Debian CLI torrent program through VPN

bittorrentdebianopenvpnsocksvpn

Has anyone successfully set up a CLI-only (no web UI's!) torrent client that can tunnel all of its traffic through a VPN? (Either by sending all traffic through a particular interface or a SOCKS proxy)?

I have a Private Internet Access subscription and would like to use it to download torrent files on my headless Debian 7 machine without having to tunnel all of the traffic on my system.

Best Answer

The approach I would recommend is to route all your traffic through the VPN except SSH; this provides much more protection for your privacy and significantly reduces the risk of any personal information leaking.

This approach has several separate components.

Torrent client

rtorrent is an excellent torrent client for running in a headless environment. Run it in a tmux session so you can connect and disconnect at will.

Additionally, you can patch rtorrent with the canvas colour patch.

Routing traffic

Essentially, you want to set up packet filtering for all traffic on a specific port (your SSH port, here assumed to be non-standard 666) and interface (eth0). You can discover your gateway (here 192.168.1.1) with route -n. You will also need iproute2 installed for this:

ip rule add fwmark 65 table novpn
ip route add default via 192.168.1.1 dev eth0 table novpn
ip route flush cache
iptables -t mangle -A OUTPUT -p tcp --sport 666 -j MARK --set-mark 65
iptables -A INPUT -i tun0 -p tcp -m tcp --dport 666 -j DROP

Once you have it all setup and working, you'll need to script it to run at boot. See Ben. D's answer on Serverfault for a full walkthrough.

Browsing

Surfraw is excellent for command line browsing, and can hand off to w3m for loading the returned results.

Thanks to Gilles excellent answer here, it is possible to bind a key in w3m to trigger the magnets script from the rtorrent wiki. So, with this in your w3m config:

extbrowser /home/alex/bin/magnets %s

when you navigate to a magnet link, you can send it to rtorrent. See this post for the details.

Related Solutions

Redirect traffic through vpn on an as needed basis

There is no practical way to select different routes on an application-by-application or process-by-process basis. (Linux had one for a time: iptables --cmd-owner, but that disappeared in kernel 2.6.14). See Linux : restricting outgoing on an application basis.

You can select different routes on a user-by-user basis with iptables --uid-owner, or select different routes for different virtual machines. So given your requirements, you can use iptables, as long as you run the proxy as a dedicated user.

ip rule add fwmark 1 table 1
ip route add 0.0.0.0/0 table 1 dev tun0
iptables -t mangle -A OUTPUT -m owner --uid-owner proxy -j MARK --set-mark 1

See Dual network connection for explanations.