qBittorrent not Connectable

[chesterjazzman]

I'm running qBittorrent under gluetun:latest. I have a VPN provider that gives me a public IP (not NATed) so I generally only need to open the torrenting port through the VPN interface, and I'm connectable. No port forwarding necessary. I have what I think is the appropriate environment variable set. Please let me know if I've done something wrong.

The reason I think something is wrong is my trackers tell me I'm not connectable, and I don't see the port opened in gluetun's firewall config.

log:

========================================
========================================
=============== gluetun ================
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================

Running version latest built on 2024-05-18T18:08:57.405Z (commit 4218dba)

🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
🐛 Bug? https://github.com/qdm12/gluetun/issues/new
✨ New feature? https://github.com/qdm12/gluetun/issues/new
☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
💻 Email? [email protected]
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2024-05-30T15:47:56Z INFO [routing] default route found: interface eth0, gateway 172.23.0.1, assigned IP 172.23.0.3 and family v4
2024-05-30T15:47:56Z INFO [routing] local ethernet link found: eth0
2024-05-30T15:47:56Z INFO [routing] local ipnet found: 172.23.0.0/16
2024-05-30T15:47:56Z INFO [firewall] enabling...
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --policy INPUT DROP
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --policy OUTPUT DROP
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --policy FORWARD DROP
2024-05-30T15:47:56Z DEBUG [firewall] ip6tables --policy INPUT DROP
2024-05-30T15:47:56Z DEBUG [firewall] ip6tables --policy OUTPUT DROP
2024-05-30T15:47:56Z DEBUG [firewall] ip6tables --policy FORWARD DROP
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --append INPUT -i lo -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] ip6tables --append INPUT -i lo -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --append OUTPUT -o lo -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] ip6tables --append OUTPUT -o lo -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] ip6tables --append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] ip6tables --append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --append OUTPUT -o eth0 -s 172.23.0.3 -d 172.23.0.0/16 -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] ip6tables --append OUTPUT -o eth0 -d ff02::1:ff/104 -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --append INPUT -i eth0 -d 172.23.0.0/16 -j ACCEPT
2024-05-30T15:47:56Z INFO [firewall] enabled successfully
2024-05-30T15:47:56Z INFO [storage] creating /gluetun/servers.json with 19425 hardcoded servers
2024-05-30T15:47:56Z DEBUG [netlink] IPv6 is not supported after searching 7 routes
2024-05-30T15:47:56Z INFO Alpine version: 3.19.1
2024-05-30T15:47:56Z INFO OpenVPN 2.5 version: 2.5.8
2024-05-30T15:47:56Z INFO OpenVPN 2.6 version: 2.6.8
2024-05-30T15:47:56Z INFO Unbound version: 1.20.0
2024-05-30T15:47:56Z INFO IPtables version: v1.8.10
2024-05-30T15:47:56Z INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: custom
|   |   └── Server selection settings:
|   |       ├── VPN type: openvpn
|   |       └── OpenVPN server selection settings:
|   |           ├── Protocol: UDP
|   |           └── Custom configuration file: /gluetun/custom.conf
|   └── OpenVPN settings:
|       ├── OpenVPN version: 2.6
|       ├── User: [not set]
|       ├── Password: [not set]
|       ├── Custom configuration file: /gluetun/custom.conf
|       ├── Network interface: tun0
|       ├── Run OpenVPN as: root
|       └── Verbosity level: 1
├── DNS settings:
|   ├── Keep existing nameserver(s): no
|   ├── DNS server address to use: 127.0.0.1
|   └── DNS over TLS settings:
|       ├── Enabled: yes
|       ├── Update period: every 24h0m0s
|       ├── Unbound settings:
|       |   ├── Authoritative servers:
|       |   |   └── cloudflare
|       |   ├── Caching: yes
|       |   ├── IPv6: no
|       |   ├── Verbosity level: 1
|       |   ├── Verbosity details level: 0
|       |   ├── Validation log level: 0
|       |   ├── System user: root
|       |   └── Allowed networks:
|       |       ├── 0.0.0.0/0
|       |       └── ::/0
|       └── DNS filtering settings:
|           ├── Block malicious: yes
|           ├── Block ads: no
|           ├── Block surveillance: no
|           └── Blocked IP networks:
|               ├── 127.0.0.1/8
|               ├── 10.0.0.0/8
|               ├── 172.16.0.0/12
|               ├── 192.168.0.0/16
|               ├── 169.254.0.0/16
|               ├── ::1/128
|               ├── fc00::/7
|               ├── fe80::/10
|               ├── ::ffff:127.0.0.1/104
|               ├── ::ffff:10.0.0.0/104
|               ├── ::ffff:169.254.0.0/112
|               ├── ::ffff:172.16.0.0/108
|               └── ::ffff:192.168.0.0/112
├── Firewall settings:
|   ├── Enabled: yes
|   └── VPN input ports:
|       └── 49201
├── Log settings:
|   └── Log level: debug
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: cloudflare.com:443
|   ├── Duration to wait after success: 5s
|   ├── Read header timeout: 100ms
|   ├── Read timeout: 500ms
|   └── VPN wait durations:
|       ├── Initial duration: 6s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   └── Logging: yes
├── OS Alpine settings:
|   ├── Process UID: 1000
|   └── Process GID: 1000
├── Public IP settings:
|   ├── Fetching: every 12h0m0s
|   ├── IP file path: /tmp/gluetun/ip
|   └── Public IP data API: ipinfo
└── Version settings:
    └── Enabled: yes
2024-05-30T15:47:56Z INFO [routing] default route found: interface eth0, gateway 172.23.0.1, assigned IP 172.23.0.3 and family v4
2024-05-30T15:47:56Z DEBUG [routing] ip rule add from 172.23.0.3/32 lookup 200 pref 100
2024-05-30T15:47:56Z INFO [routing] adding route for 0.0.0.0/0
2024-05-30T15:47:56Z DEBUG [routing] ip route replace 0.0.0.0/0 via 172.23.0.1 dev eth0 table 200
2024-05-30T15:47:56Z INFO [firewall] setting allowed subnets...
2024-05-30T15:47:56Z INFO [routing] default route found: interface eth0, gateway 172.23.0.1, assigned IP 172.23.0.3 and family v4
2024-05-30T15:47:56Z DEBUG [routing] ip rule add to 172.23.0.0/16 lookup 254 pref 98
2024-05-30T15:47:56Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2024-05-30T15:47:56Z INFO [dns] using plaintext DNS at address 1.1.1.1
2024-05-30T15:47:56Z INFO [http server] http server listening on 0.0.0.0:8000
2024-05-30T15:47:56Z INFO [firewall] allowing VPN connection...
2024-05-30T15:47:56Z INFO [healthcheck] listening on 127.0.0.1:9999
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --append OUTPUT -d 198.167.192.49 -o eth0 -p udp -m udp --dport 1194 -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] iptables-legacy --append OUTPUT -o tun0 -j ACCEPT
2024-05-30T15:47:56Z DEBUG [firewall] ip6tables --append OUTPUT -o tun0 -j ACCEPT
2024-05-30T15:48:01Z INFO [healthcheck] healthy!

~ docker exec -it gluetun sh
/ # iptables -S
# Warning: iptables-legacy tables present, use iptables-legacy to see them
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
/ # iptables-legacy -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 172.23.0.0/16 -i eth0 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -s 172.23.0.3/32 -d 172.23.0.0/16 -o eth0 -j ACCEPT
-A OUTPUT -d 198.167.192.49/32 -o eth0 -p udp -m udp --dport 1194 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
/ # 

config:

services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    volumes:
      - /gluetun/vpn.conf:/gluetun/custom.conf:ro
    environment:
      - LOG_LEVEL=debug
      - VPN_SERVICE_PROVIDER=custom
      - VPN_TYPE=openvpn
      - OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
      - FIREWALL_VPN_INPUT_PORTS=49201
    ports:
      - 8081:8081 #qb
    restart: unless-stopped

  qb:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qb
    network_mode: "service:gluetun"
    environment:
      - PUID=1000
      - PGID=1007 
      - TZ=America/New_York
      - WEBUI_PORT=8081
      - TORRENTING_PORT=49201
    #ports: #commented out, network_mode
      #- 49201:49201/tcp
      #- 49201:49201/udp
      #- 8081:8081/tcp
    volumes:
      - /qbittorrent/config:/config
      - /mnt/data:/mnt/data
    restart: unless-stopped

[chesterjazzman]

I changed my conf to wireguard, and the FIREWALL_VPN_INPUT_PORTS environment variable worked exactly as expected. I'm now connectable. I am not sure what's going on with OpenVPN. But I'm glad I got it working.