I've gotten a Private Internet Access VPN setup on a Mythbuntu 14.04 machine and I am at wits end trying to get port forwarding working with rTorrent (and ruTorrent). My setup is rTorrent running under a dedicated user account with all internet traffic for that user only directed through the VPN via OpenVPN and some iptables rules. I receive a forwarded port from PIA but using that port number with rTorrent doesn’t show the port as being forwarded in the ruTorrent web GUI. I've tried a plethora of iptables forwarding rules to no avail – no matter what I try the ruTorrent web GUI shows the rtorrent port as being blocked. I've used port scanners and I can see that the allocated port on the external VPN IP address is open and I can also see that rTorrent is listening on the allocated port. I have tried the port forwarding with OpenVPN running system wide and the ruTorrent webUI shows the port as forwarded – so I'm guessing my issue stems from the fact that the VPN is only active for one user and that I'm using iptables to achieve this – but I can't figure out how to make it work.

The command I'm using to start OpenVPN (note the --route-nopull argument):

sudo openvpn --config /home/prime/.pia/Russia.ovpn  --auth-user-pass /home/prime/.pia/passwd --script-security 2 --up /home/prime/.pia/up.sh --down /home/prime/.pia/down.sh --route-nopull --ca /home/prime/.pia/ca.crt --crl-verify /home/prime/.pia/crl.pem

My up.sh file which sets up the iptable rules for the 'torrent' user:

iptables -t mangle -I OUTPUT -m owner --uid-owner torrent -j MARK --set-mark 42
iptables -t mangle -I OUTPUT -d -m owner --uid-owner torrent -j RETURN
iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE
ip rule add fwmark 42 table 42

for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do
    echo 0 > $f

ip route add default via $(ifconfig -a tun0 | grep -o 'P-t-P:[^ ]*' | cut -d : -f 2) table 42

sleep 1

ip route flush cache

....applications load from here on

The iptables rule I am using (I've tried a great deal more too) to no avail:

IPADDRESS=$(ifconfig tun0|grep -oE "inet addr: *10\.[0-9]+\.[0-9]+\.[0-9]+"|tr -d "a-z :")
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -I PREROUTING -i tun0 -p tcp -j DNAT --to $IPADDRESS:$PORT
iptables -t nat -I PREROUTING -i tun0 -p udp -j DNAT --to $IPADDRESS:$PORT
#iptables -t nat -I PREROUTING -i tun0 -p tcp --dport $PORT -j DNAT --to-destination $IPADDRESS:$PORT
#iptables -t nat -I PREROUTING -i tun0 -p udp --dport $PORT -j DNAT --to-destination $IPADDRESS:$PORT
iptables -I FORWARD -i tun0 -p udp -d $IPADDRESS --dport $PORT -j ACCEPT
iptables -I FORWARD -i tun0 -p tcp -d $IPADDRESS --dport $PORT -j ACCEPT
iptables -A INPUT -p udp -m state --state NEW --dport $PORT -i tun0 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport $PORT -i tun0 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.