diff --git a/Dockerfile b/Dockerfile
index 3da4ed33..e8917bc3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -69,7 +69,7 @@ LABEL \
 ENV VPNSP=pia \
     VPN_TYPE=openvpn \
     # OpenVPN
-    PROTOCOL=udp \
+    OPENVPN_PROTOCOL=udp \
     OPENVPN_USER= \
     OPENVPN_PASSWORD= \
     OPENVPN_USER_SECRETFILE=/run/secrets/openvpn_user \
diff --git a/internal/configuration/cyberghost.go b/internal/configuration/cyberghost.go
index 8d39d7c1..f22a6b6c 100644
--- a/internal/configuration/cyberghost.go
+++ b/internal/configuration/cyberghost.go
@@ -32,7 +32,7 @@ func (settings *Provider) readCyberghost(r reader) (err error) {
 		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r)
 }
 
 func (settings *OpenVPN) readCyberghost(r reader) (err error) {
diff --git a/internal/configuration/fastestvpn.go b/internal/configuration/fastestvpn.go
index f35657b6..ada9bdec 100644
--- a/internal/configuration/fastestvpn.go
+++ b/internal/configuration/fastestvpn.go
@@ -26,5 +26,5 @@ func (settings *Provider) readFastestvpn(r reader) (err error) {
 		return fmt.Errorf("environment variable COUNTRY: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
 }
diff --git a/internal/configuration/hidemyass.go b/internal/configuration/hidemyass.go
index 4bae3f15..40ef68db 100644
--- a/internal/configuration/hidemyass.go
+++ b/internal/configuration/hidemyass.go
@@ -36,5 +36,5 @@ func (settings *Provider) readHideMyAss(r reader) (err error) {
 		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r)
 }
diff --git a/internal/configuration/ipvanish.go b/internal/configuration/ipvanish.go
index 6764ad78..52e8858a 100644
--- a/internal/configuration/ipvanish.go
+++ b/internal/configuration/ipvanish.go
@@ -31,5 +31,5 @@ func (settings *Provider) readIpvanish(r reader) (err error) {
 		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
 }
diff --git a/internal/configuration/ipvanish_test.go b/internal/configuration/ipvanish_test.go
index 6d136f87..fd82c4e0 100644
--- a/internal/configuration/ipvanish_test.go
+++ b/internal/configuration/ipvanish_test.go
@@ -82,7 +82,7 @@ func Test_Provider_readIpvanish(t *testing.T) {
 			settings: Provider{
 				Name: constants.Ipvanish,
 			},
-			err: errors.New("environment variable PROTOCOL: dummy test error"),
+			err: errors.New("environment variable OPENVPN_PROTOCOL: dummy test error"),
 		},
 		"default settings": {
 			targetIP:  singleStringCall{call: true},
@@ -145,7 +145,7 @@ func Test_Provider_readIpvanish(t *testing.T) {
 					Return(testCase.hostnames.values, testCase.hostnames.err)
 			}
 			if testCase.protocol.call {
-				env.EXPECT().Inside("PROTOCOL", []string{constants.TCP, constants.UDP}, gomock.Any()).
+				env.EXPECT().Inside("OPENVPN_PROTOCOL", []string{constants.TCP, constants.UDP}, gomock.Any()).
 					Return(testCase.protocol.value, testCase.protocol.err)
 			}
 
diff --git a/internal/configuration/ivpn.go b/internal/configuration/ivpn.go
index 25ff30a0..075b44aa 100644
--- a/internal/configuration/ivpn.go
+++ b/internal/configuration/ivpn.go
@@ -36,7 +36,7 @@ func (settings *Provider) readIvpn(r reader) (err error) {
 		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
 	}
 
-	err = settings.ServerSelection.OpenVPN.readIVPN(r.env)
+	err = settings.ServerSelection.OpenVPN.readIVPN(r)
 	if err != nil {
 		return err
 	}
@@ -44,13 +44,13 @@ func (settings *Provider) readIvpn(r reader) (err error) {
 	return settings.ServerSelection.Wireguard.readIVPN(r.env)
 }
 
-func (settings *OpenVPNSelection) readIVPN(env params.Interface) (err error) {
-	settings.TCP, err = readProtocol(env)
+func (settings *OpenVPNSelection) readIVPN(r reader) (err error) {
+	settings.TCP, err = readOpenVPNProtocol(r)
 	if err != nil {
 		return err
 	}
 
-	settings.CustomPort, err = readOpenVPNCustomPort(env, settings.TCP,
+	settings.CustomPort, err = readOpenVPNCustomPort(r.env, settings.TCP,
 		[]uint16{80, 443, 1443}, []uint16{53, 1194, 2049, 2050})
 	if err != nil {
 		return err
diff --git a/internal/configuration/ivpn_test.go b/internal/configuration/ivpn_test.go
index 6e47c83c..567498c1 100644
--- a/internal/configuration/ivpn_test.go
+++ b/internal/configuration/ivpn_test.go
@@ -107,7 +107,7 @@ func Test_Provider_readIvpn(t *testing.T) { //nolint:gocognit
 			settings: Provider{
 				Name: constants.Ivpn,
 			},
-			err: errors.New("environment variable PROTOCOL: dummy test error"),
+			err: errors.New("environment variable OPENVPN_PROTOCOL: dummy test error"),
 		},
 		"openvpn custom port error": {
 			targetIP:  singleStringCall{call: true},
@@ -214,7 +214,7 @@ func Test_Provider_readIvpn(t *testing.T) { //nolint:gocognit
 					Return(testCase.hostnames.values, testCase.hostnames.err)
 			}
 			if testCase.protocol.call {
-				env.EXPECT().Inside("PROTOCOL", []string{constants.TCP, constants.UDP}, gomock.Any()).
+				env.EXPECT().Inside("OPENVPN_PROTOCOL", []string{constants.TCP, constants.UDP}, gomock.Any()).
 					Return(testCase.protocol.value, testCase.protocol.err)
 			}
 			if testCase.ovpnPort.getCall {
diff --git a/internal/configuration/mullvad.go b/internal/configuration/mullvad.go
index b6c8974f..3d2fc8b7 100644
--- a/internal/configuration/mullvad.go
+++ b/internal/configuration/mullvad.go
@@ -41,7 +41,7 @@ func (settings *Provider) readMullvad(r reader) (err error) {
 		return fmt.Errorf("environment variable OWNED: %w", err)
 	}
 
-	err = settings.ServerSelection.OpenVPN.readMullvad(r.env)
+	err = settings.ServerSelection.OpenVPN.readMullvad(r)
 	if err != nil {
 		return err
 	}
@@ -49,13 +49,13 @@ func (settings *Provider) readMullvad(r reader) (err error) {
 	return settings.ServerSelection.Wireguard.readMullvad(r.env)
 }
 
-func (settings *OpenVPNSelection) readMullvad(env params.Interface) (err error) {
-	settings.TCP, err = readProtocol(env)
+func (settings *OpenVPNSelection) readMullvad(r reader) (err error) {
+	settings.TCP, err = readOpenVPNProtocol(r)
 	if err != nil {
 		return err
 	}
 
-	settings.CustomPort, err = readOpenVPNCustomPort(env, settings.TCP,
+	settings.CustomPort, err = readOpenVPNCustomPort(r.env, settings.TCP,
 		[]uint16{80, 443, 1401}, []uint16{53, 1194, 1195, 1196, 1197, 1300, 1301, 1302, 1303, 1400})
 	if err != nil {
 		return err
diff --git a/internal/configuration/nordvpn.go b/internal/configuration/nordvpn.go
index a72466e2..cd44c4e0 100644
--- a/internal/configuration/nordvpn.go
+++ b/internal/configuration/nordvpn.go
@@ -37,7 +37,7 @@ func (settings *Provider) readNordvpn(r reader) (err error) {
 		return err
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
 }
 
 func readNordVPNServerNumbers(env params.Interface) (numbers []uint16, err error) {
diff --git a/internal/configuration/openvpn.go b/internal/configuration/openvpn.go
index 4a7c4668..2f5d99d1 100644
--- a/internal/configuration/openvpn.go
+++ b/internal/configuration/openvpn.go
@@ -176,10 +176,11 @@ func (settings *OpenVPN) read(r reader, serviceProvider string) (err error) {
 	return nil
 }
 
-func readProtocol(env params.Interface) (tcp bool, err error) {
-	protocol, err := env.Inside("PROTOCOL", []string{constants.TCP, constants.UDP}, params.Default(constants.UDP))
+func readOpenVPNProtocol(r reader) (tcp bool, err error) {
+	protocol, err := r.env.Inside("OPENVPN_PROTOCOL", []string{constants.TCP, constants.UDP},
+		params.Default(constants.UDP), params.RetroKeys([]string{"PROTOCOL"}, r.onRetroActive))
 	if err != nil {
-		return false, fmt.Errorf("environment variable PROTOCOL: %w", err)
+		return false, fmt.Errorf("environment variable OPENVPN_PROTOCOL: %w", err)
 	}
 	return protocol == constants.TCP, nil
 }
diff --git a/internal/configuration/privatevpn.go b/internal/configuration/privatevpn.go
index d3818848..3fb2adbb 100644
--- a/internal/configuration/privatevpn.go
+++ b/internal/configuration/privatevpn.go
@@ -31,5 +31,5 @@ func (settings *Provider) readPrivatevpn(r reader) (err error) {
 		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r)
 }
diff --git a/internal/configuration/protonvpn.go b/internal/configuration/protonvpn.go
index 0036766b..2f50ffc0 100644
--- a/internal/configuration/protonvpn.go
+++ b/internal/configuration/protonvpn.go
@@ -47,5 +47,5 @@ func (settings *Provider) readProtonvpn(r reader) (err error) {
 		return fmt.Errorf("environment variable FREE_ONLY: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r)
 }
diff --git a/internal/configuration/provider_test.go b/internal/configuration/provider_test.go
index ac55b915..d51cb5e9 100644
--- a/internal/configuration/provider_test.go
+++ b/internal/configuration/provider_test.go
@@ -372,7 +372,7 @@ func Test_readProtocol(t *testing.T) {
 	}{
 		"error": {
 			mockErr: errDummy,
-			err:     errors.New("environment variable PROTOCOL: dummy"),
+			err:     errors.New("environment variable OPENVPN_PROTOCOL: dummy"),
 		},
 		"success": {
 			mockStr: "tcp",
@@ -388,10 +388,13 @@ func Test_readProtocol(t *testing.T) {
 
 			env := mock_params.NewMockInterface(ctrl)
 			env.EXPECT().
-				Inside("PROTOCOL", []string{"tcp", "udp"}, gomock.Any()).
+				Inside("OPENVPN_PROTOCOL", []string{"tcp", "udp"}, gomock.Any(), gomock.Any()).
 				Return(testCase.mockStr, testCase.mockErr)
+			reader := reader{
+				env: env,
+			}
 
-			tcp, err := readProtocol(env)
+			tcp, err := readOpenVPNProtocol(reader)
 
 			if testCase.err != nil {
 				require.Error(t, err)
diff --git a/internal/configuration/purevpn.go b/internal/configuration/purevpn.go
index 34c5e306..49ae1af7 100644
--- a/internal/configuration/purevpn.go
+++ b/internal/configuration/purevpn.go
@@ -35,5 +35,5 @@ func (settings *Provider) readPurevpn(r reader) (err error) {
 		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
 }
diff --git a/internal/configuration/selection.go b/internal/configuration/selection.go
index d4224cc7..67689344 100644
--- a/internal/configuration/selection.go
+++ b/internal/configuration/selection.go
@@ -5,7 +5,6 @@ import (
 	"net"
 
 	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
 )
 
 type ServerSelection struct { //nolint:maligned
@@ -132,18 +131,18 @@ func (settings *OpenVPNSelection) lines() (lines []string) {
 	return lines
 }
 
-func (settings *OpenVPNSelection) readProtocolOnly(env params.Interface) (err error) {
-	settings.TCP, err = readProtocol(env)
+func (settings *OpenVPNSelection) readProtocolOnly(r reader) (err error) {
+	settings.TCP, err = readOpenVPNProtocol(r)
 	return err
 }
 
-func (settings *OpenVPNSelection) readProtocolAndPort(env params.Interface) (err error) {
-	settings.TCP, err = readProtocol(env)
+func (settings *OpenVPNSelection) readProtocolAndPort(r reader) (err error) {
+	settings.TCP, err = readOpenVPNProtocol(r)
 	if err != nil {
 		return err
 	}
 
-	settings.CustomPort, err = readPortOrZero(env, "PORT")
+	settings.CustomPort, err = readPortOrZero(r.env, "PORT")
 	if err != nil {
 		return fmt.Errorf("environment variable PORT: %w", err)
 	}
diff --git a/internal/configuration/surfshark.go b/internal/configuration/surfshark.go
index 6449b72f..6f928baf 100644
--- a/internal/configuration/surfshark.go
+++ b/internal/configuration/surfshark.go
@@ -50,7 +50,7 @@ func (settings *Provider) readSurfshark(r reader) (err error) {
 		return fmt.Errorf("environment variable MULTIHOP_ONLY: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
 }
 
 func surfsharkRetroRegion(selection ServerSelection) (
diff --git a/internal/configuration/surfshark_test.go b/internal/configuration/surfshark_test.go
index eaccd650..ba5f377c 100644
--- a/internal/configuration/surfshark_test.go
+++ b/internal/configuration/surfshark_test.go
@@ -115,7 +115,7 @@ func Test_Provider_readSurfshark(t *testing.T) {
 			settings: Provider{
 				Name: constants.Surfshark,
 			},
-			err: errors.New("environment variable PROTOCOL: dummy test error"),
+			err: errors.New("environment variable OPENVPN_PROTOCOL: dummy test error"),
 		},
 		"default settings": {
 			targetIP:  stringCall{call: true},
@@ -214,7 +214,7 @@ func Test_Provider_readSurfshark(t *testing.T) {
 					Return(testCase.multiHop.value, testCase.multiHop.err)
 			}
 			if testCase.protocol.call {
-				env.EXPECT().Inside("PROTOCOL", []string{constants.TCP, constants.UDP}, gomock.Any()).
+				env.EXPECT().Inside("OPENVPN_PROTOCOL", []string{constants.TCP, constants.UDP}, gomock.Any()).
 					Return(testCase.protocol.value, testCase.protocol.err)
 			}
 
diff --git a/internal/configuration/torguard.go b/internal/configuration/torguard.go
index 8ae96ee2..0ee76502 100644
--- a/internal/configuration/torguard.go
+++ b/internal/configuration/torguard.go
@@ -31,5 +31,5 @@ func (settings *Provider) readTorguard(r reader) (err error) {
 		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r)
 }
diff --git a/internal/configuration/vpnunlimited.go b/internal/configuration/vpnunlimited.go
index caed2aba..9a64d968 100644
--- a/internal/configuration/vpnunlimited.go
+++ b/internal/configuration/vpnunlimited.go
@@ -42,7 +42,7 @@ func (settings *Provider) readVPNUnlimited(r reader) (err error) {
 		return fmt.Errorf("environment variable STREAM_ONLY: %w", err)
 	}
 
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r.env)
+	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
 }
 
 func (settings *OpenVPN) readVPNUnlimited(r reader) (err error) {
diff --git a/internal/configuration/windscribe.go b/internal/configuration/windscribe.go
index f7168fb0..a4340e11 100644
--- a/internal/configuration/windscribe.go
+++ b/internal/configuration/windscribe.go
@@ -32,7 +32,7 @@ func (settings *Provider) readWindscribe(r reader) (err error) {
 		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
 	}
 
-	err = settings.ServerSelection.OpenVPN.readWindscribe(r.env)
+	err = settings.ServerSelection.OpenVPN.readWindscribe(r)
 	if err != nil {
 		return err
 	}
@@ -40,13 +40,13 @@ func (settings *Provider) readWindscribe(r reader) (err error) {
 	return settings.ServerSelection.Wireguard.readWindscribe(r.env)
 }
 
-func (settings *OpenVPNSelection) readWindscribe(env params.Interface) (err error) {
-	settings.TCP, err = readProtocol(env)
+func (settings *OpenVPNSelection) readWindscribe(r reader) (err error) {
+	settings.TCP, err = readOpenVPNProtocol(r)
 	if err != nil {
 		return err
 	}
 
-	settings.CustomPort, err = readOpenVPNCustomPort(env, settings.TCP,
+	settings.CustomPort, err = readOpenVPNCustomPort(r.env, settings.TCP,
 		[]uint16{21, 22, 80, 123, 143, 443, 587, 1194, 3306, 8080, 54783},
 		[]uint16{53, 80, 123, 443, 1194, 54783})
 	if err != nil {
diff --git a/maintenance.md b/maintenance.md
index 7b85a956..1965c1cd 100644
--- a/maintenance.md
+++ b/maintenance.md
@@ -37,7 +37,7 @@
 - Remove HTTP server v0
 - `PORT` to `OPENVPN_PORT`
 - `UNBLOCK` to `DOT_UNBOUND_UNBLOCK`
-- `PROTOCOL` to `OPENVPN_PROTOCOL`
+- Remove `PROTOCOL`
 - `PORT_FORWARDING`
 - Change servers filtering environment variables to plural
 - Remove `WIREGUARD_PORT`