MichaIng
Hello
I’m back and I have a solution and some results of my tryouts and i hope you convert some of DietPi Optimized Software
So I’ve tried all of this with XU4Q.
As Result: Torrenting with an “open Port” does not work with NordVPN! That’s not possible they don’t support this feature. I’ve tried 4 VPN Provider and the free one you have posted before.
I have found only Hide.me and PIA they support this feature and the price is “harder” acceptable. For PIA, there you have to Open a Port via script and you’ll get as result of this operation an open port:
I have modified following htpcguides-guides scripts for that:
pia.sh
#!/usr/bin/env bash
# Source: http://www.htpcguides.com
# Adapted from https://github.com/blindpet/piavpn-portforward/
# Author: Mike and Drake
# Based on https://github.com/crapos/piavpn-portforward
# Set path for root Cron Job
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
USERNAME=USERNAME
PASSWORD=PASSWORD
VPNINTERFACE=tun0
VPNLOCALIP=$(ifconfig $VPNINTERFACE | awk '/inet / {print $2}' | awk 'BEGIN { FS = ":" } {print $(NF)}')
CURL_TIMEOUT=5
CLIENT_ID=$(uname -v | sha1sum | awk '{ print $1 }')
# set to 1 if using VPN Split Tunnel
SPLITVPN="1"
#get VPNIP
VPNIP=$(curl -m $CURL_TIMEOUT --interface $VPNINTERFACE "http://ipinfo.io/ip" --silent --stderr -)
#echo $VPNIP
#request new port
PORTFORWARDJSON=$(curl -m $CURL_TIMEOUT --silent --interface $VPNINTERFACE 'https://www.privateinternetaccess.com/vpninfo/port_forward_assignment' -d "user=$USERNAME&pass=$PASSWORD&client_id=$CLIENT_ID&local_ip=$VPNLOCALIP" | head -1)
#trim VPN forwarded port from JSON
echo $PORTFORWARDJSON
PORT=$(echo $PORTFORWARDJSON | awk 'BEGIN{r=1;FS="{|:|}"} /port/{r=0; print $3} END{exit r}')
echo $PORT
#change firewall rules if SPLITVPN is set to 1
if [ "$SPLITVPN" == "1" ]; then
#change firewall rules if necessary
IPTABLERULETWO=$(iptables -L INPUT -n --line-numbers | grep -E "2.*reject-with icmp-port-unreachable" | awk '{ print $8 }')
if [ -z $IPTABLERULETWO ]; then
sudo iptables -D INPUT 2
sudo iptables -I INPUT 2 -i $VPNINTERFACE -p tcp --dport $PORT -j ACCEPT
else
sudo iptables -I INPUT 2 -i $VPNINTERFACE -p tcp --dport $PORT -j ACCEPT
fi
fi
also Firewallscripts for stratup and shutdown of tunnel and so on
iptables.sh
! /bin/bash
# Niftiest Software – www.niftiestsoftware.com
# Modified version by HTPC Guides – www.htpcguides.com
export INTERFACE="tun0"
export VPNUSER="vpn"
export LOCALIP="<localip>"
export NETIF="eth0"
# flushes all the iptables rules, if you have other rules to use then add them into the script
iptables -F -t nat
iptables -F -t mangle
iptables -F -t filter
# mark packets from $VPNUSER
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT ! --dest $LOCALIP -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT --dest $LOCALIP -p udp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT --dest $LOCALIP -p tcp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT ! --src $LOCALIP -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
# allow responses
iptables -A INPUT -i $INTERFACE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# block everything incoming on $INTERFACE to prevent accidental exposing of ports
iptables -A INPUT -i $INTERFACE -j REJECT
# let $VPNUSER access lo and $INTERFACE
iptables -A OUTPUT -o lo -m owner --uid-owner $VPNUSER -j ACCEPT
iptables -A OUTPUT -o $INTERFACE -m owner --uid-owner $VPNUSER -j ACCEPT
# all packets on $INTERFACE needs to be masqueraded
iptables -t nat -A POSTROUTING -o $INTERFACE -j MASQUERADE
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# reject connections from predator IP going over $NETIF
iptables -A OUTPUT ! --src $LOCALIP -o $NETIF -j REJECT
# Start routing script
/etc/openvpn/routing.sh
exit 0
routing.sh
#! /bin/bash
# Niftiest Software – www.niftiestsoftware.com
# Modified version by HTPC Guides – www.htpcguides.com
VPNIF="tun0"
VPNUSER="vpn"
GATEWAYIP=$(ifconfig $VPNIF | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | egrep -v '255|(127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})' | tail -n1)
if [[ `ip rule list | grep -c 0x1` == 0 ]]; then
ip rule add from all fwmark 0x1 lookup $VPNUSER
fi
ip route replace default via $GATEWAYIP table $VPNUSER
ip route append default via 127.0.0.1 dev lo table $VPNUSER
ip route flush cache
# run update-resolv-conf script to set VPN DNS
/etc/openvpn/update-resolv-conf
exit 0
as last the openvpn 4 PIA
client
dev tun
proto udp
remote <PIA-SERVER> <PIA PORT: 1197 or 1198 depends on server>
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
auth-user-pass /etc/openvpn/login.txt
auth-nocache
comp-lzo
verb 1
reneg-sec 0
crl-verify /etc/openvpn/crl.rsa.2048.pem
ca /etc/openvpn/ca.rsa.2048.crt
disable-occ
script-security 2
route-noexec
#up and down scripts to be executed when VPN starts or stops
up /etc/openvpn/iptables.sh
down /etc/openvpn/update-resolv-conf
and PIAs ovpn-files are in client subfolder placed.
login.txt only PIAs USERNAME and PASSSWORD written in.
the resultport of pia.sh is the open one for transmission. don’t use uPnP and DHT, LPD, uTP … all this should disabled.
After that Transmission is happy.
Also this mysterious Splittunnel I’ve tried. So for my experience I think it’s a must have. Otherwise you cannot open Website for remote torrenting.
Also this nGix Reverse Proxy …
At this Point I’ve had some Problems with clean installs. Sometimes doing a fresh install, the setup of dietpi routine runns in an endless loop.
I have to break it with control C and doing Dietpi-Update; restart and finish the setup.
You have Dietpi-NordVPN … If it’s possible to modify this so that PIA or others get’s also a GUI and Splittunel. I have had really massive problems with this iptables stuff.
Also an userscript like that pia.sh above at startup to get an open port
A re-setup is a little complicated … this would be very very nice from you guys if you modify NORD VPN for PIA an these iptables scripts. For all of us users, security should always have a little space at our playgrounds at these days.
Have fun and nice days
yours
luzi
please apologize my english it’s not my best feature 
. Perhaps we turn it into DietPi-VPN and add support for other VPN providers in the feature, but that’s currently out of scope.