Loading
Isolate download containers behind VPN tunnels while keeping local media servers unblocked.
You do not want your entire Synology or TrueNAS file storage unit running behind a distant VPN IP because it blocks local streaming platforms, back-ups, and plex configurations on your immediate home network. This guide details how to create custom static route tables or run specific download client engines inside isolated Docker/container namespaces running exclusively on virtual port mappings.
Rather than binding the hardware interface, deploy an isolated network model in docker called "Gluetun" (a highly lightweight secure tunnel helper container). This manager manages VPN certificates and acts as a central proxy and gateway for all companion containers.
Create a single docker-compose stack. Bind your download client container (e.g., Transmission, qBittorrent) directly to the network bridge of the Gluetun secure container. The download packages must route packets exclusively through the proxy interface.
version: "3"
services:
gluetun:
image: qmcgaw/gluetun
cap_add:
- NET_ADMIN
environment:
- VPN_SERVICE_PROVIDER=nordvpn
- OPENVPN_USER=cli-username-here
- OPENVPN_PASSWORD=cli-password-here
- SERVER_REGIONS=us-east
ports:
- 8080:8080 # Download UI Port
torrent-client:
image: linuxserver/qbittorrent
network_mode: "service:gluetun" # Forces absolute tunnel encapsulationIf you are running the native OS stack, write custom IP rules into NAS terminal tasks. This commands force all packets moving from user group "secured_files" to route out through the VPN network card interface.
# Create a custom terminal routing table
echo "200 secure_lan" >> /etc/iproute2/rt_tables
# Link user group " secure_downloader" to the custom routing table
ip rule add gid 999 table secure_lan
# Force default routing pathway inside secure_lan table
ip route add default dev tun0 table secure_lanAlways verify tunnel IP inside the isolated download engine. Open the console tab inside the torrent container and execute "curl ifconfig.me" to verify that the visible IP represents the VPN server instead of your domestic ISP.
Require custom hardware integration support?
Contact support