Last updated on 5 December 2024
Important or Recent Updates
Historic Updates | Date |
---|---|
New DSM7.2 Container Manager Update (Beta/RC) | 26/04/2023 |
Added watchtower labels to the compose to allow updates and changed the proxies to off by default | 06/05/2023 |
Removed the Watchtower ‘Depends On’ Labels as they do not successfully update the GlueTUN container. Added an Exclusion label to the GlueTUN container, so it can just be manually updated. | 11/05/2023 |
Update includes: Firewall Input Ports for when your provider offers port forwarding, also a note in relation to volumes and added PUID/PGID settings for GlueTUN | 14/06/2023 |
Update for Wireguard Kernel Module Install which reduces overall CPU usage for Wireguard connections Please note if you previously followed this guide you can follow the new section to update your existing set up. | 21/09/2023 |
Added Health checks to dependent containers | 25/09/2023 |
Added an addition element to the compose to restrict the container from gaining additional privileges and umask environment variable | 25/10/2023 |
Updated with new steps to obtain and change WebUI password | 21/11/2023 |
Issue with passwords has been fixed in 4.6.2 so removed tty line from yaml | 29/11/2023 |
Swapped YAML to use Wireguard by default (Thanks Bob) (Thanks Andy for the original suggestion) | 22/01/2024 |
Amended the start-up script folders to align with the changes made late November (Apologies) | 25/01/2024 |
Added – UPDATER_PERIOD=24h variable in order to ensure the latest server lists for your provider all pulled once a day | 27/04/2024 |
Reworded the Port Forwarding section and added a new docker mod for those using ProtonVPN to update the qbit port forwarding (listening port) automatically | 18/08/2024 |
NATMAP for Proton removed from the guide as GSP is the better choice now | 19/08/2024 |
Adjusted the GSP Mod for Proton (removed un-needed for the addresses) | 04/12/2024 |
A small note to remember about updates in this guide I set GlueTUN to use the ‘latest’ version tag, sometimes it has updates which break things, so if you have an issue after an update roll back to the most recent full stable release from this page, so for example as of October 2024 that would be image: qmcgaw/gluetun:v3.39
What are qBittorrent and GlueTUN?
qBittorrent is a torrent downloader and GlueTUN is the Docker container that has pre-configured VPN connections for numerous VPN providers.
Before you start check the GlueTUN Wiki to see if your provider is on the supported list.
Also, if you are yet to choose a provider have a look at the Reddit list of recommended suppliers as could save you a headache when trying to seed. I currently use AirVPN which has nice easy port forwarding unlike some others. This is my affiliate link if you fancy signing up.
Let’s Begin
In this guide I will take you through the steps to get qBittorrent up and running in Docker and a separate GlueTUN VPN container. By having a separate container for the VPN connection we can use it in the future for other applications such as Prowlarr, this is useful if you have torrent indexers blocked in your country.
In order for you to successfully use this guide please complete the three preceding guides
- Docker Package, SSD and Memory Recommendations
- Step 1: Directory Setup Guide
- Step 2: Setting up a restricted Docker user
- Step 3: Setting up a Docker Bridge Network (synobridge)
Folder Setup
Let’s start by getting some folders set up for the containers to use. Open up File Station create the following.
/docker/projects/vpnproject-compose
/docker/gluetun
/docker/qbittorrent
Setting up the TUN start up script
In order for the VPN connection to work we need to make sure the TUN Interface is available to make the connection to a VPN provider. In order to ensure it is available even after a reboot we will set up a small ‘script’.
Open up Control Panel and then click on Task Scheduler
Next click on Create, Triggered Task then User Defined Script.
Enter the following:
Section | Setting |
---|---|
Task: | VPNTUN |
User: | root |
Event: | Boot-up |
Enabled | Tick |
On the Task Settings tab copy and paste the code below in the ‘User-Defined script’ section. It will look like screenshot.
#!/bin/sh -e
insmod /lib/modules/tun.ko
You can now press OK and agree to the warning message. Next run the script which will enable the TUN device.
You can now move on to the next step.
Wireguard Kernel Module – Recommended for Performance & Reduced CPU Resource (not required for OpenVPN connections)
The default Gluetun Wireguard setup uses a ‘Userspace’ implementation of Wireguard which requires higher CPU resources. For example a 40MiB download via qBittorrent uses up to 176% in CPU (1.7 Cores) on my 1821+.
By installing the appropriate Kernel Module this reduces down to 1 or 2% which frees up the CPU for other tasks.
BlackVoid.club have put together a Kernel Module for Synology which allows Gluetun to use the lower level Kernel to perform Wireguard duties make sure you drop them a thanks as this would not be possible without them!
While on first glances it looks like a long installation process the page details a number of methods. I recommend having a read taking note of warnings and also if you want to build your own module it tells you how.
The TLDR is below.
- Find your model of NAS under the correct DSM version section (If you are following this guide it will be 7.2) and download the pre compiled .spk file
- Head into Package Center and click ‘Manual Install’ on the top right and install the .spk file and untick the box to run after install
- Reboot
- SSH Into your NAS (Just like in the User Setup guide) and elevate yourself to root by typing
sudo -i
and entering your password - Enter this command and press enter to start up the module
/var/packages/WireGuard/scripts/start
You should now be able to see the WireGuard package running in Package Center. Please note while I will try my best to support in relation to this module I may have to refer you on if it is a specific technical issue.
When you have GlueTUN running check the gluetun log in Container Manager > Container > gluetun > then in the log tab look for this line “[wireguard] Using available kernelspace implementation”, which indicates the kernel module is installed and working properly.
On to the next part.
Container Manager
Next we are going to set up a ‘Project’ in Container Manager, a project is used when you want multiple containers to all be loaded together and often rely on each other to function. In our case we want qBittorrent to load and talk to the GlueTUN VPN container.
Open up Container Manager and click on Project then on the right-hand side click ‘Create’
In the next screen we will set up our General Settings, enter the following:
Section | Setting |
---|---|
Project Name: | vpn-project |
Path: | /docker/projects/vpnproject-compose |
Source: | Create docker-compose.yml |
Next we are going to drop in our docker compose configuration copy all the code in the box below and paste it into line ‘1’ just like the screenshot
services:
gluetun:
image: qmcgaw/gluetun:latest
container_name: gluetun
cap_add:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
ports:
- 8888:8888/tcp # HTTP proxy
- 8388:8388/tcp # Shadowsocks
- 8388:8388/udp # Shadowsocks
- 8090:8090/tcp # port for qbittorrent
volumes:
- /volume1/docker/gluetun:/gluetun
environment:
- PUID=1234 #CHANGE_TO_YOUR_UID
- PGID=65432 #CHANGE_TO_YOUR_GID
- TZ=Europe/London #CHANGE_TO_YOUR_TZ
- VPN_SERVICE_PROVIDER=NAMEOFYOURPROVIDER
- VPN_TYPE=wireguard #change as per wiki
- WIREGUARD_PRIVATE_KEY=YOUR-PRIVATE-KEY #remove if using openvpn
- WIREGUARD_PRESHARED_KEY #For AIRVPN remove if not required
- WIREGUARD_ADDRESSES=10.x.x.x #IP V4 Only - remove if using openvpn
- SERVER_COUNTRIES=VPNSERVERCOUNTRY #Change based on the Wiki
- HTTPPROXY=off #change to on if you wish to enable
- SHADOWSOCKS=off #change to on if you wish to enable
- FIREWALL_OUTBOUND_SUBNETS=172.20.0.0/16,192.168.0.0/24 #change this in line with your subnet see note on guide.
# - FIREWALL_VPN_INPUT_PORTS=12345 #uncomment or remove this line based on the notes below
- UPDATER_PERIOD=24h
network_mode: synobridge
labels:
- com.centurylinklabs.watchtower.enable=false
security_opt:
- no-new-privileges:true
restart: always
qbittorrent:
image: linuxserver/qbittorrent:latest
container_name: qbittorrent
environment:
- PUID=1234 #CHANGE_TO_YOUR_UID
- PGID=65432 #CHANGE_TO_YOUR_GID
- TZ=Europe/London #CHANGE_TO_YOUR_TZ
- WEBUI_PORT=8090
- UMASK=022
volumes:
- /volume1/docker/qbittorrent:/config
- /volume1/data/torrents:/data/torrents
network_mode: service:gluetun # run on the vpn network
depends_on:
gluetun:
condition: service_healthy
security_opt:
- no-new-privileges:true
restart: always
What is a Docker Compose?!
The code we just dropped into Container Manager defines how we want each of the container’s setup. It is broken down into sections such as ports we want to access, which folders we want the container to use and what some variables to define where we live and settings for the container known as ‘Environment’ variables.
We will now make some important edits!
IDs and Timezone
First look for the lines below, they appear twice each, these control the containers access to our filesystem and also the user the containers run as.
Variable | Value |
---|---|
PUID | (required) The UID you obtained in the user setup guide |
PGID | (required) The GID you obtained in the user setup guide |
TZ | (required) Your timezone wikipedia.org/wiki/List_of_tz_database_time_zones |
Ports and Proxies
In the top Gluetun section you will notice that we have some additional ports assigned for a http proxy and Shadowsocks Proxy – this means you can direct traffic from other devices or applications on your network through the container! If you want to use these change the following.
Variable | Value |
---|---|
HTTPPROXY | off (default) on (enabled) |
SHADOWSOCKS | off (default) on (enabled) |
Firewall Outbound Subnet
This section controls your ability to access the UIs of any containers running through the GlueTUN containers network.
- FIREWALL_OUTBOUND_SUBNETS=172.20.0.0/16,192.168.0.0/24
The first part ‘172.20.0.0/16’ don’t edit as this is our ‘synobridge’ network and allows other containers such as Radarr to access the download client.
We need to change the second IP after the , this allows us to access the WebUI and containers via out local network.
This IP address (subnet) is easy to figure out. If you NAS IP is 192.168.0.27 your subnet is 192.168.0.0/24 (notice I just changed the last number before the /24 to 0)
Firewall Input Ports (Port Forwarding)
This line is #commented out by default, if your VPN provider offers port forwarding remove the # from the start of the line and change the port number(s) in line with the ones provided to you. Make sure you also manually update the ‘Listening Port’ in qbit once you are running.
If you use ProtonVPN see the FAQ for some port forwarding extra steps you need to do!
- FIREWALL_VPN_INPUT_PORTS=12345,56789
Volumes
By default, I have assumed you have your config files stored on /volume1 if these are located on another volume amend these lines accordingly.
- /volume1/docker/gluetun:/gluetun
- /volume1/docker/qbittorrent:/config
- /volume1/data/torrents:/data/torrents
Watchtower Exclusion
You don’t need to change this, I added a label to avoid Watchtower automatically updating the GlueTUN container as it will always break the overall project which can be inconvenient if you are not around to fix it. You can update the container using the mini guide on the left menu of the site.
labels:
- com.centurylinklabs.watchtower.enable=false
Important – Provider Specific Edits
This next bit is important and if you don’t pay attention to the details you will have a harder time connecting up to your VPN provider
Open up the GlueTun Wiki and in the list find your provider.
Let’s use AirVPN as our example.
On the page you will see a number of key sections highlighting the variables that work with AirVPN. This is important as they can vary per provider so read everything on your providers page. (See the FAQ for the steps to get AirVPN Wireguard Details)
Key differences are generally the SERVER_COUNTRIES / SERVER_CITIES etc as they will vary so use the correct setting, your provider should have a list of Countries and Cities they support.
I have provided some common defaults in the compose for you but you need to amend them in line with your providers page.
- VPN_SERVICE_PROVIDER=NAMEOFYOURPROVIDER
- VPN_TYPE=wireguard
- WIREGUARD_PRIVATE_KEY=YOUR-PRIVATE-KEY
- WIREGUARD_ADDRESSES=10.x.x.x
- SERVER_COUNTRIES=VPNSERVERCOUNTRY
If your provider is not supported, you can make a request on GitHub to add it, or you can follow the custom providers guidance on GlueTUNs WIKI.
Once you have checked for your provider, make the appropriate edits to the compose accordingly.
That completes the edits to the compose!
Click ‘Next’
You do not need to enable anything on the ‘Web portal settings’ screen click ‘Next’ again
On the final screen click Done which will begin the download of the container images and once downloaded they will be launched!
The images will now be downloaded and extracted. You should see ‘Code 0’ when it has finished.
You will now see your vpn-project running both containers should have a green status on the left-hand side.
Error: “gluetun is unhealthy”
At this stage if you receive an error relating to GlueTUN being unhealthy there is likely an error in the config file, this usually relates to the provider specific elements. If you check the logs for the GlueTUN container it will tell you why it couldn’t connect. If you get stuck drop me a comment with a copy of the logs via https://paste.drfrankenstein.co.uk.
Firewall Exceptions
(Skip if you don’t have the Firewall configured)
If you have the Synology Firewall enabled please see this additional guide for further info on exceptions and correct set up.
Changing the default WebUI login and password
If you skip this step you won’t be able to log in.
Now the container has started open it in the Docker UI and go to the Log tab. Within the logs you will see the login details
Now before doing any more of the guide go to the Web UI by going to the IP of your NAS followed by port 8090 and log in. Then on the WebUI tab change the defaults to your own and save them.
Now continue on..
Final qBittorrent Setup
As we have used /data/torrents as the mount point for our downloads we need to make sure qBittorrent uses this same file path.
We need to change the file paths by editing the qBittorrent config file, before doing this stop both of the containers. Do this by selecting the Project from the main UI and under Action selecting ‘Stop’.
You can edit this file in a number of ways, but to keep the guide OS-agnostic we will be using the Synology Text Editor package which can be installed via Package Center.
Open Text Editor and browse to /docker/qbittorrent/qbittorrent and open the qBittorrent.conf then edit the file in line with the table below, once amended save the changes.
Original Value | New Value |
---|---|
Session\DefaultSavePath=/downloads/ | Session\DefaultSavePath=/data/torrents/completed |
Session\TempPath=/downloads/incomplete/ | Session\TempPath=/data/torrents/incoming/ |
Downloads\SavePath=/downloads/ | Downloads\SavePath=/data/torrents/completed |
Downloads\TempPath=/downloads/incomplete/ | Downloads\TempPath=/data/torrents/incoming/ |
You can now bring the containers back up again by starting the project back up.
Once the containers are running you can log into the Web UI by going to the IP of your NAS followed by port 8090
e.g. 192.168.0.30:8090
Log in with the username and password you created earlier.
Now you are in the UI click on settings cog at the top of the screen, we are going to change one more directory which is the watched folder to /data/torrents/watch. You can also turn on the option ‘keep incomplete torrents in:’ which should already have /data/torrents/incoming’ prefilled.
Next we are going to set a command to run when each torrent finishes to automatically extract any .rar files (Note if you have any issues with this I would recommend using Unpackerr the guide is on the menu)
Scroll down in the options to the ‘Run external program on torrent completion’ and enter the below, it tells qbittorrent to run unrar and extract the file to the same save path as the original file. This will not delete anything, so you can continue seeding.
unrar x "%D/*.r*" "%D/"
Advanced Network Settings
The last step is to tell qBittorrent to only use the tun0 interface for its traffic, go to the Advanced tab then from the ‘Network Interfaces’ drop down select ‘tun0’ and click Apply, If this doesn’t appear the first time you may need to completely reboot your NAS.
I am not going to walk through all the other settings as you can customise these as you wish.
That’s it you are completely set up, you can now start up the Project again from the ‘Project’ tab.
I recommend having a quick read through the FAQ as it covers some questions you may have!
FAQs
Q: My GlueTUN is unhealthy what can I do?
A: The GlueTUN logs should be your first point of call, they will tell you if you have key issues with the configuration that are sometimes easily remedied. If you are still stuck leave a comment on this post, include the contents of your compose and also the log file (Use my PrivateBin https://paste.drfrankenstein.co.uk) remove passwords or WireGuard keys!
Or Join Discord for some more immediate help..
Q: How can I update the GlueTUN containers?
A: See the Updating Containers section on the menu.
Q: How do I get my AirVPN details?
## Obtaining your WireGuard or OpenVPN details
- Login to your AirVPN account and go to the Client Area
- Click on `VPN Devices` and create a new device named `GlueTUN` (you can name this anything)
- Back in the Client Area select `Config Generator` and select the following:
- Linux
- Turn on either WireGuard or OpenVPN
- Choose the newly created `GlueTUN` device
- Select your preferred Server or Region
- Click Generate and download the config file.
### WireGuard Config
- In the config file you only require the following
Address = 10.141.x.x/32 #Nothing after this part
PrivateKey = uFdxxxxxxxxxxxxxxxx
PresharedKey = 4s2xxxxxxxxxxxxxxxxxxxx
Q: How can I be sure the VPN connection is working?
A: Go to the TorGuard Check My Torrent IP site, right-click on the Green banner and copy the link (it’s a Magnet link) Then add this link into qBittorrent and start the torrent. Keeping the site open after a few seconds the site will show the IP address of the connection it finds. This will be of the VPN provider not your home IP. (Please note the torrent doesn’t actually download anything it’s purely doing an IP check)
Q: I am getting the ‘errored’ status for all my torrents
This is very likely a permissions issue, go to the User and Group guide and see the permission fixes towards the bottom.
Q: Everything seems to be connected but nothing is downloading.
Try grabbing the Ubuntu torrent as that is a sure fire way of testing as generally it has over 3k seeds.
Are you using TorGuard – If so they block torrents on their US servers. Change to another country – Also while you are at it, you may need to configure port forwarding in your TorGuard account.
Q: My container doesn’t seem to start on a reboot even with the TUN script.
A: I have seen this a few times and usually relates to the VPN not completing its connection fast enough before containers using the VPN start. You can try setting an additional startup script by doing the following.
Head into Control Panel and go to Task Scheduler Click Create > Triggered Task > User Defined Task
Section | Setting |
---|---|
Task Name | DockerVPNBootUp |
User | Root |
Event | Boot Up |
Pre Task | Select the VPNTUN script from the drop-down that you created at the start of the guide |
In the ‘Task Settings’ tab enter the following and then click Save
sleep 120
docker-compose -f /volume1/docker/projects/vpnproject-compose/compose.yaml down
wait
docker-compose -f /volume1/docker/projects/vpnproject-compose/compose.yaml up -d
Proton VPN Port Forwarding Extra Step
Proton doesn’t allow you to choose your own port for port forwarding, so we need to add a mod to the compose in order for this to be automatically updated for us.
GSP : Qbittorrent – Gluetun synchronised port mod
This is a newer method and requires less setup than old NATMAP container it just involves adding some extra lines to the qbit container environment variables section to enable the mod. Note you will need to circle back and update the username and password section after the first setup of qbit.
Edits to the GlueTUN ‘environment variables’ section of the compose
#Remove this line from your compose its only required for other providers
- FIREWALL_VPN_INPUT_PORTS=12345,56789
#Add these lines to the GlueTUN Environment
- VPN_PORT_FORWARDING=on
- VPN_PORT_FORWARDING_PROVIDER=protonvpn
Edits to the qBittorrent ‘environment variables’ section of the compose, Please note if your username or password has special characters you may need to add “password” double quotes around them.
- DOCKER_MODS=ghcr.io/t-anc/gsp-qbittorent-gluetun-sync-port-mod:main
- GSP_GTN_API_KEY= #SEE BELOW
- GSP_SLEEP=120
- GSP_MINIMAL_LOGS=false
- GSP_QBT_USERNAME= #your qbit username
- GSP_QBT_PASSWORD= #your qbit password
For the GSP_GTN_API_KEY we need to generate a key for the communication, you can find the methods here,
We are going to do this using GlueTUN, log into your NAS via SSH and issue the command below which will generate a key using GlueTUN and show it on screen for you to copy.
sudo docker run --rm qmcgaw/gluetun genkey
You can then add it after the GSP_GTN_API_KEY= line
Once added Save and Container Manager will rebuild the project with the mod enabled, you will see it working in the qBittorrent containers log.
Q: I tried to start Deluge / qBittorrent manually, and it says ‘Container must join at least one network’
A: This is due to the Synology Container Manager GUI not understanding that the container will be on the GlueTUN ‘network’. You will need to start the container via the Project as it is part of the overall Project compose.
Q: How can I add additional services to the VPN container?
A: Adding additional containers to the VPN network is very easy. As you can see in the example below I have added Prowlarr to the bottom of the compose. The only amendments are that the ‘network_mode’ uses the Gluetun container and the ports for Prowlarr have been moved up to the Gluetun containers ports section.
Also see the separate Prowlarr guide on the left menu for setting up FlareSolver (In the Extras section)
- 9696:9696 # add this to the ports section of GlueTUN
#add the below to the bottom of the compose
linuxserver-prowlarr:
image: linuxserver/prowlarr:latest
container_name: prowlarr
environment:
- PUID=1234 #CHANGE_TO_YOUR_UID
- PGID=65432 #CHANGE_TO_YOUR_GID
- TZ=Europe/London #CHANGE_TO_YOUR_TZ
- UMASK=022
volumes:
- /volume1/docker/prowlarr:/config
network_mode: service:gluetun # run on the vpn network
depends_on:
gluetun:
condition: service_healthy
security_opt:
- no-new-privileges:true
restart: always
More will be added as questions come up
Looking for some help, join our Discord community
If you are struggling with any steps in the guides or looking to branch out into other containers join our Discord community!
Buy me a beverage!
If you have found my site useful please consider pinging me a tip as it helps cover the cost of running things or just lets me stay hydrated. Plus 10% goes to the devs of the apps I do guides for every year.
Hello Dr Frank – thank you for the great guide. All seems to work fine except right at the end. Completed files do not move to my Media folder. Deluge throws the following error:
[ERROR ][deluge.core.torrent :1672] Could not move storage for torrent af70190ba917aa82f9e40ae2e5fef4af13b73355 since /Media/Other Videos/vid_bckup does not exist and could not create the directory: [Errno 13] Permission denied: ‘/Media’
Is that because my Media folder is not in Docker / a container? Or other?
Thank you!
Hey if you are using a slightly different folder setup you will need to pass in that additional folder
Add this under the volumes section and you will be able to put files into that share, just make sure your docker user also has access.
- /volume1/Media:/Media
Hi Dr. Frankenstein – I am having trouble with gluetun getting stuck in an unhealthy state. I noticed this after updating to DSM 7.2.2-72806 Update 1. During troubleshooting, I also noticed that AirVPN replaced the existing server names I had configured so I am going off of server cities instead. Gluetun related compose and gluetun logs are in the below paste. Please let me know if you need anything else from me.
https://paste.drfrankenstein.co.uk/?aa8760b679ca077d#8r8DAFhFsXmFcxyKzTcjAdUaScNuD3TMEBcydvTe8kkr
Everything looks OK – try rolling back a version to see if It’s something to do with the latest release. I am currently sitting on
image: qmcgaw/gluetun:v3.38.1
Rolling back the Gluetun version did not resolve it so I dug further. The root cause seems to be that the AirVPN servers I had configured previously were no longer available in the servers.json file. Since I could not connect to the “old” AirVPN servers to update the VPN server list, I updated the server list using the command line and now I can connect to the AirVPN servers that I prefer. Technically I could have found an active AirVPN server that was still on the old list and ran the periodic update via UPDATER_PERIOD environment variable.
Refer to section “Update using the command line” at https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md
Yeah, looks like its happened over the last couple of days as had someone on Discord with the same issue. Its one of those things that you can’t predict. Good its working!!
I had the same issue. Airvpn did change their server names. I just changed the name to a new server name and everything is working now
Just had someone on Discord with the same issue so must have been a recent change.
Hi, thank you for this great work.
I followed your guide but gluetun keeps getting an AUTH_FAILED error even though my credentials are undoubtedly correct (no, I’m not using my web credentials). I’m using OpenVPN with ProtonVPN (free tier, don’t know if that matters).
It would be great if you could check the following pastes (I can’t seem to access paste.drfrankenstein.co.uk at the moment so I’m using pastebin instead).
This is my compose script:
https://pastebin.com/VE86aN6f
This are gluetun logs:
https://pastebin.com/pQEQY11a
*Also, when trying to start qbittorrent container I get an error saying it must be associated with at least one network. Is it because guetun isn’t working or is it a different problem?
Thanks!
Hi Gianluca
Working backwards…
The last bit about the network – see the FAQ it covers this 🙂
Keep in mind that Proton does not offer Torrents (P2P) or port forwarding on its free tier so you will need to upgrade to a paid service to use this guide with qbit.. Credentials wise it should work with the options in this section of your account.
https://paste.drfrankenstein.co.uk/?e7c3faa2eb858268#HVSZzLJsUMRSdCdwphmME1jEBxJey6BS1PrGGEEdBsWf
Awwww, I was so concerned about the main gluetun problem that I missed that last FAQ. Since gluetun is always unhealthy I was never able to completely start the project, hence I kept getting the “no associated network” error. Thanks.
By the way yes, I know I can’t use the free tier for torrenting. I was trying to build the project to see if I could get it to work before eventually buying a dedicated subscription. Anyway I’m definitely using the correct credentials (not the “proton account” ones, but the OpenVPN / IKEv2 listed in the account section). I even tried resetting them. It just doesn’t work.
I’ve been searching online but found no solution. Someone, somewhere, mentioned that maybe gluetun doesn’t choose the correct “free” servers and therefore can’t connect. This is also hinted by Proton in their FAQs (they openly suggest to “Confirm that you’re accessing servers which are available for you Proton VPN plan”).
I might try to subscribe for a month just to check if gluetun works well with a paid plan. I’ll let you now in case I do.
Thanks again for your time.
Ahh, you need the free servers environment variable that’s the bit I missed..
https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/protonvpn.md#optional-environment-variables
– FREE_ONLY=on
Aaaand that did it. I only looked for mandatory variables on gluetun wiki, didn’t think the solution would lie in the optional ones.
Now it works… kinda. “FREE_ONLY=on” doesn’t actually work with port forwarding, gluetun logs explain that when trying to make it work. Removing the port forwarding part makes it work.
To summarize: your guide explains how to set up qbittorrent and it’s perfect as it is. Since Proton needs the port forwarding trick AND doesn’t allow torrenting with free tiers there’s no need to mention the FREE_ONLY variable, which wouldn’t allow to use port forwarding nor torrenting.
I’ll just get a paid subscription and that should automatically solve all previous issues. I really appreciated your help though: I was trying to do something stupid, yet you took the time to help me doing it 🙂
Thank you so much!
Hello! Thanks for the amazing guides. I have a script to create hardlinks based on qbitrorrent categories (adapted from https://github.com/gravelfreeman/qbit-hardlinker with the help of chatgpt). But I don’t know how to call/run the script file after a torrent is completed. Do you have any idea?
Hey, thanks for the contribution! – You should be able to drop the script into the /docker/qbittorrent folder and then adjust the script path to the containers internal path
/config/qbit-hardlinker.sh "%R"
Hello Dr. I’m having trouble with understanding how to install SlickVPN, It doesn’t list anything about wireguard, but it is listed under providers. Is there a possible way that you can guide me?
Hi – So you need to use OpenVPN for Slick and set up the certificates required
See the GlueTUN wiki page, remove the elements from my compose and add these.
environment:
– VPN_SERVICE_PROVIDER=slickvpn
– OPENVPN_USER=abc
– OPENVPN_PASSWORD=abc
– SERVER_COUNTRIES=Netherlands
https://github.com/qdm12/gluetun-wiki/blob/main/setup/providers/slickvpn.md
You also need to do the certificates it mentions, just follow the two additional instructions from the Wiki to create the files required in /docker/gluetun if Slick doesn’t provide you with the files in its config then they are nested within the .ovpn config file.
Hello, I still a bit confused, as I am unsure how to run this command “Then bind mount this gluetun directory in the container by running it with -v /yourpath/gluetun:/gluetun.”
trying to do it via SSH, but still out of my league. Any insight?
“Setup your client encrypted key & Setup your client certificate” seems to be where I am having trouble with.
Hey so ignore the bind mount bit as we already have the /gluetun folder setup your files will go inside /docker/gluetun
Download your config file(s) from slick and look for the private key and client certificate…
Create two files in the folder above
openvpn_encrypted_key (no file extension) and put the private key in it including the start and end bits
—–BEGIN ENCRYPTED PRIVATE KEY—–
…
…
—–END ENCRYPTED PRIVATE KEY—–
then a second file called client.crt with this section in it..
—–BEGIN CERTIFICATE—–
…
…
—–END CERTIFICATE—–
Then in your compose it will look like entering the login details for slick and the country you want to use.
https://paste.drfrankenstein.co.uk/?3ed3c8b3819b24e0#BousVQnfwZKPYgRedxY4YoW4k4RL9L2KiADMEJDmRcGQ
Okay, I did figure out the certificates, and private keys. Now my problem is Gluetun is unhealthy…
Attached is the logs for my Gluetun.
https://paste.drfrankenstein.co.uk/?b6b6ee76c7e8f09d#FW2P6fapYC5uUaQRrLvRQPUEu5ErQuYDGGqoFs2UihPZ
Hey this shows in the logs, Slick is a pretty low tier provider you could add that additional environment variable mentioned
WARN OpenVPN 2.5 and 2.6 use OpenSSL 3 which prohibits the usage of weak security in today’s standards. slickvpn uses weak security which is out of Gluetun’s control so the only workaround is to allow such weaknesses using the OpenVPN option tls-cipher “DEFAULT:@SECLEVEL=0”. You might want to reach to your provider so they upgrade their certificates. Once this is done, you will have to let the Gluetun maintainers know by creating an issue, attaching the new certificate and we will update Gluetun.
environment
– tls-cipher=”DEFAULT:@SECLEVEL=0″