From e1996d43967d3a7c8b762a9767c0b7bd94205dd2 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Sat, 11 Apr 2026 09:57:07 -0500 Subject: [PATCH] Switch to gluetun native ProtonVPN port forwarding (VPN_PORT_FORWARDING=on) Replaces DIY natpmpc sidecar with gluetun's built-in NAT-PMP handling for the protonvpn provider. The natpmpc UDP response was being dropped by gluetun's firewall since conntrack doesn't track stateless UDP from the gateway. With VPN_PORT_FORWARDING=on, gluetun handles the NAT-PMP exchange internally and exposes the port at :8000/v1/openvpn/portforwarded. Helper sidecar now just polls that endpoint. --- servers/legion/k8s/media/fornax-workers.yaml | 97 ++++++++----------- .../legion/k8s/media/gluetun-qbittorrent.yaml | 64 +++++------- 2 files changed, 66 insertions(+), 95 deletions(-) diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml index 09041d2..0b22912 100644 --- a/servers/legion/k8s/media/fornax-workers.yaml +++ b/servers/legion/k8s/media/fornax-workers.yaml @@ -1,6 +1,6 @@ # Fornax distributed torrent workers — each is a gluetun+qBittorrent pod on a different VPN server -# Worker TX#253: US-TX#253 (95.173.217.29), NAT-PMP enabled -# Worker TX#34: US-TX#34 (146.70.58.130), NAT-PMP enabled +# Worker TX#253: US-TX#253, NAT-PMP via gluetun native ProtonVPN port forwarding +# Worker TX#34: US-TX#34, NAT-PMP via gluetun native ProtonVPN port forwarding # Both workers share the media-data PVC; each has its own config PVC and VPN credentials # The Fornax coordinator proxy (TBD) routes work across these workers @@ -41,8 +41,9 @@ spec: capabilities: add: ["NET_ADMIN"] env: + # Use protonvpn provider so gluetun handles NAT-PMP natively - name: VPN_SERVICE_PROVIDER - value: "custom" + value: "protonvpn" - name: VPN_TYPE value: "wireguard" - name: WIREGUARD_PRIVATE_KEY @@ -50,20 +51,17 @@ spec: secretKeyRef: name: fornax-worker-tx253-secrets key: PROTONVPN_PRIVATE_KEY - - name: WIREGUARD_PUBLIC_KEY - value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA=" - - name: WIREGUARD_ADDRESSES - value: "10.2.0.2/32" - - name: WIREGUARD_ENDPOINT_IP - value: "95.173.217.29" - - name: WIREGUARD_ENDPOINT_PORT - value: "51820" + # Pin to US-TX#253 from gluetun's built-in ProtonVPN server list + - name: SERVER_NAMES + value: "US-TX#253" + # gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded + - name: VPN_PORT_FORWARDING + value: "on" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" - - name: FIREWALL_INPUT_PORTS - value: "5351" ports: - - containerPort: 8888 + - containerPort: 8000 # gluetun control server + - containerPort: 8888 # gluetun HTTP proxy resources: requests: memory: 128Mi @@ -72,41 +70,37 @@ spec: memory: 512Mi cpu: 200m - - name: natpmpc-helper + # Port forwarding helper — polls gluetun's control API for the assigned port, + # then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange. + - name: portforward-helper image: alpine:latest command: - sh - -c - | - echo "Waiting for VPN to establish before installing packages..." - sleep 30 - until apk add -q libnatpmp curl 2>/dev/null; do - echo "apk failed (VPN not ready?), retrying in 10s..." - sleep 10 - done - echo "Packages installed, starting NAT-PMP loop" + echo "Waiting for gluetun to assign a forwarded port..." + until apk add -q curl 2>/dev/null; do sleep 5; done while true; do - OUT=$(natpmpc -a 0 0 udp 60 -g 10.2.0.1 2>&1) - PORT=$(echo "$OUT" | grep -oE 'Mapped public port [0-9]+' | grep -oE '[0-9]+$') - if [ -n "$PORT" ]; then - echo "$(date): Got forwarded port $PORT" - natpmpc -a "$PORT" "$PORT" tcp 60 -g 10.2.0.1 >/dev/null 2>&1 + RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null) + PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$') + if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then + echo "$(date): Forwarded port: $PORT — updating qBittorrent" curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ -d "username=admin&password=adminadmin" >/dev/null 2>&1 curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 echo "$(date): qBittorrent listen port set to $PORT" else - echo "$(date): NAT-PMP failed: $OUT" + echo "$(date): No port yet (gluetun response: $RESP)" fi sleep 45 done resources: requests: - memory: 32Mi + memory: 16Mi cpu: 10m limits: - memory: 64Mi + memory: 32Mi cpu: 50m - name: qbittorrent @@ -198,7 +192,7 @@ spec: add: ["NET_ADMIN"] env: - name: VPN_SERVICE_PROVIDER - value: "custom" + value: "protonvpn" - name: VPN_TYPE value: "wireguard" - name: WIREGUARD_PRIVATE_KEY @@ -206,19 +200,14 @@ spec: secretKeyRef: name: fornax-worker-tx34-secrets key: PROTONVPN_PRIVATE_KEY - - name: WIREGUARD_PUBLIC_KEY - value: "wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo=" - - name: WIREGUARD_ADDRESSES - value: "10.2.0.2/32" - - name: WIREGUARD_ENDPOINT_IP - value: "146.70.58.130" - - name: WIREGUARD_ENDPOINT_PORT - value: "51820" + - name: SERVER_NAMES + value: "US-TX#34" + - name: VPN_PORT_FORWARDING + value: "on" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" - - name: FIREWALL_INPUT_PORTS - value: "5351" ports: + - containerPort: 8000 - containerPort: 8888 resources: requests: @@ -228,41 +217,35 @@ spec: memory: 512Mi cpu: 200m - - name: natpmpc-helper + - name: portforward-helper image: alpine:latest command: - sh - -c - | - echo "Waiting for VPN to establish before installing packages..." - sleep 30 - until apk add -q libnatpmp curl 2>/dev/null; do - echo "apk failed (VPN not ready?), retrying in 10s..." - sleep 10 - done - echo "Packages installed, starting NAT-PMP loop" + echo "Waiting for gluetun to assign a forwarded port..." + until apk add -q curl 2>/dev/null; do sleep 5; done while true; do - OUT=$(natpmpc -a 0 0 udp 60 -g 10.2.0.1 2>&1) - PORT=$(echo "$OUT" | grep -oE 'Mapped public port [0-9]+' | grep -oE '[0-9]+$') - if [ -n "$PORT" ]; then - echo "$(date): Got forwarded port $PORT" - natpmpc -a "$PORT" "$PORT" tcp 60 -g 10.2.0.1 >/dev/null 2>&1 + RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null) + PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$') + if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then + echo "$(date): Forwarded port: $PORT — updating qBittorrent" curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ -d "username=admin&password=adminadmin" >/dev/null 2>&1 curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 echo "$(date): qBittorrent listen port set to $PORT" else - echo "$(date): NAT-PMP failed: $OUT" + echo "$(date): No port yet (gluetun response: $RESP)" fi sleep 45 done resources: requests: - memory: 32Mi + memory: 16Mi cpu: 10m limits: - memory: 64Mi + memory: 32Mi cpu: 50m - name: qbittorrent diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml index 70d5f9c..0a268b3 100644 --- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml +++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml @@ -1,5 +1,7 @@ # gluetun + qBittorrent — all torrent traffic routed through ProtonVPN WireGuard # gluetun runs as the VPN container; qBittorrent shares its network namespace (same pod) +# Port forwarding via gluetun's native ProtonVPN support (VPN_PORT_FORWARDING=on) +# — gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded apiVersion: apps/v1 kind: Deployment metadata: @@ -27,16 +29,15 @@ spec: securityContext: privileged: true containers: - # VPN container — must come first so network is up before qBittorrent starts + # VPN container — protonvpn provider with native port forwarding support - name: gluetun image: ghcr.io/qdm12/gluetun:latest securityContext: capabilities: add: ["NET_ADMIN"] env: - # Use custom provider pinned to US-IL#267 — NAT-PMP port forwarding enabled - name: VPN_SERVICE_PROVIDER - value: "custom" + value: "protonvpn" - name: VPN_TYPE value: "wireguard" - name: WIREGUARD_PRIVATE_KEY @@ -44,22 +45,18 @@ spec: secretKeyRef: name: media-secrets key: PROTONVPN_PRIVATE_KEY - # US-IL#267 server — generated from ProtonVPN portal with NAT-PMP=on - - name: WIREGUARD_PUBLIC_KEY - value: "qT0lxDVbWEIyrL2A40FfCXRlUALvnryRz2aQdD6gUDs=" - - name: WIREGUARD_ADDRESSES - value: "10.2.0.2/32" - - name: WIREGUARD_ENDPOINT_IP - value: "89.187.180.40" - - name: WIREGUARD_ENDPOINT_PORT - value: "51820" + # Pin to US-IL#267 (NAT-PMP enabled per ProtonVPN portal) + - name: SERVER_NAMES + value: "US-IL#267" + # gluetun handles NAT-PMP exchange natively for protonvpn provider + - name: VPN_PORT_FORWARDING + value: "on" # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API) - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" - - name: FIREWALL_INPUT_PORTS - value: "5351" ports: - - containerPort: 8888 # gluetun HTTP proxy (unused but required) + - containerPort: 8000 # gluetun control server + - containerPort: 8888 # gluetun HTTP proxy resources: requests: memory: 128Mi @@ -68,46 +65,37 @@ spec: memory: 512Mi cpu: 200m - # NAT-PMP helper — requests a forwarded port from ProtonVPN gateway every 45s - # and updates qBittorrent's listen port so peers can connect inbound - - name: natpmpc-helper + # Port forwarding helper — polls gluetun's control API for the assigned port, + # then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange. + - name: portforward-helper image: alpine:latest command: - sh - -c - | - echo "Waiting for VPN to establish before installing packages..." - sleep 30 - until apk add -q libnatpmp curl 2>/dev/null; do - echo "apk failed (VPN not ready?), retrying in 10s..." - sleep 10 - done - echo "Packages installed, starting NAT-PMP loop" + echo "Waiting for gluetun port forwarding to initialize..." + until apk add -q curl 2>/dev/null; do sleep 5; done while true; do - # Request port forwarding from ProtonVPN NAT-PMP gateway - OUT=$(natpmpc -a 0 0 udp 60 -g 10.2.0.1 2>&1) - PORT=$(echo "$OUT" | grep -oE 'Mapped public port [0-9]+' | grep -oE '[0-9]+$') - if [ -n "$PORT" ]; then - echo "$(date): Got forwarded port $PORT" - # Also request TCP mapping for the same port - natpmpc -a "$PORT" "$PORT" tcp 60 -g 10.2.0.1 >/dev/null 2>&1 - # Update qBittorrent listen port (form-encoded: json=) - SID=$(curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ - -d "username=admin&password=adminadmin" 2>/dev/null) + RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null) + PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$') + if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then + echo "$(date): Forwarded port: $PORT — updating qBittorrent" + curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ + -d "username=admin&password=adminadmin" >/dev/null 2>&1 curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1 echo "$(date): qBittorrent listen port set to $PORT" else - echo "$(date): NAT-PMP failed: $OUT" + echo "$(date): No port yet (gluetun response: $RESP)" fi sleep 45 done resources: requests: - memory: 32Mi + memory: 16Mi cpu: 10m limits: - memory: 64Mi + memory: 32Mi cpu: 50m # qBittorrent — shares gluetun's network namespace, all traffic through VPN