will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Disable gluetun port forwarding, use NAT-PMP directly in portforward-helper

Browse Source
This commit is contained in:
Will Anderson
2026-04-15 02:19:39 -05:00
parent c2a936f790
commit 6fc0fb2563
1 changed files with 105 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/media/fornax-workers.yaml
+105 -43
View File
@@ -103,15 +103,13 @@ spec:
- name: SERVER_NAMES
value: "US-TX#179"
- name: VPN_PORT_FORWARDING
value: "on"
value: "off"
- name: DOT
value: "off"
- name: DNS_UPSTREAM_RESOLVER_TYPE
value: "plain"
- name: DNS_UPSTREAM_PLAIN_ADDRESSES
value: "10.43.0.10:53"
- name: HEALTH_ICMP_TARGET_IPS
value: "10.2.0.1"
- name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16"
volumeMounts:
@@ -148,29 +146,69 @@ spec:
until wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done
echo "gluetun ready — VPN is up"
# Install curl now that VPN is routing correctly
until apk add -q curl 2>/dev/null; do sleep 5; done
# Install curl and python3 for NAT-PMP port forwarding
until apk add -q curl python3 2>/dev/null; do sleep 5; done
echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
TTL=300
# Request port forwarding via ProtonVPN NAT-PMP (gateway 10.2.0.1, UDP 5351)
# ProtonVPN supports NAT-PMP for port forwarding on p2p-enabled servers
get_natpmp_port() {
python3 - <<'PYEOF'
import socket, struct, time
gateway = "10.2.0.1"
port = 5351
# NAT-PMP external address request (version=0, opcode=0)
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.settimeout(5)
try:
# Request TCP port mapping (version=0, opcode=2, reserved=0, internal_port=0, external_port=0, lifetime=7776000)
req = struct.pack("!BBHHHI", 0, 2, 0, 0, 0, 7776000)
s.sendto(req, (gateway, port))
data, _ = s.recvfrom(256)
if len(data) >= 16:
version, opcode, result, epoch, int_port, ext_port, lifetime = struct.unpack("!BBHIHHH", data[:16])
if result == 0:
print(ext_port)
else:
print(0)
else:
print(0)
except Exception as e:
print(0)
finally:
s.close()
PYEOF
}
echo "Requesting port via NAT-PMP..."
PORT=$(get_natpmp_port)
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
echo "$(date): NAT-PMP assigned port: $PORT"
echo "$PORT" > /tmp/gluetun/forwarded_port
else
echo "$(date): NAT-PMP failed, will retry..."
fi
# Loop: refresh port every 4 minutes (lifetime 7776000s, renewal every 4min for safety)
# Also sync to qBittorrent whenever port is known
LAST_PORT=""
while true; do
if [ -f /tmp/gluetun/forwarded_port ]; then
PORT=$(cat /tmp/gluetun/forwarded_port)
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-d "username=admin&password=adminadmin" >/dev/null 2>&1
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT"
if [ -n "$COORDINATOR_URL" ] && [ -n "$WORKER_ID" ]; then
curl -s -X POST "$COORDINATOR_URL/api/v2/workers/$WORKER_ID/port-lease" \
-H "Content-Type: application/json" \
-d "{\"port\": $PORT, \"ttlSeconds\": $TTL}" >/dev/null 2>&1 || true
fi
PORT=$(get_natpmp_port)
if [ -n "$PORT" ] && [ "$PORT" != "0" ] && [ "$PORT" != "$LAST_PORT" ]; then
echo "$(date): Port: $PORT — syncing to qBittorrent"
echo "$PORT" > /tmp/gluetun/forwarded_port
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-d "username=admin&password=adminadmin" >/dev/null 2>&1
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT"
if [ -n "$COORDINATOR_URL" ] && [ -n "$WORKER_ID" ]; then
curl -s -X POST "$COORDINATOR_URL/api/v2/workers/$WORKER_ID/port-lease" \
-H "Content-Type: application/json" \
-d "{\"port\": $PORT, \"ttlSeconds\": 300}" >/dev/null 2>&1 || true
fi
LAST_PORT="$PORT"
fi
sleep 45
sleep 240
done
env:
- name: COORDINATOR_URL
@@ -340,15 +378,13 @@ spec:
- name: SERVER_NAMES
value: "US-TX#220"
- name: VPN_PORT_FORWARDING
value: "on"
value: "off"
- name: DOT
value: "off"
- name: DNS_UPSTREAM_RESOLVER_TYPE
value: "plain"
- name: DNS_UPSTREAM_PLAIN_ADDRESSES
value: "10.43.0.10:53"
- name: HEALTH_ICMP_TARGET_IPS
value: "10.2.0.1"
- name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16"
volumeMounts:
@@ -380,28 +416,54 @@ spec:
until wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done
echo "gluetun ready — VPN is up"
until apk add -q curl 2>/dev/null; do sleep 5; done
until apk add -q curl python3 2>/dev/null; do sleep 5; done
echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
TTL=300
get_natpmp_port() {
python3 - <<'PYEOF'
import socket, struct
gateway = "10.2.0.1"
port = 5351
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.settimeout(5)
try:
req = struct.pack("!BBHHHI", 0, 2, 0, 0, 0, 7776000)
s.sendto(req, (gateway, port))
data, _ = s.recvfrom(256)
if len(data) >= 16:
version, opcode, result, epoch, int_port, ext_port, lifetime = struct.unpack("!BBHIHHH", data[:16])
print(ext_port if result == 0 else 0)
else:
print(0)
except Exception:
print(0)
finally:
s.close()
PYEOF
}
echo "Requesting port via NAT-PMP..."
PORT=$(get_natpmp_port)
[ -n "$PORT" ] && [ "$PORT" != "0" ] && echo "$(date): NAT-PMP port: $PORT" && echo "$PORT" > /tmp/gluetun/forwarded_port
LAST_PORT=""
while true; do
if [ -f /tmp/gluetun/forwarded_port ]; then
PORT=$(cat /tmp/gluetun/forwarded_port)
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-d "username=admin&password=adminadmin" >/dev/null 2>&1
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT"
if [ -n "$COORDINATOR_URL" ] && [ -n "$WORKER_ID" ]; then
curl -s -X POST "$COORDINATOR_URL/api/v2/workers/$WORKER_ID/port-lease" \
-H "Content-Type: application/json" \
-d "{\"port\": $PORT, \"ttlSeconds\": $TTL}" >/dev/null 2>&1 || true
fi
PORT=$(get_natpmp_port)
if [ -n "$PORT" ] && [ "$PORT" != "0" ] && [ "$PORT" != "$LAST_PORT" ]; then
echo "$(date): Port: $PORT — syncing to qBittorrent"
echo "$PORT" > /tmp/gluetun/forwarded_port
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-d "username=admin&password=adminadmin" >/dev/null 2>&1
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT"
if [ -n "$COORDINATOR_URL" ] && [ -n "$WORKER_ID" ]; then
curl -s -X POST "$COORDINATOR_URL/api/v2/workers/$WORKER_ID/port-lease" \
-H "Content-Type: application/json" \
-d "{\"port\": $PORT, \"ttlSeconds\": 300}" >/dev/null 2>&1 || true
fi
LAST_PORT="$PORT"
fi
sleep 45
sleep 240
done
env:
- name: COORDINATOR_URL