Skip to content

Deluge with GlueTUN VPN in Docker on a Synology NAS

Last updated on 28 December 2023

Please note if you are using DSM7.2 or higher you should use the Container Manager version of this guide from the menu.
This guide has reached the end of its updates as most people are now on the latest DSM update - This guide is correct as of 08/12/2023 however no further updates will be added.
Important or Recent Updates
Historic UpdatesDate
New guide23/09/2022
Fixed a typo in the yaml ‘vpngluetun’ to ‘gluetun’26/09/2022
Added the synobridge network to the VPN container07/10/2022
Added depends_on to the compose file to help with the container stack coming online at boot.18/10/2022
Removed requirement to use VPN Package06/11/2022
Amended compose file for enabling or disabling the built-in proxy09/12/2022
Added note to the FAQ about how to Update the containers06/01/2023
Added additional step to force Deluge to use the tun0 interface 06/02/2023
Added firewall exception for network subnet22/02/2023
Added firewall exception for ‘synobridge’ subnet as this seems to be yet another random thing that works for some and not others!31/03/2023
Compose version number removed and image updated in line with amendment09/04/2023
Amended the path to save the compose file – this is for security, so the container has no access to the file contents.14/04/2023
Added watchtower labels to the compose to allow updates and changed the proxies to off by default06/05/2023
Removed the Watchtower ‘Depends On’ Labels as they do not successfully update the GlueTUN container. Added an Exclusion label to the GlueTUN container, so it can just be manually updated.11/05/2023
Update includes: Firewall Input Ports for when your provider offers port forwarding, also a note in relation to volumes and added PUID/PGID settings for GlueTUN14/06/2023
Update for Wireguard Kernel Module Install which reduces overall CPU usage for Wireguard connections
Please note if you previously followed this guide you can follow the new section to update your existing set-up.

Added Health checks to dependent containers
25/09/2023
Historic Updates

What are Deluge and GlueTUN?

Deluge is a lightweight torrent downloader, it has a number of built-in plugins to help organise your downloads and a full web interface, GlueTUN is the Docker container that has pre-configured VPN connections for numerous VPN providers.

Before you start check the GlueTUN Wiki to see if your provider is on the supported list on the left-hand side.

Also, if you are yet to choose a provider have a look at the Reddit list of recommended suppliers as could save you a headache when trying to seed. I currently use AirVPN which has nice easy port forwarding unlike some others. This is my affiliate link if you fancy signing up.

Let’s Begin

In this guide I will take you through the steps to get Deluge up and running in Docker and a separate GlueTUN VPN container. By having a separate container for the VPN connection we can use it in the future for other applications such as Prowlarr, this is useful if you have torrent indexers blocked in your country.

As the Synology DSM GUI does not support some of the functions we need for this tutorial we will be using Docker Compose. This is not as complicated as it might seem!

In order for you to successfully use this guide please complete the three preceding guides

Folder Setup

Let’s start by getting a couple of folders set up for the containers to use. Open up Filestation and within the /docker share create a folder called ‘deluge’ and one called ‘gluetun’

Setting up the start up script

Open up Control Panel and then click on Task Scheduler

Next click on Create, Triggered Task then User Defined Script.

Now enter a name for the script – you can call it anything you like. The User must be ‘root’ and ‘Boot-up’ for the Event.

On the Task Settings tab copy and paste the code below in the ‘User-Defined script’ section. It will look like screenshot.

Bash
#!/bin/sh -e

insmod /lib/modules/tun.ko

You can now press OK and agree to the warning message. Next run the script which will enable the TUN device.

You can now move on to the next step.

Wireguard Kernel Module
(Recommended for Performance & Reduced CPU Resource)

The default Gluetun Wireguard setup uses a ‘Userspace’ implementation of Wireguard which normally should not use much from a CPU resource perspective. However, on Synology it tends to require high CPU utilisation. For example a 40MiB download via qBittorrent uses up to 176% in CPU (1.7 Cores) on my 1821+.

By installing the appropriate Kernel Module this reduces down to 1 or 2% which over time would add up from an electric usage perspective and free up the CPU for other tasks.

BlackVoid.club have put together a Kernel Module for Synology which allows Gluetun to use the lower level Kernel to perform Wireguard duties make sure you drop them a thanks as this would not be possible without them!

While on first glances it looks like a long installation process the page details a number of methods. I recommend having a read taking note of warnings and also if you want to build your own model it tells you how.

The TLDR is below.

Step 1 – Find your model of NAS under the correct DSM version section (If you are following this guide it will be 7.0/1) and download the pre compiled .spk file
Step 2 – Head into Package Manager and click ‘Manual Install’ on the top right and install the .spk file and untick the box to run after install
Step 3 – Reboot (Not always required for DSM7.1 and lower)
Step 4 – SSH Into your NAS (Just like in the User Setup guide) and elevate yourself to root by typing sudo -i and entering your password
Step 5 – Enter this command and press enter to start up the module /var/packages/WireGuard/scripts/start

You should now be able to see the WireGuard package running in Package Manager. Please note while I will try my best to support in relation to this module I may have to refer you on if it is a specific technical issue.

When you have GlueTUN running check the log for this line [wireguard] Using available kernelspace implementation, and you know it is working.

On to the next part.

Firewall (Optional Step if you have the Firewall Enabled)

If you have the Synology Firewall enabled and configured to block outgoing connections you will need to do this step. Otherwise, you will have issues with the VPN connecting to your provider. (please note the screenshot below does not show all the other rules you would normally have enabled)

Go into Control Panel > Security > Firewall

Click on Edit Rules and in the screen that appears click on ‘Create’

In the first screen select ‘Custom’

On the next screen we select the Type as ‘Destination Port’ and Protocol as ‘All’. In this example I am going to open up both 1194 and 1195 as some providers use UDP and some TCP and these are the most commonly used ports.

Click on OK and Apply the rule, and leave the ‘Source IP’ and ‘Action’ to their defaults on the original screen.

Docker Compose

Next we are going to create a Docker Compose file, this is used to tell Docker how to set up our container with all the variables we require that are not available in the DSM GUI.

You can edit this file in a number of ways, but to keep the guide OS-agnostic we will be using the Synology Text Editor package which can be installed via Package Center.

Open up Text Editor and create a new file, then copy and paste the information below into the file.

YAML
services:
  gluetun:
    image: qmcgaw/gluetun:latest
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8112:8112 # port for deluge
    volumes:
      - /volume1/docker/gluetun:/gluetun
    environment:
      - PUID=1234 #CHANGE_TO_YOUR_UID
      - PGID=65432 #CHANGE_TO_YOUR_GID
      - TZ=Europe/London #CHANGE_TO_YOUR_TZ
      - VPN_SERVICE_PROVIDER=NAMEOFYOURPROVIDER
      - VPN_TYPE=openvpn
      - OPENVPN_USER=VPNUSERNAME
      - OPENVPN_PASSWORD=VPNPASSWORD
      - SERVER_COUNTRIES=VPNSERVERCOUNTRY
      - HTTPPROXY=off #change to on if you wish to enable
      - SHADOWSOCKS=off #change to on if you wish to enable
      - FIREWALL_OUTBOUND_SUBNETS=172.20.0.0/16,192.168.0.0/24 #change this in line with your subnet see note on guide.
#      - FIREWALL_VPN_INPUT_PORTS=12345 #uncomment this line and change the port as per the note on the guide
    network_mode: synobridge
    labels:
      - com.centurylinklabs.watchtower.enable=false
    restart: unless-stopped

  linuxserver-deluge:
    image: linuxserver/deluge:latest
    container_name: deluge
    environment:
      - PUID=1234 #CHANGE_TO_YOUR_UID
      - PGID=65432 #CHANGE_TO_YOUR_GID
      - TZ=Europe/London #CHANGE_TO_YOUR_TZ
      - DELUGE_LOGLEVEL=error #optional
    volumes:
      - /volume1/docker/deluge:/config
      - /volume1/data/torrents:/data/torrents
    network_mode: service:gluetun # run on the vpn network
    depends_on:
      gluetun:
        condition: service_healthy
    restart: unless-stopped

You can change the formatting to YAML in the bottom right of the editor to make it easier to read.

Firewall Subnet

You will see an environment variable in the yml file called FIREWALL_OUTBOUND_SUBNETS=172.20.0.0/16,192.168.0.0/24

The first part 172.20.0.0/16 don’t edit this, the second IP after the , change as per below.

This IP address is easy to figure out. If you NAS IP is 192.168.1.27 your subnet is 192.168.1.0/24 (notice I just changed the last number to 0) This variable allows any containers connected via the VPN access to your local network.

Firewall Input Ports

This part is # commented out by default, if your provider offers port forwarding remove the # from the start of the line and change the port number in line with the one provided to you. This will also be the port used within Deluge and will help overall connectivity. (Note if you are using Proton VPN see the FAQ for an important extra step now!)

Volumes

By default, I have assumed you have your config files stored on /volume1 if these are located on another volume amend this line accordingly.

Watchtower Exclusion

You don’t need to change this, I added a label to avoid Watchtower automatically updating the GlueTUN container as it will always break the overall project which can be inconvenient if you are not around to fix it. You can update the container using the mini guide on the left menu of the site.

Default Value
    labels:
      - com.centurylinklabs.watchtower.enable=false

Important – Provider Specific Edits

Next up we will need to make some edits to the Environment Variables section of the compose in line with what is required for your specific provider. Open up the GlueTun Wiki and in the list find your provider.

For example in the Privado section (screenshot below) it has the variables required to make a successful connection, The ‘Required environment variables’ section will get you connected to a random server of the containers choosing.

You can add the ‘Optional environment variables’ parameters in order to select a specific server or range of servers. These are found on the same page.

(Pay close attention to your providers amendments as often people are caught out by using the incorrect settings such as SERVER_COUNTRIES when it should be SERVER_REGIONS etc)

If your provider is not supported, you can make a request on GitHub to add it, I do not currently have custom providers covered in this guide, feel free to jump on Discord / email me for help here.

Also note that some providers don’t like you having special characters in the password you will generally spot this in the log with AUTH errors.

This will be very similar across all the providers built in with some slight variances.

Once you have checked for your provider, make the appropriate edits to the compose accordingly.

In addition to the edits we just made there are a couple more in the table below, do these in the sections I have pre-filled

VariableValue
PUID(required) The UID you obtained in the user setup guide
PGID(required) The GID you obtained in the user setup guide
TZ(required) Your timezone wikipedia.org/wiki/List_of_tz_database_time_zones

You can now save this compose file in /docker and call it delugevpn.yml

SSH and Docker-Compose

It’s time to get logged into you Diskstation via SSH, you can do this in the same way as when you obtained your IDs in the ‘Setting up a restricted Docker user‘ guide.

Once you have logged in you will need to give 2 commands, you can copy and paste these one at a time — you will need to enter your password for the command starting with ‘sudo’

First we are going to change directory to where the delugevpn.yml is located, type the below and then press enter.

Bash
cd /volume1/docker

Then we are going to instruct Docker Compose to read the file we created and complete the set-up of the container. Again type the below and press enter.

Bash
sudo docker-compose -f delugevpn.yml up -d

When the command has completed you should be able to see both Deluge and the VPN container running in the list of containers in the Synology GUI.

Error: “gluetun is unhealthy”

At this stage if you receive an error relating to GlueTUN being unhealthy there is likely an error in the config file, this usually relates to the provider specific elements. If you check the logs for the GlueTUN container it will tell you why it couldn’t connect. If you get stuck drop me a comment with a copy of the logs via https://paste.drfrankenstein.co.uk.

Final Deluge Setup

As we have used /data/torrents as the mount point for our downloads we need to make sure Deluge uses this same file path.

We are going to do this by just changing the directory settings within Deluge.

Open a new browser tab and go to your NAS IP address on port 8112 (e.g. 192.168.0.46:8112)

Deluge by default has the password of ‘deluge’ to access the web UI, you can change or remove this later in the settings.

Next you will connect to the Deluge back end, just select the host and click connect, it will remember this going forward.

Now you are in the UI click on Preferences at the top of the screen, we are going to change the various folders to the settings shown in the screenshot/table below

OptionFromTo
Download to:/root/Downloads/data/torrents/incoming
Move complete to:/root/Downloads/data/torrents/completed

Network

To be sure that Deluge only uses the TUN interface you next need to go to the Network options (second one down) and within the ‘Outgoing Interface’ enter ‘tun0’

Plugins

There are a couple of plugins you will want to enable. (If you are looking for something to unpack torrents that are zipped then follow the Unpackerr guide)

  • Autoadd – This allows you to pull in any torrents in the watch directory
  • Label – This allows Radarr/Sonarr to assigned labels and pull downloads into subdirectories – no additional configuration required for this plugin
  • Auto Remove Plus – Download the ‘AutoRemovePlus-2.0.0-py3.8.egg’ version from the Deluge forums and place it in the Plugins’ folder in /docker/deluge/plugins. It allows you to fine tune when to remove torrents and their associated data once downloaded. (You may need to stop and re-up the container for this to appear)
Autoadd Plugin Settings

AutoremovePlus Settings

That’s it you are completely set up! I recommend having a quick read through the FAQ as it covers some questions you may have!


FAQs

Q: How can I update the GlueTUN containers?

A: See the Updating Containers section on the menu for a specific guide for GlueTUN

Q: How can I be sure the VPN connection is working?

A: Go to the TorGuard Check My Torrent IP site, right-click on the Green banner and copy the link (it’s a Magnet link) Then add this link into Deluge and start the torrent. Keeping the site open after a few seconds the site will show the IP address of the connection it finds. This will be of the VPN provider not your home IP. (Please note the torrent doesn’t actually download anything it’s purely doing an IP check)

Q: I tried to start Deluge / qBittorrent manually, and it says ‘Container must join at least one network’

A: This is due to the Synology Docker GUI not understanding that the container will be on the VPNs ‘network’. You will either need to start the container again via SSH or you can set up a manually triggered script via Task Scheduler you will only need to do use this if you ever stop the container.

Head into Control Panel and go to Task Scheduler, Click Create > Triggered Task > User Defined Task

SectionSetting
Task NameDockerVPNRestart
UserRoot
EnabledLeave Unticked

In the ‘Task Settings’ tab enter the following and then click Save

Bash
docker-compose -f /volume1/docker/delugevpn.yml down 
wait
docker-compose -f /volume1/docker/delugevpn.yml up -d

Q: Everything seems to be connected but nothing is downloading.

Are you using TorGuard – If so they block torrents on their US servers. Change to another country – Also while you are at it, you may need to configure port forwarding in your TorGuard account.

Try grabbing the Ubuntu torrent as that is a sure fire way of testing as generally it has over 3k seeds.

Q: My container doesn’t seem to start on a reboot even with the TUN script.

A: I have seen this a few times and usually relates to the VPN not completing its connection fast enough before containers using the VPN start. You can try setting an additional startup script by doing the following.

Head into Control Panel and go to Task Scheduler Click Create > Triggered Task > User Defined Task

SectionSetting
Task NameDockerVPNBootUp
UserRoot
EventBoot Up
Pre TaskSelect the TUN script from the drop-down

In the ‘Task Settings’ tab enter the following and then click Save

Bash
sleep 120
docker-compose -f /volume1/docker/delugevpn.yml down 
wait
docker-compose -f /volume1/docker/delugevpn.yml up -d

Proton VPN Port Forwarding Extra Step

Proton doesn’t allow you to choose your own port for port forwarding, so we need to add another container to the compose in order for this to be automatically updated for us. (Please note I am unable to test this personally it is based on Feedback via our Discord channel)

First don’t uncomment this line in the compose leave it disabled
# - FIREWALL_VPN_INPUT_PORTS=40312

Next copy the code below to bottom of the compose file and then amend the following only leave the other options.

TZ= #ENTER YOUR TIMEZONE
QBITTORRENT_SERVER= #ENTER YOUR NAS IP
QBITTORRENT_USER=admin (change to the username you will be using later for qbit)
QBITTORRENT_PASS=adminadmin (change to the password you will be using later for qbit)

Once added continue with the guide 🙂

YAML
  qbittorrent-natmap:
    # https://github.com/soxfor/qbittorrent-natmap
    image: ghcr.io/soxfor/qbittorrent-natmap:latest
    container_name: qbittorrent-natmap
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - TZ=Europe/London #CHANGE_TO_YOUR_TZ
      - QBITTORRENT_SERVER=
      - QBITTORRENT_PORT=8090
      - QBITTORRENT_USER=admin
      - QBITTORRENT_PASS=adminadmin
      # - VPN_GATEWAY=
      # - VPN_CT_NAME=gluetun
      # - VPN_IF_NAME=tun0
      # - CHECK_INTERVAL=300
      # - NAT_LEASE_LIFETIME=300
    network_mode: service:gluetun
    depends_on:
      qbittorrent:
        condition: service_started
      gluetun:
        condition: service_healthy

Q: How can I add additional services to the VPN container?

A: Adding additional containers to the VPN network is very easy. As you can see in the example below I have added Prowlarr to the bottom of the compose. The only amendments are that the ‘network_mode’ uses the Gluetun container and the ports for Prowlarr have been moved up to the Gluetun containers ports section.

Also see the separate Prowlarr guide on the left menu for setting up FlareSolver (In the Extras section)

YAML
      - 9696:9696 # add this to the ports section of GlueTUN
#add the below to the bottom of the compose
  linuxserver-prowlarr:
    image: linuxserver/prowlarr:latest
    container_name: prowlarr
    environment:
      - PUID=1234 #CHANGE_TO_YOUR_UID
      - PGID=65432 #CHANGE_TO_YOUR_GID
      - TZ=Europe/London #CHANGE_TO_YOUR_TZ
    volumes:
      - /volume1/docker/prowlarr:/config
    network_mode: service:gluetun # run on the vpn network
    depends_on:
      gluetun:
        condition: service_healthy
    restart: unless-stopped

Q: I Get a long error mentioning OCI when bringing up the containers.

A: Stop both the containers from the Docker UI and delete them, run the command again, and it should start up fine. If this still happens double check you have set your VPN providers settings correctly.

More will be added as questions come up



Buy Me a Coffee or a Beer

If you have found my site useful please consider pinging me a tip as it helps cover the cost of running things or just lets me get the odd beverage. Plus 10% goes to the devs of the apps I do guides for every year.

Published inDockerDownload Tools 7.1Synology

87 Comments

  1. frankiechains frankiechains

    Hello! gluten was really lagging my whole NAS so I deleted both the deluge and gluten containers and their folders. When I tried to reinstall by using the docker compose, I keep getting this error when installing – “OCI runtime create failed: container_linux.go:363: creating new parent process caused: container_linux.go:1946: running lstat on namespace path “/proc/11529/ns/net” caused: lstat /proc/11529/ns/net: no such file or directory: unknown”

    The error also shows in docker after the failed install, both containers still get created

    • Dr_Frankenstein Dr_Frankenstein

      Hey, I have been speaking with someone via email with the same issue and been going through a lot of attempted fixes. Can you try pulling an older version of Gluetun

      Change the image line from latest to v3.33

      image:qmcgaw/gluetun:v3.33

      If that’s doesn’t work let me know.

      • frankiechains frankiechains

        Unfortunately I am still getting the error with the change. Here’s how it looks in terminal.

        Pulling gluetun (qmcgaw/gluetun:v3.33)…
        v3.33: Pulling from qmcgaw/gluetun
        f56be85fc22e: Already exists
        d8fb6512d68b: Pull complete
        31fef5c836e9: Pull complete
        Digest: sha256:cadc352ebed5988c9fbc750f2759ea703dc7587f969d70342cc5eff05282024b
        Status: Downloaded newer image for qmcgaw/gluetun:v3.33
        Pulling linuxserver-deluge (linuxserver/deluge:latest)…
        latest: Pulling from linuxserver/deluge
        5e495b63f279: Already exists
        d2e3055e0657: Already exists
        c41a5c105a44: Already exists
        81bd45e58002: Already exists
        ba0bab250ad4: Pull complete
        f497c86220f0: Pull complete
        Digest: sha256:4412c730f84586daa11ac23a5290a53da2db7ccbbf5b8948d18319efacb99299
        Status: Downloaded newer image for linuxserver/deluge:latest
        Creating gluetun … done
        Creating deluge … error

        ERROR: for deluge Cannot start service linuxserver-deluge: Container eb8a8e1a45e5cb8f42d9c8e19d0d4cbd3a5292b6a2a38d4d4ecfc459d61568c5 is restarting, wait until the container is running

        ERROR: for linuxserver-deluge Cannot start service linuxserver-deluge: Container eb8a8e1a45e5cb8f42d9c8e19d0d4cbd3a5292b6a2a38d4d4ecfc459d61568c5 is restarting, wait until the container is running
        ERROR: Encountered errors while bringing up the project.

        Appreciate your help

        • Dr_Frankenstein Dr_Frankenstein

          OK this is a different error
          Check the Gluetun log it will tell you why it is restarting.

          • frankiechains frankiechains

            Fixed a config issue. Everything is working fine now. Thanks again for the help!

      • Jacob Jacob

        Just wanted to say this fixed my issue – looks like the latest version of Gluetun doesn’t work with the current configuration. I was getting the same error message frankiechains was.

  2. Juan Juan

    Hello, I have a question. I already have deluge installed and working without VPN and I want to add the VPN to it, will this work without re-installing everything? maybe just changing some network params?

    • Dr_Frankenstein Dr_Frankenstein

      You can just run through this guide and point the new container at your existing config files in the docker folder. Remember to delete the Deluge container itself before starting.

  3. GK GK

    Thanks for the guide! I am able to setup the VPN fine and downloads are working. However, when I try to download through radarr/sonarr, I get the error ‘Indexer specified download client is not available’.

    In radarr/sonarr, I have disabled the old torrent client (I was using Transmission) and updated to use Deluge. I have restarted the radarr/sonarr container as well but still get the same error.

    • Dr_Frankenstein Dr_Frankenstein

      Hey, try using either your NAS ip address or the synobridge gateway address of 172.20.0.1 for Radarr and Sonarr.

  4. smoobandit smoobandit

    Hi there!

    Another great job with the step by step explanations and screen shots for this installation.

    I do have a question though… I need to stress that my installation is WORKING. Deluge is connecting through NordVPN. It reports a VPN IP address in use. The test .torrent file and website also report the same VPN IP address. So all is up and running. Deluge is using the tun0 interface.

    What’s the problem? I cannot see gluetun as a container. It is not in the list of running containers under ‘Overview’ or the list of all containers under ‘Container’. It does show up as a downloaded image. It also shows up in the list of containers connected to my bridge network connection.

    At the moment, this does not seem to be a problem, as it is running as intended.

    • Dr_Frankenstein Dr_Frankenstein

      This is a bit of a bug in the Syno DockerUI every now, and again I have the same issue with other containers. It will appear you may have to stop it and start it again.

  5. Mark Mark

    Dr, I keep struggling setting up the right .yml file apparently. I keep getting an error during compiling: “ERROR: for linuxserver-deluge Cannot start service linuxserver-deluge: Container is restarting, wait until the container is running”.

    I also tried all suggestions in the Comments but unitl now…not working. Could you help me out specifically with my provider details and variable settings for the yml file?

    Thanks!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

drfrankenstein.co.uk – writing Synology Docker Guides since 2016 – Join My Discord!