r/VPNTorrents
•
u/iqBuster
•
Aug 18 '21
•
2
1
Answered: Why you do need port-forwarding for Bittorrent
Many people look for a VPN with the primary goal of running Bittorrent. Sadly nearly equally many people have no idea what's important there and recommend a random popular VPN without port-forwarding. They know no better. These misguided 'recommendations' are all over this sub and r/piracy too.
Explanation
> But it has been running fine without any port-forwarding for me!
If you are OK with your downloads failing in 10% of cases then continue as usual. If you don't want to miss a chance, here's a short explanation:
Bittorrent relies on your connection working both ways: to accept incoming and outgoing connections. Without port-forwarding: you may will see slower speeds, slower speed ramp up and if a torrent has very few online seeders you may run into a situation where you cannot connect to anybody at all - no download! Seeding is very hard without port-forwarding.
Normally home users cannot accept incoming connections due to NAT. This is always the case for proxies and VPNs, but some VPNs allow the assignment of a port that will always lead to your connected device (and to your client). Making outgoing connections is always technically possible but then you rely on the seed/peer to have their ports open! At least one side must be open. There's no way around.
A detailed explanation would be too long but you can ask in comments.
Is it safe (privacy-wise)? Decide for yourself, discussions also in comments
Opinion & TLDR: If a VPN tracked/logged you, they don't need port-forwarding to find you. On the other hand, it is possible that the no-log VPN is forced to disclose which account currently (at the time of request) has the port in question configured. So far without known precedents. I believe it's worth it, without seeding torrents would die.
How to
- Pick a VPN provider that supports port-forwarding. Here's a list I compiled last month.
- Pick a client and force it to only ever use the VPN connection in settings (see screenshots). This is called IP/interface binding
- In client settings set the "incoming port" to match the forwarded port from your VPN provider (also referred to as "local port")
- Disable UPnP and other automatic configuration unless your VPN provider explicitly only works with UPnP.
- You are set. Bon voyage at the calm seas!
Sometimes you also need to allow incoming connections to the client application in your firewall.
EDIT: Examples
Explicit examples where port-forwarding will help establishing a connection:
Downloader, closed port <--- ---> Seeder, closed port: Tough luck!
Downloader, closed port ---> Seeder, open port: Instant!
Downloader, open port ---> Seeder, closed port: Bummer. Need to wait until Seed sees and connects back to you. Usually up to 30min (or tracker refresh time)
Downloader, open port <---> Seeder, open port: Instant! in either direction
I am writing these posts to form a complete guide for people to follow and set up everything. Next time I see someone recommending a trashy VPN, I'll send them here.
3
u/CluelessButTrying Aug 18 '21
Ah the things I wish I had known before getting a 2 year Nord subscription... its great for everything else but I always see it getting recommended for tormenting and I'm like wait, no! It honestly hasn't affected my torrenting in a big way but it would certainly be preferable to have port forwarding
2
u/Actual-Maize Aug 24 '21
What about remote port on private internet access? Would that be fine to use ?
1
2
Aug 18 '21
How does it connect to peers if you don't have port forwarding turned ON?
I only download and then seed popular torrents -- this may be why I don't notice a major speed decrease of any kind.
The things I torrent reach my max internet speed in both download and upload for the right popular torrents.
Why is this still working?
1
u/iqBuster Aug 19 '21
Yes, I said:
Making outgoing connections is always technically possible but then you rely on the seed/peer to have their ports open! At least one side must be. There's no way around.
There are only few possible scenarios:
you have open ports
other peer has open ports
your/their NAT does not fall into the category of 'strict' NATs and sort of 'soft-reserves' the port you're using. I.e. without explicit configuration, the port always leads back to you for the duration of your active communication.
NAT hole punching relies on that last point, the ability to send out some packets to a destination, then the port is temporarily 'yours' and connectable from the outside world.
Bittorrent as a protocol has an extension that uses a 3rd peer to facilitate a 'rendez-vous' between two NAT'ed peers. I've done some searching last time around and both this feature support as well as NAT UDP hole punching are either not implemented at all or not properly advertised. This is the territory where only direct questions to developers can shed light on.
Usually if you see a non-zero number of peers reported by the tracker but nobody's connected to you and you're the only seed (unless someone's tricking the tracker), you've hit the 10% and the unlikely NAT situation I talked about. Totally depends on the kind of torrents you're going for.
Wikipedia lists the typical 4 types of NAT in the article on it, but it's a bit hard to understand just going by the descriptions there. I tried to explain but a textual explanation is destined to failure.
1
u/TheTurkishWarlord Aug 18 '21
Other people with port forwarding on can still connect to you.
1
Aug 18 '21
So, if 2 people don't have port-forwarding turned ON, they'll never be able to transfer files over bittorrent to each other?
1
u/TheTurkishWarlord Aug 18 '21
Yes, that is the case.
1
Aug 18 '21
What about what these fellas are saying at the bottom here?: https://superuser.com/questions/104462/how-does-bittorrent-work-with-only-outbound-connections
1
u/TheTurkishWarlord Aug 19 '21
I don't know that much about it. But usually when there's no peer at my local private tracker with forwarded ports, we have to request someone with port forwarding on to help us be able to download that torrent.
1
1
u/Adamblastia Aug 18 '21
How do you know when it's working? When I use the process you describe with Mullvad port forwarding, this site shows my success. I can't get similar results with TorGuard under any circumstances yet. I'm left unsure whether I've accomplished anything. Do you have a process you use for verification?
2
u/iqBuster Aug 18 '21
Usually a fair way to tell is when you see people in the peer list with an incoming arrow, the clients like qBittorrent then tell you the connection is fine.
Unfortunately I do not have an easy way or tool to recommend. Sometimes/some these websites don't work, sometimes the VPN (needs like a reconnect or something). Generally you want the client running on that port before checking on the website, otherwise it'll not open a connection (no application to connect to) and tell you it's "closed"
The first time went smooth, yet last time I did it, I nearly went insane. This doesn't sound motivational for this post, but after half an hour of logging my attempts (write everything down when troubleshooting!) it just started working after repeating steps I had done before. In reality you need to check all of the following:
The (Website) Checker works? -> got correct VPN's public IP? -> got correct VPN public(remote)/local port? -> firewall on computer blocking? -> client listening on correct port?
Keep in mind most of these websites only check for TCP, not UDP. For Bittorrent you ideally want both (TCP-only works fine with trackers with impaired DHT, UDP is used for DHT+transfers and sometimes trackers). Usually though an open TCP port = open UDP port.
For your sanity: just tested and the website reports correctly but only when the client is running on that port.
1
Aug 18 '21
Usually a fair way to tell is when you see people in the peer list with an incoming arrow , the clients like qBittorrent then tell you the connection is fine.
Where do I find this arrow?
1
u/Adamblastia Aug 18 '21 edited Aug 18 '21
I see the tiny flags along with the swarm IPs, but don't see any arrows, if that's where I'm supposed to see them.
Update on TorGuard port forwarding - YouGetSignal now shows it working. Yay! (I need a few more testing websites so I'm not entirely dependent on the one.)
Edit:
Port Checker and CanYouSeeMe do just the same thing, so one isn't over-relying on a single site.
2
u/sgben52 Aug 20 '21
Hey. I use TorGuard too, but am a bit confused as to all the settings for setting up port forwarding. Could you send me a censored version of your settings?
1
1
1
u/jdk309 Aug 18 '21
Ivacy is easy to get the paid option as a free option. Some of the sales included LIFETIME membership ($34 at the time iirc) and all paid features were even included. Best buy ever.
1
Aug 18 '21
How does IPv6 factor into all of this?
2
u/iqBuster Aug 19 '21
Theoretically IPv6 has enough address space such that each VPN user on a server could get his own for the duration of the connection. Therefore the need for port-forwarding/mapping is eliminated. The problem with IPv4 is that all users share the same 65535 ports.
Residential users of ISPs that offer Dual-stack Lite do not need to worry about IPv6-to-IPv6 connections, they already have a unique IPv6. But they do not have a dedicated IPv4 and due to the nature of it are behind CGNAT for IPv4 connections without the ability to manually port forward. Enter all the NAT hole punching techniques...
If your VPN has both IPv4+6 and your client seeks simultaneous connection, there's an interesting (rare) phenomenon to be observed. Peers behind NAT can accept (from their PoV) incoming IPv6 connections, but not for IPv4. Also their port numbers will differ (although it's the same computer): because IPv6 shows the real port number and IPv4 shows an ephemeral port number used by a NAT server inbetween.
IPv6 is a special case with VPNs. Sure they must first implement it, such that each user gets a unique IPv6. But do they now forward ALL incoming traffic to the user? That's not desirable. It will either still be manual (but instead of 'port-forwarding' it would technically be 'lifting a restriction' in the firewall) or be connection-tracking, i.e. functioning like the not restrictive NAT I talked about in another comment.
1
Aug 19 '21
My VPN uses Wireguard.
My ISP is still working on moving to dual-stack, so I'm still using IPv4.
More importantly, my VPN offers IPv6 and IPv4 through an IPv4 endpoint that I connect to.
I notice that many IPv6 peers that I connect to are all not in the US or Canada -- most are from developing countries like India, Indonesia, etc.
That makes sense because they didn't get dibs on IPv4 spaces like the developed world did.
And, they, thank the lord, don't have strong internet piracy laws like we in the developed world do.
2
u/iqBuster Aug 19 '21
And, they, thank the lord, don't have strong internet piracy laws like we in the developed world do.
Amen. Though not for long: https://torrentfreak.com/president-sends-south-africas-new-copyright-bill-back-to-parliament-after-us-and-eu-pressure-200624/
All WTO member countries are bound by the Berne convention and its later amendments. On paper they ought to... in practice there's no money to be had so the trolls don't bother yet imo.
1
Aug 19 '21
Don't mean to sound offensive, but, I guess they're too broke to sue for any worthwhile amount of money.
Though, I guess that it's the richer people in the developing world that are engaging in torrenting -- long live these folks!
1
u/iqBuster Aug 19 '21
Too broke for the first world? Yes. But not in relation to the own countrymen imho.
I think the main reason is the lack of easy laws. The IP industry had spent billions to push their laws in the west. A well oiled legal machine makes it easy for them to the point of it being a tangible source of income: If IP holder doesn't legally distribute their trash video or whatever, they'd just sell exclusive rights (time-limited and geo-restricted) to local troll lawyers and these wreck havoc in their hunt for easy money. So yeah I think it's for the lack of laws.
<3
1
Aug 19 '21
That's not desirable.
What does the standard/average residential router do with IPv6 in this case?
Will we have to rely on OS firewalls alone?
How will that work? Set anything coming to your WAN IPv6 into a "public" firewall profile and everything coming to your Link-Local or Unique-Local addresses into a "private" firewall profile?
Then, you'd open a port on your WAN IPv6 "public" firewall for all your torrenting needs?
1
u/iqBuster Aug 19 '21
I think technically the consideration was to have firewalls, but ain't no one wishing early 2000s Windows worms back. All good questions I can't answer :) But I think that all routers default to the old port/address restricted NAT: let traffic through if your computer (IPv6) has previously contacted that other address. Aka stateful firewall/connection tracking etc.
Then, you'd open a port on your WAN IPv6 "public" firewall for all your torrenting needs?
I think yes, if you give out the complete 2001:db8:0:3::4567 address, there's nothing to reroute and it points to your device. It's just a matter of not discarding the traffic.
1
1
u/blondbeaast Jan 16 '22
Hi! Thank you for your explanation. I am a bit of a noob and I wondered if it is also neccessary to setup port forwarding in the router with the private pc IP adress? If yes should I then use the same port as used in torrent client and VPN?
Also, can I use proxy, via the VPN provider, in the torrent client while port forwarding?
I am a little late to the party, but hope you can help. :)
2
u/iqBuster Jan 21 '22
The point of using VPN/proxy is to not let any traffic go raw through your real router connection. This is the reason you must not port-forward on your router, it's the VPN server's job now and that's where it must be configured.
If you use the proxy you'll lose port-forwarding.
You -> router -> VPN -> proxy:proxyPort and that's different from
You -> router -> VPN:port (port-forwarded)
10
u/Lordb14me Aug 18 '21 edited Aug 18 '21
With port forwarding, apparently the vpn can no longer maintain that they can't forward dmca notices. What's the truth about this? Usually vpns share 1 ip with hundreds of connected customers at that location. I. Have heard from fellow seeders that somehow port forwarding might give you more exposure to copyright trolls.