qBittorrent with Proton VPN: Port Forwarding Setup, Docker and Firewalled Fixes

qBittorrent Proton VPN Setup (Windows and macOS): 6 Steps

1. 1

   Connect to a P2P server

   Windows: Countries → P2P tab → connect. macOS: pick a server with the P2P icon. Port forwarding only works on P2P servers.

2. 2

   Turn on port forwarding

   Windows: click Port forwarding in the right sidebar, switch it on and click Apply. macOS: click the Port forwarding shortcut and choose On. Note the port number the app shows.

3. 3

   Enter the port in qBittorrent

   Tools → Options → Connection. Type Proton’s number into “Port used for incoming connections” and untick “Use different port on each startup”.

4. 4

   Untick UPnP / NAT-PMP

   In the same tab, untick “Use UPnP / NAT-PMP port forwarding from my router”. Proton says it can conflict with the VPN’s own port mapping.

5. 5

   Bind to the Proton interface

   Tools → Options → Advanced → Network interface: choose the Proton adapter (on Windows it is named ProtonVPN), and set “Optional IP address to bind to” to All addresses. qBittorrent then cannot leak traffic outside the tunnel.

6. 6

   Restart qBittorrent and check the icon

   The connection icon in the status bar should turn into a green globe within a few minutes of an active torrent. A flame icon means firewalled; see the fixes below.

Proton’s server picks the port, and it usually changes after a reconnect, a server switch or a sleep cycle. On Windows and macOS, check the number in the app after every reconnect and update qBittorrent if it differs. On Linux, the Proton app writes the active port to /run/user/$UID/Proton/VPN/forwarded_port, so a small script can keep qBittorrent in sync:

#!/bin/sh
# Keeps qBittorrent's listening port in sync with the Proton VPN Linux app.
# Needs the qBittorrent Web UI on port 8080 with "Bypass authentication for clients on localhost" ticked.
PORT_FILE="/run/user/$(id -u)/Proton/VPN/forwarded_port"
LAST=""
while true; do
  PORT=$(cat "$PORT_FILE" 2>/dev/null)
  if [ -n "$PORT" ] && [ "$PORT" != "$LAST" ]; then
    curl -s --data "json={\"listen_port\":$PORT,\"upnp\":false,\"random_port\":false}" \
      http://127.0.0.1:8080/api/v2/app/setPreferences && LAST="$PORT" && echo "qBittorrent port set to $PORT"
  fi
  sleep 30
done

Turn on the Web UI first (Tools → Options → Web UI) and tick “Bypass authentication for clients on localhost”. Run the script at login, for example as a systemd user service.

Headless Linux or a Manual WireGuard Config

Without the Proton app, generate a WireGuard config for a P2P server with NAT-PMP (port forwarding) ticked, or add +pmp to your OpenVPN username. Then request the port with natpmpc (version 20230423 or newer) and keep renewing it, because the mapping expires after 60 seconds:

# Manual WireGuard/OpenVPN connection to a Proton P2P server (NAT-PMP enabled)
while true ; do date ; natpmpc -a 1 0 udp 60 -g 10.2.0.1 && natpmpc -a 1 0 tcp 60 -g 10.2.0.1 || { echo -e "ERROR with natpmpc command \a" ; break ; } ; sleep 45 ; done

The output prints the public port; put it in qBittorrent. Closing the terminal stops the loop and the port closes a minute later, so run it as a service. Background on the protocol: what NAT-PMP is.

qBittorrent + Proton VPN in Docker (Gluetun)

Gluetun has Proton port forwarding built in and can push each new port straight into qBittorrent through its Web UI API. PORT_FORWARD_ONLY=on limits Gluetun to P2P servers, and the up-command sets the port and network interface every time the port changes:

services:
  gluetun:
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8080:8080 # qBittorrent Web UI
    environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=your_proton_wireguard_key # config generated with NAT-PMP on
      - SERVER_COUNTRIES=Netherlands
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on
      - VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c 'wget -O- -nv --retry-connrefused --post-data "json={\"listen_port\":{{PORT}},\"current_network_interface\":\"{{VPN_INTERFACE}}\",\"random_port\":false,\"upnp\":false}" http://127.0.0.1:8080/api/v2/app/setPreferences'
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent
    network_mode: service:gluetun
    environment:
      - WEBUI_PORT=8080
    volumes:
      - ./config:/config
      - ./downloads:/downloads

In qBittorrent’s Web UI settings, tick “Bypass authentication for clients on localhost” so Gluetun can reach the API. TrueNAS, Unraid and Synology users can use the same two containers. Full walkthroughs: Gluetun port forwarding and qBittorrent VPN in Docker.

Deeper fixes: qBittorrent firewalled, qBittorrent stalled, qBittorrent slow download.

This page contains affiliate links. If you sign up through them, NAT Checker may earn a commission at no extra cost to you.

How PureVPN’s add-on works: PureVPN port forwarding. NordVPN users cannot forward ports; see qBittorrent with NordVPN.

qBittorrent with Proton VPN FAQ