How can I run one instance of qBittorrent connected to a VPN and one instance bypassing the VPN connection on a Raspberry Pi?

Question

I have a use case that requires one instance of qBittorrent to connect through a VPN and another instance that does not. I'd like to run both on a single Raspberry Pi. I am using PrivateInternetAccess VPN.

I tried the first solution I thought of and it almost works. First I connect to the VPN with the WireGuard protocol and disable the Kill Switch. I launch two instances of qBittorrent with different profiles using the --profile command line option. On the first one, I visit the advanced settings and specify the interface created for the VPN. (wgpia0 or something like that). On the second one, I visit the same setting and specify eth0. Using a port checker, I can see that both the VPN and public connections are live and reachable from the correct IP addresses. If I use ipleak.net's Torrent Detection feature, I show up correctly on the VPN, but it never finds me on the public instance. If I look at the tracker, the public one shows it as "Not Working". If I turn off the VPN, it suddenly starts working and I can be detected just fine.

I've searched and tweaked settings as much as I can, but I can't figure out why everything would work but the tracker connection. I can even download torrents just fine through DHT. So I obviously have a connection on that interface, but something about the tracker just doesn't work. I've checked the Execution Log and I don't see any errors (Although I can provide a redacted version of it if that would help).

This is still my preferred solution. I would prefer to figure out what is wrong with the tracker connection and fix it, but I'm out of options, so I came here. Is there is any way to debug this connection further?

I suspect that I may be able to solve this problem by running both instances in separate docker containers. If I can specify to each container which interface it should use, as long as the interface works at all, all traffic from the container should flow through it, which would hopefully solve this problem. I don't really want the administrative overhead of docker if it can be avoided, but I'm willing to accept it if it would work. I've never touched docker on a Pi before, I may have to make my own image for qBittorrent. Is my intuition correct? Would this solve the problem? I don't want to embark on this journey if the chance of success is low.

The last idea I have is I could try to use control groups as described here. That looks complex to set up and maintain. I'd prefer to avoid this and would only pursue it if there is no other way. Is this the canonical solution? The way it's "supposed" to be done? If so, I suppose I shouldn't waste my time on other methods and learn how to do this.

Are there any other solutions I have not considered? I'll be happy with anything that works as long as I can reasonably understand and maintain it.

Answer 1

Docker is the way to go here. There are containers that replace the network stack of other containers. Gluetun is a popular example. You can create a docker-compose file that has two qBittorrent containers and connect one of them to the Gluetun network. This should work just fine on a Pi, Gluetun supports it and many popular qBittorrent containers support it also.

You will also need a way to keep the qBittorrent listening port up-to-date with the port forwarded from the VPN, if you plan to use that. I didn't see any other reasonable solutions, so I made my own: qbittorrent-gluetun-port-forward. This image supports amd64 and arm64, so it should work on Raspberry Pi 4 as well as traditional desktops and laptops.

A (very abbreviated) docker-compose.yml to implement this might look something like this.

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    ports:
      - 13492:8000     # Gluetun Control server
      - 13491:13491    # qBittorrent WebUI
    environment:
      - VPN_PORT_FORWARDING=on
    restart: "unless-stopped"
  qbittorrent-vpn:
    image: lscr.io/linuxserver/qbittorrent:latest
    network_mode: service:gluetun
    environment:
      - WEBUI_PORT=13491
    restart: "unless-stopped"
  qbittorrent-port-update:
    image: technosam/qbittorrent-gluetun-port-update:1.1
    network_mode: service:gluetun
    environment:
      - QBITTORRENT_WEBUI_PORT=13491
    restart: "unless-stopped"
  qbittorrent-public:
    image: lscr.io/linuxserver/qbittorrent:latest
    environment:
      - WEBUI_PORT=27054
    ports:
      - 27054:27054     # WebUI
      - 6881:6881       # Listen port
    restart: "unless-stopped"