA enabled. Is this a problem? I thought 2FA could be bypassed with the OpenVPN login credentials, which I also entered in addition to the normal Proton credentials?

My main issue is actually that I no longer have access to the ProtonVPN API that shows server load information. I was hoping to use the CLI version to somehow display the server load, since I'm actually using WireGuard connections but want to see which of my servers has the lowest load before connecting.

[jonasjancarik]

Regarding 2FA, I'll need to double-check, but I don't believe it's currently supported. The original version of the CLI only required OpenVPN login details, which are specifically for the VPN connection itself. Now, account credentials are also needed to connect to the API, which used to be publicly accessible. I've updated the API endpoints and the authentication process using code from the official ProtonVPN apps. However, it might need further improvements to actually support 2FA. In the meantime, would you be willing to try using a new, free ProtonVPN account without 2FA/MFA enabled to see if that resolves the issue?

…

On Fri, 16 May 2025, 16:33 xing0r, ***@***.***> wrote: *xing0r* left a comment (Rafficer/linux-cli-community#384) <#384 (comment)> Yes, I do have 2FA enabled. Is this a problem? I thought 2FA could be bypassed with the OpenVPN login credentials, which I also entered in addition to the normal Proton credentials? My main issue is actually that I no longer have access to the ProtonVPN API that shows server load information. I was hoping to use the CLI version to somehow display the server load, since I'm actually using WireGuard connections but want to see which of my servers has the lowest load before connecting. — Reply to this email directly, view it on GitHub <#384 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AASYMN4FJSANULOHRODTRS326XZK5AVCNFSM6AAAAAB3BPWFQ6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQOBWHA4TONRZGU> . You are receiving this because you commented.Message ID: ***@***.***>

[xing0r]

I have deactivated 2FA for testing purposes, and now it works:

"Pulling server configuration...
Server configuration pulled successfully.
ProtonVPN-CLI has been initialized with your credentials."

It would of course be nicer if it worked with 2FA enabled. Are you familiar with rclone? I use it to back up my Proton Drive. With rclone, you can enter the 2FA code during the Proton authentication process, and then rclone receives a login token that I believe is valid for about 1-2 days, as well as a long-term token that can be used to refresh the login token. Perhaps something similar could be implemented for ProtonVPN as well?

cat rclone.conf

[proton]
type = protondrive
username = testuser
password = sdfjekfgjdklgedgkldfjgklfgjelkfgjdiofgjsdJKLJKLHJJKGHUIGHkhkjhjskdhks
2fa = 9285838
client_uid = sdkclsfjsdklfjsdklfjsdklfjsklfsdkjfsklfjslkfksjs
client_access_token = sfkosfjsdofcjsdjkasldjkasopdkasjdopasjkdopasdks
client_refresh_token = sdfjksdjfsdklfjsdklfjsdklfjsklfjsklfjsdlkfjskldfjsdklfjls
client_salted_key_pass = JKLJDKLFJLKDJKLDSJDKLDJKLDJKLJLKDJJKLJjjj==

[Nikita-Goncharov]

Same here, but my 2FA is disabled

[lsli8888]

@jonasjancarik

I've built your project (protonvpn-cli-community) in my own Docker container where my service resides. I haven't tried your docker-compose set up yet as my current configuration is my preferred configuration, but I may try it next.

Anyway, the project builds successfully in my Docker container. Executing:

protonvpn --version

works and yields:

ProtonVPN-CLI v3.0.0
I've also executed:

protonvpn init

And that seemed to work after I disabled 2FA on my account.

However, when I try to connect to a server, it fails. If I try:

protonvpn c

Then go through the text based interface to select a country/server/protocol combination, it fails - regardless of any combination I choose.

I also tried the pure command line connection commands like:

sudo protonvpn c --fastest

and that doesn't work either. The output is something like:

Connecting to JP-FREE#12 via TCP... Connection failed.

When I look at the Proton VPN logs in my .pvpn-cli directory pvpn-cli.log file, I see:

2025-07-06 17:33:44,098 — protonvpn-cli — DEBUG — openvpn_connect:533 — OpenVPN process started 2025-07-06 17:34:29,165 — protonvpn-cli — DEBUG — openvpn_connect:609 — Connection failed after 45 Seconds

Any idea what's going on or what may be causing this issue? FYI, I'm trying to use the free tier (tier 1).

[jonasjancarik]

Hi, I’m not sure when I’ll be able to take a closer look, for personal reasons. In the meantime, I’d suggest spinning up the example Docker Compose setup to rule out any credential-related or similar issues. There should also be a dedicated log file from the OpenVPN process, though I can’t recall its exact location off the top of my head… Generally, if the example setup works but yours doesn’t, it’s probably due to something missing in the OS image your container is built on.

…

On Mon, 7 Jul 2025, 09:48 lsli8888, ***@***.***> wrote: *lsli8888* left a comment (Rafficer/linux-cli-community#384) <#384 (comment)> @jonasjancarik <https://github.com/jonasjancarik> I've built your project (protonvpn-cli-community <https://github.com/jonasjancarik/protonvpn-cli-community>) in my own Docker container where my service resides. I haven't tried your docker-compose set up yet as my current configuration is my preferred configuration, but I may try it next. Anyway, the project builds successfully in my Docker container. Executing: protonvpn --version works and yields: ProtonVPN-CLI v3.0.0 I've also executed: protonvpn init And that seemed to work after I disabled 2FA on my account. However, when I try to connect to a server, it fails. If I try: protonvpn c Then go through the text based interface to select a country/server/protocol combination, it fails - regardless of any combination I choose. I also tried the pure command line connection commands like: sudo protonvpn c --fastest and that doesn't work either. The output is something like: Connecting to JP-FREE#12 via TCP... Connection failed. When I look at the Proton VPN logs in my .pvpn-cli directory pvpn-cli.log file, I see: 2025-07-06 17:33:44,098 — protonvpn-cli — DEBUG — openvpn_connect:533 — OpenVPN process started 2025-07-06 17:34:29,165 — protonvpn-cli — DEBUG — openvpn_connect:609 — Connection failed after 45 Seconds Any idea what's going on or what may be causing this issue? FYI, I'm trying to use the free tier (tier 1). — Reply to this email directly, view it on GitHub <#384 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AASYMN66QENFPZHUKPXNXE33HIQ4PAVCNFSM6AAAAAB3BPWFQ6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTANBTHA2DMMBYGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[lsli8888]

@jonasjancarik - thanks for the suggestion. I figured out the issue by doing what you suggested. I examined the OpenVPN logs, which had the following error:

2025-07-06 16:57:12,748 — protonvpn-cli — ERROR — authenticate:102 — Authentication error during API login: Unable to run gpg (gpg) - it may not be available.

So I ensure gnupg was installed, then added the following properties to my scrapyd service:

cap_add:
      - NET_ADMIN
devices:
  - /dev/net/tun:/dev/net/tun

And that worked. Again, thanks for your help!

[ejjdejong]

Hi @jonasjancarik,
I'm using your fork, first thank you so much for making this available!
As the other say I can confirm that protonvpn init in doesn't work with 2FA enabled. Using the exact same env, it throws the Error: Failed to pull server configuration error, after disabling 2FA on my account, it says Server configuration pulled successfully.
I hope you find the time to look into this, but take it easy of course. I the meantime, I'll see if I can set up a seconds protonvpn account without 2fa.
Cheers!

[lsli8888]

Hi @jonasjancarik ,

Can you enable the Issues page for your project?

I wanted to create an issue (I wasn't sure whether to create a pull request as I'm not too familiar with the code) whereby there's an issue in utils.py with the VERSION reference being unresolved:

https://github.com/jonasjancarik/protonvpn-cli-community/blob/master/protonvpn_cli/utils.py#L529

Your most recent commit for this file showed you commented out the import for VERSION:

jonasjancarik@936fee4#diff-712decd57d3ef70ca9877a78d889dd7ab9e0c5c7323fdf79a450855c068092a3R26

with the comment:

we could use this for the API identification, but it blocks low version numbers as no longer supported

I could have submitted a simple pull request to put that import back in, but I didn't really understand your comment so I felt I shouldn't create a pull request without fully understanding it.

I can definitely modify my pvpn-cli.cfg file and set check_update_interval to a very large value, so that the if block here:

https://github.com/jonasjancarik/protonvpn-cli-community/blob/master/protonvpn_cli/utils.py#L524

will always return..., but I didn't want to have to modify my pvpn-cli.cfg file. What are your thoughts on this minor issue? I just hate seeing a runtime error like the following every time I connect:

Connected!
STDERR: Traceback (most recent call last):
  File "/usr/local/bin/protonvpn", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/local/lib/python3.12/site-packages/protonvpn_cli/cli.py", line 115, in main
    cli()
  File "/usr/local/lib/python3.12/site-packages/protonvpn_cli/cli.py", line 247, in cli
    connection.country_f(args.get("--cc"), protocol)
  File "/usr/local/lib/python3.12/site-packages/protonvpn_cli/connection.py", line 228, in country_f
    openvpn_connect(fastest_server, protocol)
  File "/usr/local/lib/python3.12/site-packages/protonvpn_cli/connection.py", line 625, in openvpn_connect
    check_update()
  File "/usr/local/lib/python3.12/site-packages/protonvpn_cli/utils.py", line 529, in check_update
    current_version = list(VERSION.split("."))
                           ^^^^^^^
NameError: name 'VERSION' is not defined
2025-07-10 21:01:14 [myapp] CRITICAL: Failed to establish initial ProtonVPN connection. Closing spider to prevent unprotected scraping.
2025-07-10 21:01:14 [scrapy.utils.signal] ERROR: Error caught on signal handler: <bound method ProtonVPNCLICommunityExtension.spider_opened of <myapp.ProtonVPNCLICommunityExtension object at 0x7ffff98b8ce0>>
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/scrapy/utils/defer.py", line 417, in maybeDeferred_coro
    result = f(*args, **kw)
             ^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/pydispatch/robustapply.py", line 55, in robustApply
    return receiver(*arguments, **named)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/data/scrapy-configuration/scrapyd/eggs/myapp/1752027636.egg/myapp/extensions/protonvpn_cli_community_extension.py", line 95, in spider_opened
    raise CloseSpider(reason=error_msg)
scrapy.exceptions.CloseSpider

[jonasjancarik]

Yes of course, I didn't realise it was disabled. https://github.com/jonasjancarik/protonvpn-cli-community/issues

Feel free to open an issue there. I am also open to adding collaborators to the project as I have rather limited time and energy for this right now.

Anyway, you're probably right, VERSION should still be imported even if we have a hardcoded arbitrary version number for the client identification in the API requests (see line 80 https://github.com/jonasjancarik/protonvpn-cli-community/blob/936fee412f1a1e08b68deb84f01d6ee7424724d9/protonvpn_cli/utils.py#L80).

[lsli8888]

Thanks @jonasjancarik . I appreciate all the hard work you put into the code. Haha, I'm a bit low on time, too, so I'm not sure I can be a collaborator, but feel free to add me if you want so I can make the change. Or I can always fork the project and create a PR. Let me know how you want me to proceed in the future if I find any additional issues. But I've created the issue for you for now here.