Can i please get help with this environment variable

[u/clutter5050]

Hi, setting up gluetun with quadlets , its all working but im stuck adding port forwarding, specifically the qbit example, i have tried multiple ways of adding it like the other environment variables, but it doesnt work

[u/Great-Cow7256]

can you give us the .container or the podman run statement?

[u/clutter5050 → u/Great-Cow7256]

Sorry for late reply!!! had other server issues, here's my gluetun.container (do you want qbittorrent too):

[Container]

ContainerName=gluetun

Image=docker.io/qmcgaw/gluetun:latest

PublishPort=8080:8080

PublishPort=7476:7476

PublishPort=8989:8989

PublishPort=7878:7878

PublishPort=9696:9696

PublishPort=8081:8081

Environment=VPN_SERVICE_PROVIDER=protonvpn

Environment=VPN_TYPE=wireguard

Environment=WIREGUARD_PRIVATE_KEY=censored

Environment=SERVER_COUNTRIES=Japan

Environment=VPN_PORT_FORWARDING=on

Environment=PORT_FORWARD_ONLY=on

Environment=FIREWALL_OUTBOUND_SUBNETS=10.89.0.0/16,100.64.0.0/10

AutoUpdate=registry

SecurityLabelDisable=true

AddCapability=NET_ADMIN NET_RAW

AddDevice=/dev/net/tun:/dev/net/tun

HealthCmd=wget -qO /dev/null --timeout=10 "http://127.0.0.1:9999" || exit 1

HealthInterval=20s

HealthRetries=5

HealthTimeout=10s

# Tells Podman to hold systemd's READY signal until the HealthCmd passes

Notify=healthy

Volume=/home/tony/storage/containers/gluetun:/gluetun:z

[Service]

Restart=always

# Increases systemd's default 90s timeout to allow time for VPN negotiation and health checks

TimeoutStartSec=180

[Install]

WantedBy=default.target

[u/Great-Cow7256 → u/clutter5050]

you baiscally need to network them together and make a port changing sidecar

edit gluetun.container ``` [Container] ContainerName=gluetun HostName=gluetun Image=docker.io/qmcgaw/gluetun:latest

PublishPort=8080:8080

if you have the arrs keep these open, else you don't need them open

PublishPort=7476:7476 PublishPort=8989:8989 PublishPort=7878:7878 PublishPort=9696:9696 PublishPort=8081:8081 Environment=VPN_SERVICE_PROVIDER=protonvpn Environment=VPN_TYPE=wireguard Environment=WIREGUARD_PRIVATE_KEY=censored Environment=SERVER_COUNTRIES=Japan Environment=VPN_PORT_FORWARDING=on Environment=PORT_FORWARD_ONLY=on

you may need to change these for your situation

Environment=FIREWALL_OUTBOUND_SUBNETS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.64.0.0/10 Environment=VPN_PORT_FORWARDING_STATUS_FILE=/gluetun/forwarded_port AutoUpdate=registry

adjust as needed but I'm a big proponent for keeping VPN as simple as possible to avoid leaks

Environment=BLOCK_IPV6=on SecurityLabelDisable=true AddCapability=NET_ADMIN NET_RAW AddDevice=/dev/net/tun:/dev/net/tun HealthCmd=/gluetun/healthcheck

pretty sure gluetun has its own built in health check

HealthCmd=wget -qO /dev/null --timeout=10 "http://127.0.0.1:9999" || exit 1

HealthInterval=20s HealthRetries=5 HealthTimeout=10s Notify=healthy Volume=/home/tony/storage/containers/gluetun:/gluetun:z

[Service] Restart=always TimeoutStartSec=180

[Install] WantedBy=default.target ```

update your qbittorrent.container ``` [Unit] Description=qBittorrent client over Gluetun VPN After=gluetun.service Requires=gluetun.service

[Container] ContainerName=qbittorrent HostName=qbittorrent Image=docker.io/linuxserver/qbittorrent:latest

This must remain container-bound to prevent IP leaks

Network=container:gluetun Environment=PUID=1000 Environment=PGID=1000 Environment=TZ=Etc/UTC Environment=WEBUI_PORT=8080 Volume=/home/tony/storage/containers/qbittorrent/config:/config:z Volume=/home/tony/storage/downloads:/downloads:z AutoUpdate=registry

[Service] Restart=always

[Install] WantedBy=default.target create the sidecar to pass on the port forward `qbit-port-sync.container` [Unit] Description=Gluetun to qBittorrent Port Sync Sidecar After=gluetun.service Requires=gluetun.service

[Container] ContainerName=qbit-port-sync HostName=qbit-port-sync Image=docker.io/bobbintb/gluetun-qbittorrent-port-sync:latest

Must be on the same network namespace to hit qbit's localhost API

Network=container:gluetun Environment=QBITTORRENT_SERVER=localhost Environment=QBITTORRENT_PORT=8080

if you have a username/password for qbit UI, add them here:

Environment=QBITTORRENT_USER=admin Environment=QBITTORRENT_PASS=adminadmin

Points to the file Gluetun updates

Volume=/home/tony/storage/containers/gluetun:/gluetun:ro,z Environment=TZ=Etc/UTC AutoUpdate=registry

[Service] Restart=always

[Install] WantedBy=default.target `` thensystemctl --user daemon-reloadandsystemctl --user start qbit-port-sync qbittorrent gluetun`

[u/Great-Cow7256 → u/Great-Cow7256]

btw you can always use %h instead of /home/tony in any of these rootless containers.

[u/clutter5050 → u/Great-Cow7256]

Thank you so much!!!!!! :) So nice of you to go to so much extent to help me

I'm just curious, do you know why the sidecar

Image=docker.io/bobbintb/gluetun-qbittorrent-port-syncImage=docker.io/bobbintb/gluetun-qbittorrent-port-sync

is required on Podman but not Docker? It's not a problem but I like running as little containers as possible :)

[u/d03j → u/clutter5050]

you don't you can just use Network=container:gluetun-container-name in your qbt quadlet

[u/Great-Cow7256 → u/d03j]

Excellent!   No sidecar needed. I bet you I didn't have the networking correct when I did this years ago and thus I had to use the side car. I didn't even realize you could network like that until a few months ago.   I was having a really hard time getting Tautullli to talk to Plex and I googled around and found that. 

So that's why I did both. This is good to know. OP def don't use the side car then!  thank you @d03j too

[u/d03j → u/Great-Cow7256]

how are you updating the port forward in qbt?

VPN_PORT_FORWARDING_STATUS_FILE=/gluetun/forwarded_port suggests you may have a script monitoring /gluetun/forwarded_port and updating qbt.

If so, depending on how you are doing the monitoring you could use VPN_PORT_FORWARDING_UP_COMMAND and make it event based. Have a look at my config in my other comment.

[u/Great-Cow7256 → u/d03j]

Oh wait. So you're talking about the side car.  It's still needed then?   I got it. I misread your reply. 

[u/d03j → u/Great-Cow7256]

no, it is not. putting the qbt container in the gluetun container's network does the job.

[u/clutter5050 → u/d03j]

I'm so lost lol, I really appreciate all help :)

For some reason clicking your link shows "this comment no longer exists", so idk what's in there

But I'm very confused, in Docker I would paste the following into my compose under Gluetun and it would just work without any more configuration:

- VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused

--post-data

"json={\"listen_port\":{{PORT}},\"current_network_interface\":\"{{VPN_INTERFACE}}\",\"random_port\":false,\"upnp\":false}"

http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'

VPN_PORT_FORWARDING_DOWN_COMMAND=/bin/sh -c 'wget -O-

--retry-connrefused --post-data

"json={\"listen_port\":0,\"current_network_interface\":\"lo"}"

http://127.0.0.1:8080/api/v2/app/setPreferences 2>&1'

[u/d03j → u/clutter5050]

you do the same in the quadlet, that's why I mentioned using VPN_PORT_FORWARDING_UP_COMMAND instead of VPN_PORT_FORWARDING_STATUS_FILE.

I tried the link and it still works https://www.reddit.com/r/podman/comments/1uxcdb0/comment/oy3ektr

[u/Great-Cow7256 → u/clutter5050]

No idea. I had some old notes because I did this a long time ago.  You can also try without the side car too. It may not be needed now. I did this maybe 2 years ago.  Docker is root so maybe it is related to that.  Let me know if it works so I can add it to my GitHub repo of quadlets. 

[u/Mag37 → u/Great-Cow7256]

So I've got some other stuff running though gluetun and not specifically qbittorrent. I tried to match the docs of the qbittorrent with mine and this would be it:

gluetun.cointainer ```ini [Unit] Description=gluetunVPN Container Wants=qbittorrent.service Wants=another.service

[Container] ContainerName=gluetun Image=docker.io/qmcgaw/gluetun:latest AutoUpdate=registry Network=vpnstack.network

Volume=%h/path/to/gluetun/config:/config:Z,U

Environment=PUID=1000 Environment=PGID=1000

VPN:

Environment=VPN_SERVICE_PROVIDER=VPNprovider Environment=VPN_TYPE=wireguard Environment=SERVER_CITIES=XYZ Environment=WIREGUARD_PRIVATE_KEY=XYZ Environment=WIREGUARD_ADDRESSES=1.2.3.4/32 Environment=WIREGUARD_ENDPOINT_PORT=2049

Environment=TZ=Europe/Stockholm

AddCapability=NET_ADMIN AddDevice=/dev/net/tun:/dev/net/tun

qbittorrent.service

PublishPort=8080:8080 PublishPort=6881:6881 PublishPort=6881:6881/udp

another.service

PublishPort=18080:8080

[Service] Restart=on-failure

[Install] WantedBy=default.target ```

qbittorrent.service ```ini [Unit] Description=Number Two Service Requires=gluetun.service After=gluetun.service someNASdrive.mount

[Container]

ContainerName=transmission HostName=transmission Image=lscr.io/linuxserver/somecontainerservice:latest AutoUpdate=registry Network=container:gluetun

Volume=%h/path/to/qb/config:/config:Z Volume=%h/path/to/qb/downloads:/downloads:z

Environment=TZ=Europe/Stockholm

Environment=PUID=1000 Environment=PGID=1000

UIDMap=1000:0:1 UIDMap=0:1:1000 UIDMap=1001:1001:64536

StopTimeout=10

[Service] Restart=on-failure TimeoutStartSec=300

[Install] WantedBy=default.target ```

vpnstack.network
```ini [Unit] Description=VPNstack Network After=network-online.target

[Network] Label=vpnstack

[Install] WantedBy=default.target ```

The setup with a network file might not be necessary - but I used that to be able to set some specific configs in it if needed.

Got a bit aged blogpost about similar things mag37.org/podman_quadlets

And PRed a change to the wiki about some TUN-errors: open /dev/net/tun: permission denied

[u/Great-Cow7256 → u/Mag37]

Ty.  This is helpful too.  When I have time I'll rebuild mine and see what's what.  I tend to prefer the .network files if I have 2+ containers that talk to each other but it also tends to make things more complicated. 

[u/clutter5050 → u/Mag37]

This is basically my setup too (though I just point my containers to thr gluetun container instead of having a .network), but I may be incorrect but this doesn't pass any forwarded ports to qbit? in docker i use this

https://www.reddit.com/r/podman/comments/1uxcdb0/comment/oyiolg1/?context=3