Gluetun+PIA: anyone have a script to auto-update the forwarded port in qbittorrent?

[jay-kub]

PIA changes the forwarded port every 60 days, which gluetun publishes to forwarded_port in the config directory. Has anyone created a script to auto-update the qbittorrent config with the new port? Ideally I am looking for a docker-compose option so that I can add it to my gluetun-qbit-etc yaml file.

Thanks y'all

[carmatana]

I have in synology running every X timer the next script:

#!/bin/sh

#read PIA port
gluetun_port=$(jq .port /gluetun/piaportforward.json)

WEBUI_PORT=8080 #qBittorrent port
web_protocol="http"

curl -k -i -X POST -d "json={"random_port": false}" "${web_protocol}://localhost:${WEBUI_PORT}/api/v2/app/setPreferences" # &> /dev/null
curl -k -i -X POST -d "json={"listen_port": ${gluetun_port}}" "${web_protocol}://localhost:${WEBUI_PORT}/api/v2/app/setPreferences" # &> /dev/null

---

I ran it with:

docker exec qbittorrent sh -c "/gluetun/port-tool-gluetun.sh"

My qbittorrent container (linuxserver) has to have access to the gluetun folder when creating it, in compose:

volumes:
- /path/to/gluetun:/gluetun:ro

IMPORTANT:

In Qbittorrent settings, in the WEBUI section, the following option has to be turned ON.

"Bypass authentication for clients on localhost"

If not, the curl instructions of the script will return Access Forbidden.

[carmatana]

If you do not want to have the option "Bypass authentication for clients on localhost" checked, you can do:

#!/bin/sh


gluetun_port=$(jq .port /gluetun/piaportforward.json)

echo "gluetun port is ${gluetun_port}"

WEBUI_PORT=8080
web_protocol="http"

cookie=$(curl -i --header 'Referer: ${web_protocol}://localhost:${WEBUI_PORT}' --data 'username=admin&password=adminadmin' ${web_protocol}://localhost:${WEBUI_PORT}/api/v2/auth/login | grep set-cookie | sed 's/.*set-cookie: //;s/;.*//') # &> /dev/null

echo "login cookie is: $cookie"

curl -k -i -X POST -d "json={\"random_port\": false}" "${web_protocol}://localhost:${WEBUI_PORT}/api/v2/app/setPreferences" --cookie $cookie  # &> /dev/null
        
curl -k -i -X POST -d "json={\"listen_port\": ${gluetun_port}}" "${web_protocol}://localhost:${WEBUI_PORT}/api/v2/app/setPreferences" --cookie $cookie  # &> /dev/null

Again, I ran it with:

docker exec qbittorrent sh -c "/gluetun/port-tool-gluetun.sh"

the qbittorrent container (linuxserver) has to have access to the gluetun container folder to read the vpn port and the script if this is located also there.

[jay-kub]

Thanks @carmatana. I ended up going with charlocharlie/qbittorrent-port-forward-file just due to ease-of-use, but I will keep this script earmarked in case I run into issues.

[DieSchoeneWolke]

#!/bin/sh

gluetun_port=$(jq .port /Gluetun/piaportforward.json)

echo "gluetun port is ${gluetun_port}"

DOMAIN=http://
USER=
PASS=

cookie=$(curl -i --header 'Referer: ${DOMAIN}' --data 'username=${USER}&password=${PASS}' ${DOMAIN}/api/v2/auth/login | grep set-cookie | sed 's/.set-cookie: //;s/;.//') # &> /dev/null

echo "login cookie is: $cookie"

curl -k -i -X POST -d "json={"random_port": false}" "${DOMAIN}/api/v2/app/setPreferences" --cookie $cookie # &> /dev/null

curl -k -i -X POST -d "json={"listen_port": ${gluetun_port}}" "${DOMAIN}/api/v2/app/setPreferences" --cookie $cookie # &> /dev/null

results in:

curl: (28) Failed to connect to xxx port xxx after 129402 ms: Couldn't connect to server

curl: option --cookie: requires parameter

curl: try 'curl --help' or 'curl --manual' for more information

curl: option --cookie: requires parameter

curl: try 'curl --help' or 'curl --manual' for more information

gluetun port is xxx

[DcR-NL]

The docker compose solution I've been using is charlocharlie/qbittorrent-port-forward-file. Something like this (bare minimal):

  qbittorrent-port:
    image: charlocharlie/qbittorrent-port-forward-file:latest
    container_name: qbittorrent-port
    environment:
      - QBT_USERNAME=${QBITTORRENT_USER}
      - QBT_PASSWORD=${QBITTORRENT_PASS}
      - QBT_ADDR=${QBITTORRENT_URL}
      - PORT_FILE=/config/forwarded_port
    volumes:
      - /something/gluetun/main/:/config:ro
    restart: unless-stopped

[jay-kub]

That worked flawlessly, thanks!

[DieSchoeneWolke]

Could you share your final docker-compose.yml please?
Because I'm stuck with the container wanting to read the file from /config/ which I don't have.
I already rewrote the script with removing it without any luck.

[jay-kub]

version: "3"

services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    hostname: gluetun
    cap_add:
      - NET_ADMIN
    volumes:
      - /*LOCATION*:/gluetun
    environment:
      - PUID=*USER*
      - PGID=100
      - VPN_SERVICE_PROVIDER=private internet access
      - OPENVPN_USER=*USER*
      - OPENVPN_PASSWORD=*PASS*
      - SERVER_REGIONS=*REGION*
      - PRIVATE_INTERNET_ACCESS_VPN_PORT_FORWARDING=on
      - PRIVATE_INTERNET_ACCESS_VPN_PORT_FORWARDING_STATUS_FILE=/gluetun/forwarded_port
      - FIREWALL_VPN_INPUT_PORTS=8080
    ports:
      - 8080:8080 #qbit
    restart: unless-stopped
    network_mode: bridge

  qbittorrent-port:
    image: charlocharlie/qbittorrent-port-forward-file:latest
    container_name: gluetun-qbittorrent-portfw
    environment:
      - QBT_USERNAME=*USER*
      - QBT_PASSWORD=*PASS*
      - QBT_ADDR=http://*IP*:8080
      - PORT_FILE=/config/forwarded_port
    volumes:
      - /*LOCATION*/:/config:ro
    restart: unless-stopped

[DieSchoeneWolke]

Thank you very much that helped me out with the filepaths!

[GotRambutan]

Hi
I new at docker and I am not able to get it to work . Could some one provide some guidance. Thank you!

 Gluetun - VPN Client for Docker Containers and More
  gluetun:
    <<: *common-keys-core # See EXTENSION FIELDS at the top
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    ports:
      - "8085:8085" # Exposing qBittorrent through Docker Host LAN IP
    volumes:
      - $DOCKERDIR/appdata/gluetun:/gluetun
    environment:
      <<: *default-tz-puid-pgid
      #OpenVPN
      LOG_LEVEL: "debug"
      VPN_SERVICE_PROVIDER: "private internet access"
      OPENVPN_USER: $PIA_USERNAME
      OPENVPN_PASSWORD: $PIA_PASSWORD
      SERVER_REGIONS: "CA Vancouver"
      PRIVATE_INTERNET_ACCESS_VPN_PORT_FORWARDING: "on"
      PRIVATE_INTERNET_ACCESS_VPN_PORT_FORWARDING_STATUS_FILE: "/gluetun/forwarded_port"
      FIREWALL_VPN_INPUT_PORTS: "8085"

  qbittorrent-port:
    image: charlocharlie/qbittorrent-port-forward-file:latest
    container_name: gluetun-qbittorrent-portfw
    environment:

      QBT_USERNAME: $QBT_RPC_USERNAME
      QBT_PASSWORD: $QBT_RPC_PASSWORD
      QBT_ADDR: http://$SERVER_IP:8085
      PORT_FILE: "/gluetun/forwarded_port"
    volumes:
      - $DOCKERDIR/appdata/gluetun:/gluetun:ro
    restart: unless-stopped

I see the port being written

gluetun                     | 2023-07-04T12:55:02-07:00 INFO [port forwarding] Port forwarded data expires in 62 days
gluetun                     | 2023-07-04T12:55:03-07:00 INFO [port forwarding] port forwarded is 44798
gluetun                     | 2023-07-04T12:55:03-07:00 INFO [firewall] setting allowed input port 44798 through interface tun0...
gluetun                     | 2023-07-04T12:55:03-07:00 DEBUG [firewall] iptables --append INPUT -i tun0 -p tcp --dport 44798 -j ACCEPT
gluetun                     | 2023-07-04T12:55:03-07:00 DEBUG [firewall] ip6tables-nft --append INPUT -i tun0 -p tcp --dport 44798 -j ACCEPT
gluetun                     | 2023-07-04T12:55:03-07:00 DEBUG [firewall] iptables --append INPUT -i tun0 -p udp --dport 44798 -j ACCEPT
gluetun                     | 2023-07-04T12:55:03-07:00 DEBUG [firewall] ip6tables-nft --append INPUT -i tun0 -p udp --dport 44798 -j ACCEPT
gluetun                     | 2023-07-04T12:55:03-07:00 INFO [port forwarding] writing port file /gluetun/forwarded_port

I keep getting this error:
gluetun-qbittorrent-portfw | Port file /gluetun/forwarded_port does not exist

[jay-kub]

It sounds like the $DOCKERDIR location for your qbittorrent volume doesn't match the $DOCKERDIR location for the gluetun-qbittorrent-portfw. I'd double check those and make sure they match verbatim.

It could also be that whatever user is running the docker for gluetun-qbittorrent-portfw doesn't have read access to that folder location. You may want to give that user read access to your entire $DOCKERDIR just to be sure.

[GotRambutan]

Thanks

$DockerDIR = /home/user/docker/

I have given Docker group and the user full rights to the file and folder but still gives the same error.

[qdm12]

If any of you wants to PR your solution to https://github.com/qdm12/gluetun-wiki feel free to have a go 😉

[tomdh76]

I have an issue using the docker: I keep getting error:

curl: (22) The requested URL returned error: 404

Looks like somehow the script cannot access qbittorrent?

qbittorrent-port:
image: charlocharlie/qbittorrent-port-forward-file
container_name: qbittorrent-port
environment:
- QBT_USERNAME=${QBT_USERNAME}
- QBT_PASSWORD=${QBT_PASSWORD}
- QBT_ADDR=http://192.168.30.11:8090/
- PORT_FILE=/config/forwarded_port
volumes:
- ${DOCKERDIR}/gluetun/:/config:ro
restart: unless-stopped

If I change the qbt_address: it errors that it cannot find website so its making a connection. Username and password are correct when I login in the webbrowser of qbittorrent.

[jay-kub]

This sounds like an issue with your firewall rules. Try turning the firewall off and see if it works. If it still doesn't work then please share you're entire docker-compose.

[tomdh76]

What firewall do I need to turn off? I cannot find a setting for the qbitorrent docker? I have a OPNSENSE firewall but this should not block local networks I think?

This is my docker compose:

services:
qbittorrent:
image: lscr.io/linuxserver/qbittorrent:latest
container_name: qbittorrent
network_mode: "service:gluetun"
environment:
PUID: $PUID
PGID: $PGID
TZ: $TZ
WEBUI_PORT: "8090"
volumes:
- $DOCKERDIR/qbittorent/config:/config
- /media/downloads/qbittorent:/downloads
depends_on:
- gluetun
restart: unless-stopped
qbittorrent-port:
image: charlocharlie/qbittorrent-port-forward-file
container_name: qbittorrent-port
environment:
- QBT_USERNAME=${QBT_USERNAME}
- QBT_PASSWORD=${QBT_PASSWORD}
- QBT_ADDR=http://192.168.30.11:8090/
- PORT_FILE=/config/forwarded_port
volumes:
- ${DOCKERDIR}/gluetun/:/config:ro
#restart: no
gluetun:
image: qmcgaw/gluetun
container_name: gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
ports:
- 8888:8888/tcp # HTTP proxy
- 8090:8090 # qbittorrent
- 6881:6881
- 6881:6881/udp
volumes:
- ${DOCKERDIR}/gluetun:/gluetun:rw
environment:
- VPN_SERVICE_PROVIDER=private internet access
- TZ=${TZ}
- OPENVPN_USER=xxxxxx
- OPENVPN_PASSWORD=xxxxxx
- SERVER_REGION=Netherlands
- SERVER_HOSTNAMES=nl-amsterdam.privacy.network
- VPN_PORT_FORWARDING=on
- VPN_PORT_FORWARDING_STATUS_FILE=/gluetun/forwarded_port
- FIREWALL_VPN_INPUT_PORTS=8090
- FIREWALL_OUTBOUND_SUBNETS=192.168.2.0/24,192.168.30.0/24
- HTTPPROXY=on
- HTTPPROXY_LOG=off
- DOT=on
- DOT_PROVIDERS=quad9,cloudflare
- DNS_ADDRESS=1.1.1.1
- DOT_CACHING=off
- PUID=${PUID}
- PGID=${PGID}
restart: always

[R7KT]

@tomdh76 did you ever figure out the solution to this issue? I am having the exact same issue.

[tomdh76]

@R7KT No, I gave up on gluetun and just use qbittorrent and qbittorrent forward docker file in another vm box.

[EMarshal]

For reference, the issue here was probably the trailing slash in QBT_ADDR; QBT_ADDR=http://192.168.30.11:8090/ should be QBT_ADDR=http://192.168.30.11:8090.

[AnonymousX86]

I have created a custom solution: https://github.com/AnonymousX86/qbt-updater-for-gluetun, as charlocharlie/qbittorrent-port-forward-file is unmaintained. The README file explains how to use it.

[TechClusterHQ]

I made https://github.com/TechClusterHQ/qbt-portchecker, which is a docker mod that you can add to the linuxserver.io container using a few env variables

[AnonymousX86]

This is the same logic as my package, except it's a LinuxServer.io mod. Glad to help and will appreciate mentioning (mutually).

[qdm12]

Hello everyone,

The new options VPN_PORT_FORWARDING_UP_COMMAND and VPN_PORT_FORWARDING_DOWN_COMMAND were added just today to Gluetun (latest image and future release v3.40.0). Documentation is here.

@TechClusterHQ @AnonymousX86 @carmatana as it says on the wiki page:

💁 feel free to propose a pull request to add commonly used shell scripts for port forwarding!

I'm happy to add a few (simple, not-too-long) shell script files in the Gluetun image and document them in the Wiki for people to use in their up/down commands.

[pbranly]

Hi
Sorry for the noob question but i have tried to add such option in the docker compose but I don’t see any way to see or get any answer from it
Thanks
Phil

[TechClusterHQ]

Thanks for the release! Since my solution to this problem is packaged as a full on mod for the linuxserver.io container, I don't think it makes sense to put in the readme (except if you want something that is not directly related to the gluetun image, in which case I could PR it in). Ripping the actual script out of the mod is also not a good idea since it also monitors if the port is actually open and forwarded and then restarts qBittorrent if it's not (acting as a healthcheck in a way).

[qdm12]

@pbranly I just tried it with docker run -it --rm --cap-add=NET_ADMIN -e VPN_TYPE=wireguard -e VPN_SERVICE_PROVIDER=protonvpn -e WIREGUARD_PRIVATE_KEY=redacted -e VPN_PORT_FORWARDING=on -e VPN_PORT_FORWARDING_UP_COMMAND="echo up" -e VPN_PORT_FORWARDING_DOWN_COMMAND="echo down" qmcgaw/gluetun and it works fine here, logging 2024-11-12T08:41:12Z INFO [port forwarding] up when port forwarding finishes setting up:

2024-11-12T08:41:08Z INFO [healthcheck] healthy!
2024-11-12T08:41:10Z INFO [dns] DNS server listening on [::]:53
2024-11-12T08:41:10Z INFO [dns] ready
2024-11-12T08:41:11Z INFO [ip getter] Public IP address is 45.87.214.23 (United States, Florida, Miami - source: ipinfo)
2024-11-12T08:41:12Z INFO [vpn] There is a new release v3.39.1 (v3.39.1) created 43 days ago
2024-11-12T08:41:12Z INFO [port forwarding] starting
2024-11-12T08:41:12Z INFO [port forwarding] gateway external IPv4 address is 45.87.214.23
2024-11-12T08:41:12Z INFO [port forwarding] port forwarded is 52237
2024-11-12T08:41:12Z INFO [firewall] setting allowed input port 52237 through interface tun0...
2024-11-12T08:41:12Z INFO [port forwarding] writing port file /tmp/gluetun/forwarded_port
2024-11-12T08:41:12Z INFO [port forwarding] up

And then down when shutdown.

@TechClusterHQ So the idea is to bundle a single utility shell script in the Gluetun image, and just document you can use it for example with VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c /gluetun/scripts/qbittorrent-port-forwarding.up.sh {{PORTS}}

Ripping the actual script out of the mod is also not a good idea since it also monitors if the port is actually open and forwarded and then restarts qBittorrent if it's not (acting as a healthcheck in a way).

If it interacts with the docker socket, yeah better leave it as a separate container, gluetun already has quite a few privileges and mixing VPN/network with docker socket can be kind of dangerous. I remember now qbittorrent needs to be restarted on Gluetun internal vpn restarts, unlike transmission or deluge. In case one day qbittorrent fix their networking reconnect logic, you could then have a script to run from Gluetun and update qbittorrent via its API 😉

[pbranly]

Thanks
But I think I understand the (my) issue.
Your exemple is based on paid subscription
With a protonvpn free, there is no way to have benefit of port forward.
thanks again
Phil

[TechClusterHQ]

@qdm12 sounds like a good plan. I'll leave my mod as a standalone (it's very easy to install anyways) and then consider adding it to the wiki in script form once they fix their networking.

[pbranly]

I am afraid that the free version of protonvpn does not allow port forward
2024-11-12T12:04:36.949519961Z 2024-11-12T13:04:36+01:00 INFO [port forwarding] starting
2024-11-12T12:04:37.113002706Z 2024-11-12T13:04:37+01:00 ERROR [vpn] starting port forwarding service: port forwarding for the first time: getting external IPv4 address: executing remote procedure call: reading from udp connection: read udp 10.2.0.2:41102->10.2.0.1:5351: recvfrom: connection refused - make sure you have +pmp at the end of your OpenVPN username