ProtonVPN Port Forwarding Setup

[IBNobody]

Since #2596 was open by a different user, was closed, and the user did not give clear details, I would like to continue the discussion here in a new discussion.

There are some issues with ProtonVPN that need to be worked through that I need some help with.

ProtonVPN doesn't tell you your port forward. You have to use natpmpc to set up port mappings.

https://protonvpn.com/support/port-forwarding-manual-setup/

The first step is to run...

sudo docker exec TransmissionVPN bash -c "apt update ; apt install natpmpc -y"

...to update the package list and install natpmpc. This only has to be run once upon docker creation.

Then you need to run sudo docker exec TransmissionVPN bash -c "natpmpc -a 0 0 udp 60 ; natpmpc -a 0 0 tcp 60"

This needs to be run every 60 seconds.

Sample output can be seen on ProtonVPN's website.

The magical grep setup to cull the port forward port is grep -oP -m 1 '(?<=public port ).*(?= protocol)'"

I lifted that and cleaned it up from here: https://www.reddit.com/r/ProtonVPN/comments/10n0w0m/port_forwarding_on_debiadietpi_with_wireguard/

However, what I need to figure out is...

• What is the recommended way for this docker container to add in a cron job to run those natpmpc commands?
• If I write a script to capture the port, how do I update / restart Transmission?

Right now, I'm manually having to update the port number, and that gets really annoying.

[edgd1er]

• specific provider operations (package download, configuration, checks, ....) may be added to configure-openvpn.sh in vpn-configs-contrib' project. Each provider has a directory. Here is an example for nordvpn https://github.com/haugene/vpn-configs-contrib/blob/main/openvpn/nordvpn/configure-openvpn.sh
• There is no service in this image:
  • transmission is started as a background task.

    docker-transmission-openvpn/transmission/start.sh

    Line 104 in 42eb2ee

    exec su --preserve-environment ${RUN_AS} -s /bin/bash -c "/usr/local/bin/transmission-daemon ${TRANSMISSION_LOGGING} -g ${TRANSMISSION_HOME} --logfile $LOGFILE" &

    . You may try to stop and start transmission the way tunnelup.sh does:

    docker-transmission-openvpn/openvpn/tunnelUp.sh

    Line 64 in 42eb2ee

    /etc/transmission/start.sh

  • no cron is available, but you could start an infinite loop with a sleep period of 60 sec.
• This image has a pre-start script available.
  

  docker-transmission-openvpn/transmission/start.sh

  Lines 21 to 26 in 42eb2ee

  	# If transmission-pre-start.sh exists, run it
  	if [[ -x /scripts/transmission-pre-start.sh ]]; then
  	echo "Executing /scripts/transmission-pre-start.sh"
  	/scripts/transmission-pre-start.sh "${USER_SCRIPT_ARGS[@]}"
  	echo "/scripts/transmission-pre-start.sh returned $?"
  	fi

[IBNobody]

Hmm... So that gives me some options, especially with the /etc/transmission/start.sh and /etc/transmission/stop.sh. But what I'm not sure on now is how to set the port. I need to set peer-port in the configuration.

In writing the response to you, @edgd1er , I found something useful.

This script is tantalizingly close to what I need as it doesn't need to bring down Transmission. It only needs remote access to update the port setting.

https://github.com/haugene/vpn-configs-contrib/blob/main/openvpn/pia/update-port.sh

However, I can't seem to get past the login for transmission-remote.

transmission-remote $TRANSMISSION_RPC_PORT $myauth -l

That translates to...

transmission-remote 9091 --auth <my_username_from_/config/transmission-credentials.txt>:<my_password_from_/config/transmission-credentials.txt> -l

Giving me the Unexpected response: <h1>401: Unauthorized</h1><p>Unauthorized User. 2 unsuccessful login attempts.</p> error.

edit: It's because my password is hashed. Not sure how I can use this method if the password is hashed.

[IBNobody]

This is what I got working...

It's not pretty, and I settled on running it as a task on my Synology (docker exec), but it works for now.

I'll open another question regarding the transmission-remote and passwords.

#!/bin/bash
source /etc/openvpn/utils.sh

. /etc/transmission/environment-variables.sh

# Settings
TRANSMISSION_PASSWD_FILE=/config/transmission-credentials.txt

transmission_username=$(head -1 ${TRANSMISSION_PASSWD_FILE})
# transmission_passwd=$(tail -1 ${TRANSMISSION_PASSWD_FILE})
transmission_passwd=<insert your unhashed pw here>
transmission_settings_file=${TRANSMISSION_HOME}/settings.json

# sleep 5

bind_port () {
pf_port=$(natpmpc -a 0 0 tcp 60 > nul ; natpmpc -a 0 0 udp 60 | grep -oP -m 1 '(?<=public port ).*(?= protocol)')
echo Port is $pf_port
}

bind_trans () {
new_port=$pf_port
#
# Now, set port in Transmission
#

# Check if transmission remote is set up with authentication
auth_enabled=$(grep 'rpc-authentication-required\"' "$transmission_settings_file" \
                   | grep -oE 'true|false')


if [[ "true" = "$auth_enabled" ]]
  then
  echo "transmission auth required"
  myauth="--auth $transmission_username:$transmission_passwd"
else
    echo "transmission auth not required"
    myauth=""
fi

# make sure transmission is running and accepting requests
echo "waiting for transmission to become responsive"
echo transmission-remote $TRANSMISSION_RPC_PORT $myauth -l
until torrent_list="$(transmission-remote $TRANSMISSION_RPC_PORT $myauth -l)"; do sleep 10; done
echo "transmission became responsive"
output="$(echo "$torrent_list" | tail -n 2)"
echo "$output"

# get current listening port
transmission_peer_port=$(transmission-remote $TRANSMISSION_RPC_PORT $myauth -si | grep Listenport | grep -oE '[0-9]+')
if [[ "$new_port" != "$transmission_peer_port" ]]; then
  if [[ "true" = "$ENABLE_UFW" ]]; then
    echo "Update UFW rules before changing port in Transmission"

    echo "denying access to $transmission_peer_port"
    ufw deny "$transmission_peer_port"

    echo "allowing $new_port through the firewall"
    ufw allow "$new_port"
  fi

  echo "setting transmission port to $new_port"
  transmission-remote ${TRANSMISSION_RPC_PORT} ${myauth} -p "$new_port"

  echo "Checking port..."
  sleep 10
  transmission-remote ${TRANSMISSION_RPC_PORT} ${myauth} -pt
else
    echo "No action needed, port hasn't changed"
fi
}

echo "Running functions for token based port fowarding"
bind_port
bind_trans

echo "#######################"
echo "        SUCCESS        "
echo "#######################"
echo "Port: $pf_port"