Ensure torrent client uses openvpn

Question

I recently signed up to a VPN provider and to log in, I use network manager for my normal wireless connection and then start the openvpn connection from network manager. In my browser I can check that I'm using the tunnel by going to an ip location finder site but how do I ensure that my torrent client actually uses this connection? For example, couldn't it happen that my VPN provider logs me out after some time (intentionally or not) and then my torrent client starts using the still available normal wifi connection?

Answer 1

How do I ensure that my torrent client actually uses this connection?

There is a site, CheckMyTorrentIP, that does exactly that. Basically, you download a torrent file generated specifically for you and once you open it in your client it will report the IP address being used. The IP should be displayed directly in your client but you can also revisit the site which will also display it. There is a FAQ on the site where you can get more info.

Couldn't it happen that my VPN provider logs me out after some time (intentionally or not) and then my torrent client starts using the still available normal wifi connection?

Absolutely. The FAQ on CheckMyTorrentIP as well as this article from TorrentFreak explain some options for preventing this, which include using specific firewall rules, changing TCP/IP routes, or using specific apps.

If you happen to use rtorrent you can bind it to a specific IP address (the one given to you by your VPN) and if you lose connection to that interface rtorrent will stop downloading/seeding (TBH, I'm not 100% that statement is true, but it is at least something interesting to look into). If your VPN IP is 0.0.0.0, then just add this to your .rtorrent.rc:

bind = 0.0.0.0

Answer 2

Run the command sudo ifconfig. It should return a list of connections, one of them is going to be something like tun0 which is your VPN tunnel. In the tun0 block, there will be an inet addr xxx.xxx.xxx.xxx.

Take that inet addr and add it or edit your .rtorrent.rc file (which is probably in your /home directory) such that it reads:

bind = xxx.xxx.xxx.xxx

(Obviously you will fill in numbers, not xxx.xxx.xxx.xxx).

It is tedious to do so each time you connect, but unmasking your actual IP is a real problem if your VPN times out and you get kicked over to your real IP while your rtorrent is still running.

I'm writing a script to do this automagically each time I boot. If it works I'll try and come back and post it.

as promised here is a script to do this for you. it isnt practical to run it at boot unless youre starting your vpn at boot so you should run it manually as root or with sudo from the directory where your .rtorrent.rc is after you start your vpn and before you start rtorrent.

sorry to post something that needs root privileges, never run anything from a forum asking for root unless you review it yourself for safety.

script will parse your ifconfig output looking for the ip address associated with the string 'tun' and write that as a bind statement on the last line of your .rtorrent.rc file.

meanwhile it first makes a directory called .svrtvpn where it stores up to ten backups of the existing .rtorrent.rc file, then deletes all other bind statements from your .rtorrent.rc file then writes the detected vpn ip address to bind to as the last line in your .rtorrent.rc file

im super lazy so it was easier to take time to write the script and just call it quickly than to take ten extra seconds to manually detect and write the bind every time i run a vpn. #!/bin/bash

#svrtvpn.sh ver 0.3  "shadowvision rtorrent vpn" 01-05-2016 @ shadowvision.com/org
#a simple script to set your .rtorrent.rc bind to the ip address your vpn is using so that if your vpn gets disconnected, rtorrent will stop and you wont be unmasked
#WARNING WARNING WARNING WARNING under some circumstances it erases parts or even the entire .rtorrent file, but it makes a backup first so namaste :)
#this seems to happen if there arent any bind addresses to start with so the script will append a bogus one before it does anything else.

#syntax before starting rtorrent, run as root from the directory where your .rtorrent.rc is, follow the prompt and enter your linux user name that you will be running rtorrent as.

#provide help
if [ "$1" = "help" ]; then
echo "  use: before starting rtorrent, run as root from the directory where your .rtorrent.rc is."
echo "  script is dependent on ifconfig returning the vpn connection as 'tun'.  if that isnt what your connection is called you will have to manually change it inside the script"
echo "  svrtvpn.sh saves your existing .rtorrent.rc file in a directory called .svrtvpn with the extension of the epoch time in seconds. the last ten backups are saved."
echo "  if you use this script, the bind = address will always be the last line of your .rtorrent.rc file"
echo "  svrtvpn.sh ver 0.3  "shadowvision rtorrent vpn" 01-05-2016 @ shadowvision.com/org"
echo "  a simple script to set your .rtorrent.rc bind to the ip address your vpn is using so that if your vpn gets disconnected, rtorrent will stop and you wont be unmasked"
echo "  shadowvision makes no claims as to the usability of this script on your system, it was tested on kali linux with network manager and PIA 'private internet access'"
exit
fi

#first check to see if you have a .rtorrent.rc file.  if you dont it tells you so and exits.
RTORRENTFILE=./.rtorrent.rc
if [ ! -f "$RTORRENTFILE" ]; then
    echo "You dont have  .rtorrent.rc in this directory, script will now exit!"
    exit
fi

# set your backup directory variable
SVDIR=.svrtvpn

#tell the user its using a backup directory
if [ -d "$SVDIR" ]; then
  echo "using existing $SVDIR directory for backups.  your your last ten backups will be saved here."


#now make your .svrtvpn directory where your backups are stored if it doesnt already exist
else
mkdir -p $SVDIR
echo "created a directory called $SVDIR, your last ten .rtorrent.rc backups are stored here."
fi


#first find out what user you are running as, the script sets the ownership of .rtorrent.rc to this user at the end

SVUSER=$(ls -ld .rtorrent.rc | awk '{print $3}')
echo "your .rtorrent.rc file is owned by $SVUSER , it should remain read/write by that user and read for everyone else at the end of this script."
#copy your .rtorrent.rc to a backup file with the seconds of epoch time as the extension.
cp .rtorrent.rc ./$SVDIR/.rtorrent.rc.$(date +"%s")

#append a bogus ip bind so that the script wont erase your entire file
echo "bind = 999.999.999.999" >> .rtorrent.rc


#find out what your current vpn ip is, and if you dont have one, exit. as long as you didnt previously have a valid ip entered rtorrent wont start.
if $( ifconfig |grep -q -A1 tun); then
VPNIP=$(ifconfig |grep -A1 tun |grep inet | grep  -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | head -1)

#find any bind addresses in the file so we can delete them
DELINE=$(cat .rtorrent.rc |grep   bind | grep  '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -v \# |grep -v \:)

#delete old bind addresses by tediously copying everything but found addresses to a temp file then back to the original file.
cat .rtorrent.rc |grep -v "$DELINE" > ./$SVDIR/.rtorrent.xx
cat ./$SVDIR/.rtorrent.xx > .rtorrent.rc

#add the vpn ip to the end of your file
echo "bind =" "$VPNIP" >> .rtorrent.rc

#make sure ownerships and read perms are sane
chown $SVUSER .rtorrent.rc
chmod u+rw .rtorrent.rc
chmod a+r .rtorrent.rc
chown -R $SVUSER $SVDIR
chmod -R a+r $SVDIR

#only save last ten backups, note the number is set to 13 because the three files . .. and .xx file arent backups
cd $SVDIR

ls -tra | head -n -13 | xargs --no-run-if-empty rm

cd -
else

#if you got to here it didnt work so set a bogus bind address so rtorrent wont start
VPNIP=999.999.999.999

#just like above find any old bind addresses so we can remove them
DELINE=$(cat .rtorrent.rc |grep   bind | grep  '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -v \# |grep -v \:)
cat .rtorrent.rc |grep -v "$DELINE" > ./$SVDIR/.rtorrent.xx
cat ./$SVDIR/.rtorrent.xx > .rtorrent.rc

#set the bogus address
echo "bind =" "$VPNIP" >> .rtorrent.rc

#reset sane perms
chown $SVUSER .rtorrent.rc
chmod u+rw .rtorrent.rc
chmod a+r .rtorrent.rc
chown -R $SVUSER $SVDIR
chmod -R a+r $SVDIR

#tell us what happened
echo "you are not connected to a vpn, this wont work"
echo "your bind address has been set to 999.999.999.999"
fi