will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch to gluetun native ProtonVPN port forwarding (VPN_PORT_FORWARDING=on)

Browse Source 
Replaces DIY natpmpc sidecar with gluetun's built-in NAT-PMP handling for the protonvpn
provider. The natpmpc UDP response was being dropped by gluetun's firewall since conntrack
doesn't track stateless UDP from the gateway. With VPN_PORT_FORWARDING=on, gluetun handles
the NAT-PMP exchange internally and exposes the port at :8000/v1/openvpn/portforwarded.
Helper sidecar now just polls that endpoint.
This commit is contained in:
Will Anderson
2026-04-11 09:57:07 -05:00
parent 24e308202b
commit e1996d4396
2 changed files with 66 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/media/fornax-workers.yaml
+40 -57
View File
@@ -1,6 +1,6 @@
# Fornax distributed torrent workers — each is a gluetun+qBittorrent pod on a different VPN server
# Worker TX#253: US-TX#253 (95.173.217.29), NAT-PMP enabled
# Worker TX#34: US-TX#34 (146.70.58.130), NAT-PMP enabled
# Worker TX#253: US-TX#253, NAT-PMP via gluetun native ProtonVPN port forwarding
# Worker TX#34: US-TX#34, NAT-PMP via gluetun native ProtonVPN port forwarding
# Both workers share the media-data PVC; each has its own config PVC and VPN credentials
# The Fornax coordinator proxy (TBD) routes work across these workers
@@ -41,8 +41,9 @@ spec:
capabilities:
add: ["NET_ADMIN"]
env:
# Use protonvpn provider so gluetun handles NAT-PMP natively
- name: VPN_SERVICE_PROVIDER
value: "custom"
value: "protonvpn"
- name: VPN_TYPE
value: "wireguard"
- name: WIREGUARD_PRIVATE_KEY
@@ -50,20 +51,17 @@ spec:
secretKeyRef:
name: fornax-worker-tx253-secrets
key: PROTONVPN_PRIVATE_KEY
- name: WIREGUARD_PUBLIC_KEY
value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA="
- name: WIREGUARD_ADDRESSES
value: "10.2.0.2/32"
- name: WIREGUARD_ENDPOINT_IP
value: "95.173.217.29"
- name: WIREGUARD_ENDPOINT_PORT
value: "51820"
# Pin to US-TX#253 from gluetun's built-in ProtonVPN server list
- name: SERVER_NAMES
value: "US-TX#253"
# gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded
- name: VPN_PORT_FORWARDING
value: "on"
- name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16"
- name: FIREWALL_INPUT_PORTS
value: "5351"
ports:
- containerPort: 8888
- containerPort: 8000 # gluetun control server
- containerPort: 8888 # gluetun HTTP proxy
resources:
requests:
memory: 128Mi
@@ -72,41 +70,37 @@ spec:
memory: 512Mi
cpu: 200m
- name: natpmpc-helper
# Port forwarding helper — polls gluetun's control API for the assigned port,
# then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange.
- name: portforward-helper
image: alpine:latest
command:
- sh
- -c
- |
echo "Waiting for VPN to establish before installing packages..."
sleep 30
until apk add -q libnatpmp curl 2>/dev/null; do
echo "apk failed (VPN not ready?), retrying in 10s..."
sleep 10
done
echo "Packages installed, starting NAT-PMP loop"
echo "Waiting for gluetun to assign a forwarded port..."
until apk add -q curl 2>/dev/null; do sleep 5; done
while true; do
OUT=$(natpmpc -a 0 0 udp 60 -g 10.2.0.1 2>&1)
PORT=$(echo "$OUT" | grep -oE 'Mapped public port [0-9]+' | grep -oE '[0-9]+$')
if [ -n "$PORT" ]; then
echo "$(date): Got forwarded port $PORT"
natpmpc -a "$PORT" "$PORT" tcp 60 -g 10.2.0.1 >/dev/null 2>&1
RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null)
PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$')
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-d "username=admin&password=adminadmin" >/dev/null 2>&1
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT"
else
echo "$(date): NAT-PMP failed: $OUT"
echo "$(date): No port yet (gluetun response: $RESP)"
fi
sleep 45
done
resources:
requests:
memory: 32Mi
memory: 16Mi
cpu: 10m
limits:
memory: 64Mi
memory: 32Mi
cpu: 50m
- name: qbittorrent
@@ -198,7 +192,7 @@ spec:
add: ["NET_ADMIN"]
env:
- name: VPN_SERVICE_PROVIDER
value: "custom"
value: "protonvpn"
- name: VPN_TYPE
value: "wireguard"
- name: WIREGUARD_PRIVATE_KEY
@@ -206,19 +200,14 @@ spec:
secretKeyRef:
name: fornax-worker-tx34-secrets
key: PROTONVPN_PRIVATE_KEY
- name: WIREGUARD_PUBLIC_KEY
value: "wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo="
- name: WIREGUARD_ADDRESSES
value: "10.2.0.2/32"
- name: WIREGUARD_ENDPOINT_IP
value: "146.70.58.130"
- name: WIREGUARD_ENDPOINT_PORT
value: "51820"
- name: SERVER_NAMES
value: "US-TX#34"
- name: VPN_PORT_FORWARDING
value: "on"
- name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16"
- name: FIREWALL_INPUT_PORTS
value: "5351"
ports:
- containerPort: 8000
- containerPort: 8888
resources:
requests:
@@ -228,41 +217,35 @@ spec:
memory: 512Mi
cpu: 200m
- name: natpmpc-helper
- name: portforward-helper
image: alpine:latest
command:
- sh
- -c
- |
echo "Waiting for VPN to establish before installing packages..."
sleep 30
until apk add -q libnatpmp curl 2>/dev/null; do
echo "apk failed (VPN not ready?), retrying in 10s..."
sleep 10
done
echo "Packages installed, starting NAT-PMP loop"
echo "Waiting for gluetun to assign a forwarded port..."
until apk add -q curl 2>/dev/null; do sleep 5; done
while true; do
OUT=$(natpmpc -a 0 0 udp 60 -g 10.2.0.1 2>&1)
PORT=$(echo "$OUT" | grep -oE 'Mapped public port [0-9]+' | grep -oE '[0-9]+$')
if [ -n "$PORT" ]; then
echo "$(date): Got forwarded port $PORT"
natpmpc -a "$PORT" "$PORT" tcp 60 -g 10.2.0.1 >/dev/null 2>&1
RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null)
PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$')
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-d "username=admin&password=adminadmin" >/dev/null 2>&1
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT"
else
echo "$(date): NAT-PMP failed: $OUT"
echo "$(date): No port yet (gluetun response: $RESP)"
fi
sleep 45
done
resources:
requests:
memory: 32Mi
memory: 16Mi
cpu: 10m
limits:
memory: 64Mi
memory: 32Mi
cpu: 50m
- name: qbittorrent
servers/legion/k8s/media/gluetun-qbittorrent.yaml
+26 -38
View File
@@ -1,5 +1,7 @@
# gluetun + qBittorrent — all torrent traffic routed through ProtonVPN WireGuard
# gluetun runs as the VPN container; qBittorrent shares its network namespace (same pod)
# Port forwarding via gluetun's native ProtonVPN support (VPN_PORT_FORWARDING=on)
# — gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded
apiVersion: apps/v1
kind: Deployment
metadata:
@@ -27,16 +29,15 @@ spec:
securityContext:
privileged: true
containers:
# VPN container — must come first so network is up before qBittorrent starts
# VPN container — protonvpn provider with native port forwarding support
- name: gluetun
image: ghcr.io/qdm12/gluetun:latest
securityContext:
capabilities:
add: ["NET_ADMIN"]
env:
# Use custom provider pinned to US-IL#267 — NAT-PMP port forwarding enabled
- name: VPN_SERVICE_PROVIDER
value: "custom"
value: "protonvpn"
- name: VPN_TYPE
value: "wireguard"
- name: WIREGUARD_PRIVATE_KEY
@@ -44,22 +45,18 @@ spec:
secretKeyRef:
name: media-secrets
key: PROTONVPN_PRIVATE_KEY
# US-IL#267 server — generated from ProtonVPN portal with NAT-PMP=on
- name: WIREGUARD_PUBLIC_KEY
value: "qT0lxDVbWEIyrL2A40FfCXRlUALvnryRz2aQdD6gUDs="
- name: WIREGUARD_ADDRESSES
value: "10.2.0.2/32"
- name: WIREGUARD_ENDPOINT_IP
value: "89.187.180.40"
- name: WIREGUARD_ENDPOINT_PORT
value: "51820"
# Pin to US-IL#267 (NAT-PMP enabled per ProtonVPN portal)
- name: SERVER_NAMES
value: "US-IL#267"
# gluetun handles NAT-PMP exchange natively for protonvpn provider
- name: VPN_PORT_FORWARDING
value: "on"
# Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
- name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16"
- name: FIREWALL_INPUT_PORTS
value: "5351"
ports:
- containerPort: 8888 # gluetun HTTP proxy (unused but required)
- containerPort: 8000 # gluetun control server
- containerPort: 8888 # gluetun HTTP proxy
resources:
requests:
memory: 128Mi
@@ -68,46 +65,37 @@ spec:
memory: 512Mi
cpu: 200m
# NAT-PMP helper — requests a forwarded port from ProtonVPN gateway every 45s
# and updates qBittorrent's listen port so peers can connect inbound
- name: natpmpc-helper
# Port forwarding helper — polls gluetun's control API for the assigned port,
# then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange.
- name: portforward-helper
image: alpine:latest
command:
- sh
- -c
- |
echo "Waiting for VPN to establish before installing packages..."
sleep 30
until apk add -q libnatpmp curl 2>/dev/null; do
echo "apk failed (VPN not ready?), retrying in 10s..."
sleep 10
done
echo "Packages installed, starting NAT-PMP loop"
echo "Waiting for gluetun port forwarding to initialize..."
until apk add -q curl 2>/dev/null; do sleep 5; done
while true; do
# Request port forwarding from ProtonVPN NAT-PMP gateway
OUT=$(natpmpc -a 0 0 udp 60 -g 10.2.0.1 2>&1)
PORT=$(echo "$OUT" | grep -oE 'Mapped public port [0-9]+' | grep -oE '[0-9]+$')
if [ -n "$PORT" ]; then
echo "$(date): Got forwarded port $PORT"
# Also request TCP mapping for the same port
natpmpc -a "$PORT" "$PORT" tcp 60 -g 10.2.0.1 >/dev/null 2>&1
# Update qBittorrent listen port (form-encoded: json=<json_string>)
SID=$(curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-d "username=admin&password=adminadmin" 2>/dev/null)
RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null)
PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$')
if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
echo "$(date): Forwarded port: $PORT — updating qBittorrent"
curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-d "username=admin&password=adminadmin" >/dev/null 2>&1
curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
echo "$(date): qBittorrent listen port set to $PORT"
else
echo "$(date): NAT-PMP failed: $OUT"
echo "$(date): No port yet (gluetun response: $RESP)"
fi
sleep 45
done
resources:
requests:
memory: 32Mi
memory: 16Mi
cpu: 10m
limits:
memory: 64Mi
memory: 32Mi
cpu: 50m
# qBittorrent — shares gluetun's network namespace, all traffic through VPN