Gluetun VPN portforwarding with ProtonVPN

Hi all,

I’m starting to route a qBittorent/ aMule instance through Gluetun VPN container and ProtonVPN that seems to be running (downloads are happening) but don’t know how to properly portforward, since I get a random port every container start.

  • Is there a way to tell the servers/ containers to use the port that is open? (i’ve seen some guys citing scripts but not really sure how to use them)
  • If I have multiple services that need open ports (qBittorrent and aMule), is it possible to open it for all of them and how can I do it?

EDIT: setting openport with qBit in Binhex qBittorrentVPN is easy as cakes (Q31 here documentation/docker/faq/vpn.md at master · binhex/documentation · GitHub)

Problem is with aMule that I’m not sure how to route through qBit with a different port so I’m still trying Gluetun.
With the following script I’m able to update aMule port and restart the container.
Problem is that Gluetun doesn’t have the updated port passed to aMule so it can’t actually use them.

# Run curl to get the port forwarded and extract the port value
port=$(curl -s http://localhost:8000/v1/openvpn/portforwarded | jq -r '.port')
# Check if the port is different from the one in amule.conf
if [ "$port" != "$(grep -oP 'Port\s*=\s*\K\d+' /mnt/user/appdata/aMule/amule.conf)" ] || [ "$port" != "$(grep -oP 'UDPPort\s*=\s*\K\d+' /mnt/user/appdata/aMule/amule.conf)" ]; then
# Update the port in amule.conf
sed -i "s/^Port\s*=.*/Port = $port/" /mnt/user/appdata/aMule/amule.conf
sed -i "s/^UDPPort\s*=.*/UDPPort = $port/" /mnt/user/appdata/aMule/amule.conf
# Restart amule docker container
docker restart amule
fi

One fairly simple way to do this would be to install one of the binhex vpn containers(deluge, qbittorrent…) and route the apps you want on the VPN to use that container’s network as it’s network.

Edit: Found a guide to exactly this if you want to try that route.
https://www.reddit.com/r/unRAID/comments/m7wn5j/guide\_routing\_containers\_through\_your\_vpns/

Back when I ran everything on the metal, I used a script that waited until a minute or two after system start up, checked what the forwarded port was from the VPN, then started my torrent client with the port specified. I then had another script that ran every 5 minutes to check that the ports still matched in case either the VPN or torrent client restarted for whatever reason. That’s trickier to do with docker containers, but I did find this Reddit post where someone in the comments explains a way to update the port through an API call. You should be able to write a script that checks what the forwarded port is and then runs the API call to update qBittorrent without too much trouble. You won’t be able to bind the same port to multiple programs as far as I know.

Thanks for the reply, I am actually already running a qbittorentvpn container with NordVPN but neither the container nor the provider allow for port forwarding as far as I understand.

That’s the reason why I am trying to switch to Gluetun and Protonvpn, so to have port forwarding but I am still not clear how to do it…

Thanks for the reply, I will try to figure out a way to write a script (not really sure how to do it in Unraid as I am very much a noob).

When you say you can’t bind multiple programs to the same port you mean there is no way to have portforwarding available to different download clients?

Thanks

In that case you could just change qbittorrentvpn to use ProtonVPN instead of Nord and then follow that guide for any other containers you want to use that VPN connection.I’ve only used PIA so I’m not 100% on ProtonVPN but I only open ports 43 for DNS and 1337 as that’s the port the server I’m using uses.

In unRAID, you’d use the user scripts plugin. You can use that to run scripts within docker containers by doing docker exec [container-name] ./[script-name]. You could write the script entirely within the user scripts plugin, but I think it’s probably less confusing to run the actual script within the container and just use user scripts to call it.

It turns out that getting the VPN forwarded port might be more complicated than I thought it was. When I did it, I was using my provider’s Linux client, so a single command would spit out the forwarded port. Looking at the scripts qbittorrentvpn uses to get the port, it’s really not as simple as that. Now having said that, that work might already be done for you, because although the scripts qbittorrentvpn uses aren’t so simple, they’re already written. You should check what scripts are available in Gluetun because it might already do what you need. It might even already be writing the forwarded port to some temp file that you can just pull it from. I’m not sure because I don’t use Gluetun, so I can’t check very easily.

When you say you can’t bind multiple programs to the same port you mean there is no way to have portforwarding available to different download clients?

I has assumed that Proton, like the service I use, only allows one public port, but according to a comment here, Proton allows up to 5 public ports. If that was accurate and still works, you should be able to get up to 5 things connectable. But yeah, one port per piece of software.

It will probably take some tinkering to get port forwarding working, but you should be able to do it. Like I said, checking what Gluetun is already doing in terms of ports will help and you can build on that.

Personally I use this

It’s very easy to setup.

If you don’t want to bother with an additional Docker image, you can always copy paste the script and adapt it yourself.

Sorry might be too newbie to fully understand if this answers my question, but the issue I’m having is to bind (?) the random port that protonvpn forwards every time it starts to the relevant one my container uses (at least one, hopefully both qbit and amule) so that I get the benefit of port forwarding.

If it’s in the guide you linked can you help me understand it? I am at the point that I have successfully routed qbit/ amule through gluetun (without port forwarding)

So thanks for your comment I think I’m getting somewhere. With the following script I am able to grab the port forwarded by Gluetun, update aMule and restart it so it uses the new ports.

Problem is that the new port is not opened in Gluetun for the container so it doesn’t see it :frowning: Any suggestions?

Run curl to get the port forwarded and extract the port value

port=$(curl -s http://localhost:8000/v1/openvpn/portforwarded | jq -r ‘.port’)

Check if the port is different from the one in amule.conf

if [ “$port” != “$(grep -oP ‘Port\s*=\s*\K\d+’ /mnt/user/appdata/aMule/amule.conf)” ] || [ “$port” != “$(grep -oP ‘UDPPort\s*=\s*\K\d+’ /mnt/user/appdata/aMule/amule.conf)” ]; then

Update the port in amule.conf

sed -i “s/^Port\s*=.*/Port = $port/” /mnt/user/appdata/aMule/amule.conf

sed -i “s/^UDPPort\s*=.*/UDPPort = $port/” /mnt/user/appdata/aMule/amule.conf

Restart amule docker container

docker restart amule

fi

I’m thinking you are worrying about the port you see in the settings of qbittorrent which you shouldn’t have to do anything with. You should only have to have open the port the server you connect to uses which should be static, and it sounds like it’s already connecting for you.

Since the container traffic is using the VPN tunnel, your router has no role in port forwarding. It’s all being done through the VPN tunnel.

The qbittorrentvpn container automatically updates the torrent client to use the random public port and then checks every so often that the port still matches. However, I don’t think Proton is supported for that.

EDIT: no, Proton is supported, so the port will update automatically. The scripts used by qbittorrentvpn to update the port might help you get port forwarding working for aMule since half the work (the part that checks what ports are forwarded) is already done, although you’d probably have to modify the scripts a bit since they’re probably assuming there’s only one port forwarded.

I just noticed you mentioned using Gluetun as well. Is there a reason for 2 VPN containers? The qbittorrent container is already routing everything through your VPN. Are you then routing that through Gluetun?

Thanks! So I’ve managed to setup Binhex qbittorentvpn to grap the portforwarded and it’s very easy with ProtonVPN, highly suggested to everyone that only needs qBit as it’s just a matter of updating the docker config!!

I’m not sure for the other service I have (aMule) that needs a different port forwarded yet and I’m still trying with Gluetun (at the cost of having 2 different containers). It’s unfortunately a bit old it seems and not supported as docker by big names