I depend on torrenting to watch my TV shows and movies.
For years, I've been torrenting without a VPN. My ISP was Vidéotron and I trusted them.
However, at the new house we've built, Vidéotron is not a good option. So we've switched to Starlink.
Unfortunately, Starlink does not like you torrenting on their service.
So now, I need my torrenting to go through a VPN. I chose NordVPN because it sounded nice and people online said it was good for torrenting.
However, I still want all of my other Internet needs to go through Starlink and not the VPN. Only torrenting should be going through the VPN.
Split tunneling is not available for my iMac. « Split tunneling » is used to have some apps go through the tunnel while others don't. I also do not want to install NordVPN's app on my iMac.
So, my plan was to have my linux server connect to NordVPN and share its access on a VLAN between it and my iMac.
On macOS, it is possible to add "virtual network interfaces" that allow us to connect to multiple networks over the same network cable using VLAN. I will be using those so my iMac can communicate with my local network and also be able to download torrents at the same time. (The TV shows I watch are saved on my server. It is better to not have to go through the Internet to watch them).
The goal is to create a link between the iMac and the server with a static IPv4 address on each end.
I will be using network 192.168.9.0/24 on VLAN 9 with routing table 9.
On the server side, add this to your netplan file (mine is at /etc/netplan/00-installer-config.yaml) :
vlans:
vlan9:
id: 9
link: eno1
addresses:
- 192.168.9.2/24
routes:
- to: 192.168.9.0/24
scope: link
table: 9
routing-policy:
- from: 192.168.9.0/24
table: 9
"vlan9" can be any string you want. "vlans:" must be at the same level as "ethernets:"
"id: 9" selects the VLAN used.
"link: eno1" selects the network interface the VLAN will be using. Choose the one connected to the same switch as the iMac. (It should be at the top of the ethernets: section)
The routing-policy: setting separates all traffic from the 192.168.9.0/24 network and puts it in its own routing table so it can have different routes than the default ones.
The routes: section allows ping to work.
If you are using a managed switch, tag the VLAN on the ports.
Apply the changes :
sudo netplan apply
On the iMac side, add a new VLAN interface. (Apple provides instructions for this one, use the same VLAN as the "id:" field in the netplan file) and set it to a static IPv4 address :
You may now test the connection. Do ping 192.168.9.3 on the server and ping 192.168.9.2 on the iMac.
All outgoing traffic on the iMac's virtual interface will be sent to the default gateway, in this case the server.
You may want to reorder the interfaces on your iMac to put things the way you like (personally, I put Ethernet before VLAN).
First, log into your NordVPN dashboard.
Then, visit Server recommendation and download « OpenVPN UDP » of the first server.
You will also need the username and password from Service credentials.
Now, you may install openvpn on the server.
sudo apt install openvpn
Take the .ovpn file you downloaded, rename it "torrent.conf" and put it in /etc/openvpn/client/
On the second line of torrent.conf, change dev tun for dev tun0 and add this at the end :
auth-user-pass pass.txt route-noexec # Don't add or remove routes automatically script-security 2 # Allow user-defined scripts to be called down down.sh # Run script called "down.sh" when connection goes down up up.sh # Run script called "up.sh" when connection comes up
Put the username and password in a file named pass.txt and put it in the same folder as torrent.conf. (Put the username on the first line and the password on the second)
In that same folder, create up.sh :
#!/bin/sh ip route add default via $route_vpn_gateway table 9 ip route flush cache
and down.sh :
#!/bin/sh ip route del default via $route_vpn_gateway table 9 ip route flush cache
The goal is to disable openvpn's default routes and create our own that forwards anything from the VLAN through the VPN.
"table 9" corresponds to the "table: 9" settings in the netplan file.
Make sure the permissions are proper :
chmod +x up.sh down.sh
You are now ready to start the openvpn client :
sudo systemctl start openvpn-client@torrent.service
To test the connection, this should get you the VPN's public IP address :
curl --interface tun0 ifconfig.me
Before enabling forwarding, the firewall must be set up.
I use nftables as my firewall. You will need to add this to /etc/nftables.conf :
table inet filter {
# ... (existing rules)
chain forward {
type filter hook forward priority 0; policy drop;
iifname "vlan9" oifname "tun0" accept
iifname "tun0" oifname "vlan9" ct state established,related accept
}
}
table ip nat {
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "tun0" masquerade
}
}
If you have chosen a name other than vlan9 for the VLAN, replace it.
This will allow traffic between the two interfaces and enable NAT so the requests to the Internet have the proper source IP address. All outgoing traffic is allowed and only replies are allowed back.
Apply the changes :
sudo nft -f /etc/nftables.conf
For Ubuntu to act as a router between the VLAN and the VPN, IPv4 forwarding must be enabled.
First, check if forwarding is already enabled :
sysctl net.ipv4.ip_forward
If it is set to zero, enable forwarding permanently like this :
echo net.ipv4.ip_forward=1 | sudo tee -a /etc/sysctl.d/torrent.conf sudo sysctl -w net.ipv4.ip_forward=1
You can test the setup by running this in Terminal on the iMac :
curl --interface vlan0 ifconfig.me
which should give you the IP of the VPN.
Just go to Settings > Advanced > Network Interface and choose vlan0 (or whatever what the interface you created was) and restart the app.
I recommend testing the IP used by qBittorrent using torrentpeek.net.
Enjoy !
I also made this AppleScript that tells you the IP of the VPN :
display dialog (do shell script "curl --interface vlan0 ifconfig.me") buttons "Awesome" default button "Awesome"
I exported the script to an app I added to my dock.
You will need to start the VPN connection after every reboot :
sudo systemctl start openvpn-client@torrent.service
Technically, you can enable it forever by using "systemctl enable ...", but I don't want to do that on my own server just in case it blocks booting if it cannot connect (although I'm not sure that can happen).
My previous setup used to work with my ER605 router, but it can no longer connect to NordVPN.
And my previous previous setup used to work with a SOCKS5 proxy.