torrenting-with-thick-vnet-jail-on-freebsd
Differences
This shows you the differences between two versions of the page.
| torrenting-with-thick-vnet-jail-on-freebsd [2026-02-23 08:12:41] – created hyperreal | torrenting-with-thick-vnet-jail-on-freebsd [2026-03-14 20:20:27] (current) – removed hyperreal | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Setup a thick VNET jail on FreeBSD ====== | ||
| - | |||
| - | ===== Setup the VNET bridge ===== | ||
| - | |||
| - | Create the bridge. | ||
| - | |||
| - | <code bash> | ||
| - | ifconfig bridge create | ||
| - | </ | ||
| - | |||
| - | Attach the bridge to the main network interface. '' | ||
| - | |||
| - | <code bash> | ||
| - | ifconfig igb0bridge addm igc0 | ||
| - | </ | ||
| - | |||
| - | To make this persistent across reboots, add the following to '' | ||
| - | |||
| - | <code bash> | ||
| - | defaultrouter=" | ||
| - | cloned_interfaces=" | ||
| - | ifconfig_igc0bridge=" | ||
| - | </ | ||
| - | |||
| - | ===== Create the classic (thick) jail ===== | ||
| - | |||
| - | Create the ZFS datasets for the jails. We’ll use '' | ||
| - | |||
| - | <code bash> | ||
| - | zfs create -o mountpoint=/ | ||
| - | zfs create naspool/ | ||
| - | </ | ||
| - | |||
| - | Use the '' | ||
| - | |||
| - | <code bash> | ||
| - | export DISTRIBUTIONS=" | ||
| - | export BSDINSTALL_DISTSITE=https:// | ||
| - | bsdinstall jail / | ||
| - | </ | ||
| - | |||
| - | Run '' | ||
| - | |||
| - | <code bash> | ||
| - | freebsd-update -b / | ||
| - | freebsd-update -b / | ||
| - | </ | ||
| - | |||
| - | We now snapshot the '' | ||
| - | |||
| - | <code bash> | ||
| - | zfs snapshot naspool/ | ||
| - | zfs clone naspool/ | ||
| - | </ | ||
| - | |||
| - | We now use the following configuration for '' | ||
| - | |||
| - | <code bash> | ||
| - | torrenting { | ||
| - | exec.consolelog = "/ | ||
| - | allow.raw_sockets; | ||
| - | exec.clean; | ||
| - | mount.devfs; | ||
| - | devfs_ruleset = 11; | ||
| - | path = "/ | ||
| - | host.hostname = " | ||
| - | vnet; | ||
| - | vnet.interface = " | ||
| - | $id = " | ||
| - | $ip = " | ||
| - | $gateway = " | ||
| - | $bridge = " | ||
| - | $epair = " | ||
| - | | ||
| - | exec.prestart = "/ | ||
| - | exec.prestart += "/ | ||
| - | exec.prestart += "/ | ||
| - | exec.start += "/ | ||
| - | exec.start += "/ | ||
| - | exec.start += "/ | ||
| - | exec.stop = "/ | ||
| - | exec.poststop = "/ | ||
| - | exec.poststop += "/ | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | Now we create the devfs ruleset to enable access to devices under '' | ||
| - | |||
| - | <code bash> | ||
| - | [devfsrules_jail_vnet=11] | ||
| - | add include $devfsrules_hide_all | ||
| - | add include $devfsrules_unhide_basic | ||
| - | add include $devfsrules_unhide_login | ||
| - | add include $devfsrules_jail | ||
| - | add path ' | ||
| - | add path ' | ||
| - | </ | ||
| - | |||
| - | Enable the '' | ||
| - | |||
| - | <code bash> | ||
| - | sysrc jail_enable=" | ||
| - | sysrc jail_parallel_start=" | ||
| - | </ | ||
| - | |||
| - | Start the jail service for torrenting jail. | ||
| - | |||
| - | <code bash> | ||
| - | service jail start torrenting | ||
| - | </ | ||
| - | |||
| - | ===== Setting up Wireguard inside the jail ===== | ||
| - | |||
| - | Since we have the '' | ||
| - | |||
| - | <code bash> | ||
| - | jexec -u root torrenting | ||
| - | |||
| - | pkg install wireguard-tools wireguard-go | ||
| - | </ | ||
| - | |||
| - | Download a Wireguard configuration for ProtonVPN, and save it to '' | ||
| - | |||
| - | Enable Wireguard to run when the jail boots up. | ||
| - | |||
| - | <code bash> | ||
| - | sysrc wireguard_enable=" | ||
| - | sysrc wireguard_interfaces=" | ||
| - | </ | ||
| - | |||
| - | Start the Wireguard daemon and make sure you are connected to it properly. | ||
| - | |||
| - | <code bash> | ||
| - | service wireguard start | ||
| - | |||
| - | curl ipinfo.io | ||
| - | </ | ||
| - | |||
| - | The curl command should display the IP address of the Wireguard server defined in '' | ||
| - | |||
| - | ===== Setting up qBittorrent inside the jail ===== | ||
| - | |||
| - | Install the qbittorrent-nox package. | ||
| - | |||
| - | <code bash> | ||
| - | pkg install -y qbittorrent-nox | ||
| - | </ | ||
| - | |||
| - | Before running the daemon from '' | ||
| - | |||
| - | <code bash> | ||
| - | pkg install -y sudo | ||
| - | sudo -u qbittorrent qbittorrent-nox --profile=/ | ||
| - | </ | ||
| - | |||
| - | Copy the password displayed after running the command. Login to the qBittorrent web UI at http:// | ||
| - | |||
| - | Now press '' | ||
| - | |||
| - | <code bash> | ||
| - | sysrc qbittorrent_enable=" | ||
| - | sysrc qbittorrent_flags=" | ||
| - | </ | ||
| - | |||
| - | Enable the qBittorrent daemon. | ||
| - | |||
| - | <code bash> | ||
| - | service qbittorrent start | ||
| - | </ | ||
| - | |||
| - | Go back to the web UI at http:// | ||
| - | |||
| - | ===== Finding the forwarded port that the ProtonVPN server is using ===== | ||
| - | |||
| - | Install the libnatpmp package. | ||
| - | |||
| - | Make sure that port forwarding is allowed on the server you’re connected to, which it should be if you enabled it while creating the Wireguard configuration on the ProtonVPN website. Run the '' | ||
| - | |||
| - | <code bash> | ||
| - | natpmpc -g 10.2.0.1 | ||
| - | </ | ||
| - | |||
| - | If the output looks like the following, you’re good. | ||
| - | |||
| - | <code bash> | ||
| - | initnatpmp() returned 0 (SUCCESS) | ||
| - | using gateway : 10.2.0.1 | ||
| - | sendpublicaddressrequest returned 2 (SUCCESS) | ||
| - | readnatpmpresponseorretry returned 0 (OK) | ||
| - | Public IP address : 62.112.9.165 | ||
| - | epoch = 58081 | ||
| - | closenatpmp() returned 0 (SUCCESS) | ||
| - | </ | ||
| - | |||
| - | Now create the UDP and TCP port mappings, then loop natpmpc so that it doesn’t expire. | ||
| - | |||
| - | <code bash> | ||
| - | while true ; do date ; natpmpc -a 1 0 udp 60 -g 10.2.0.1 && natpmpc -a 1 0 tcp 60 -g 10.2.0.1 || { echo -e "ERROR with natpmpc command \a" ; break ; } ; sleep 45 ; done | ||
| - | </ | ||
| - | |||
| - | The port allocated for this server is shown on the line that says “Mapped public port XXXXX protocol UDP to local port 0 lifetime 60”. Port forwarding is now activated. Copy this port number and, in the qBittorrent web UI options menu, go to the Connections tab and enter it into the “Port used for incoming connections” box. Make sure to uncheck the “Use UPnP/ | ||
| - | |||
| - | If the loop terminates, you’ll need to re-run this loop script each time you start a new port forwarding session or the port will only stay open for 60 seconds. | ||
| - | |||
| - | ===== P2P NAT port forwarding script with supervisord ===== | ||
| - | |||
| - | Install supervisord. | ||
| - | |||
| - | <code bash> | ||
| - | sudo pkg install -y py311-supervisor | ||
| - | </ | ||
| - | |||
| - | Enable the supervisord service. | ||
| - | |||
| - | <code bash> | ||
| - | sudo sysrc supervisord_enable=" | ||
| - | </ | ||
| - | |||
| - | Edit '' | ||
| - | |||
| - | <code bash> | ||
| - | [program: | ||
| - | command=/ | ||
| - | autostart=true | ||
| - | </ | ||
| - | |||
| - | Add the following contents to a file at '' | ||
| - | |||
| - | <code bash> | ||
| - | #!/bin/sh | ||
| - | |||
| - | port=$(/ | ||
| - | echo $port | tee / | ||
| - | |||
| - | while true; do | ||
| - | date | ||
| - | if ! / | ||
| - | echo "error Failure natpmpc $(date)" | ||
| - | break | ||
| - | fi | ||
| - | sleep 45 | ||
| - | done | ||
| - | </ | ||
| - | |||
| - | Ensure the script is executable with '' | ||
| - | |||
| - | supervisord will start the above shell script automatically. Ensure supervisord service is started. | ||
| - | |||
| - | <code bash> | ||
| - | sudo service supervisord start | ||
| - | </ | ||
| - | |||
| - | The script will print out the forwarded port number at '' | ||
| - | |||
| - | <code bash> | ||
| - | cat / | ||
| - | 48565 | ||
| - | </ | ||
torrenting-with-thick-vnet-jail-on-freebsd.1771834361.txt.gz · Last modified: by hyperreal