13 ms·

Good to see it being in active development. But the one feature I'm waiting for is a network whitelist. For example, it should never connect over my home or off

Good to see it being in active development. But the one feature I'm waiting for is a network whitelist. For example, it should never connect over my home or office network, but only via anonymous VPN. (Edit: I know you can do this already with firewall rules, or containers, but I don't trust myself to not make a mistake. Ideally this should be part of the OS. You should be able to right-click somewhere in the window and say "use this network for this app".) The other feature I'd like to see is sequential downloads, but the developers object out of principle so that is never going to come.

tssva 4y ago
It already has the ability to specify an IP address to bind to. I use an OpenVPN up script to stop any running instance, replace the bind address with the current VPN interface address and start an instance.
tambourine_man 4y ago
I have to agree with them, it’s antithetical to what torrent is about.
- captainmuon 4y ago
  Depends on what torrent is about. For me, it is about watching shows that you can't officially watch where I live yet. Once I week, I hit up a site and, click a magnet link, and a couple of minutes later I can watch my favorite show. (The cost of the VPN is incidentally about the same as a streaming subscription. I think for this reason it is tolerated by the powers that be.) I don't expect torrents to be available for a long time. Only very few people keep the torrent entry in their client alive for long, even though I keep around all the files. This is as opposed to eMule and older systems, where you can download any file in the user's media folder.
  - dkdbejwi383 4y ago
    I believe the previous commenter meant that sequential downloads are orthogonal to the design of Bit Torrent.
  - PcChip 4y ago
    >(The cost of the VPN is incidentally about the same as a streaming subscription. I think for this reason it is tolerated by the powers that be.) I really don't follow you there
- gpvos 4y ago
  Why? It doesn't need to prevent concurrent uploading.
- pessimizer 4y ago
  Superseeding (and whatever you would call it from the client point of view) allows for peer-to-peer broadcasting.
MaxMatti 4y ago
I'm using namespaced-openvpn to restrict transmission to one network and you could limit the amount of concurrently active files to one, effectively downloading them sequentially. Or do you want to download each file sequentially?
- defrost 4y ago
  I would hazard they are asking for file-block sequential downloads from start of file to end, so they can start watching a movie while it is still downloading and be assured that the first parts of the moview are present without gaps ... This goes against the general cluster inter-peer everybody swaps what they have so far w/out reference to file position for maximising transmission within a swarm design of the torrent protocol.
pveierland 4y ago
This is a plug-and-play solution bundling Transmission and the most common VPN configurations in a Docker container, ensuring that all torrent traffic goes via an active VPN connection. After configuring it, you just run "docker-compose up" and can then access Transmission via its web UI. It could be nice to have this built into the client, but using a container feels safer. https://github.com/haugene/docker-transmission-openvpn https://github.com/haugene/docker-transmission-openvpn
- Cyph0n 4y ago
  I’ve been using this for a while now, and it has been working like a charm!
- pvillano 4y ago
  For me, the real power of containers is that all the mistakes I could've made during the install are in ~a single file instead of a long forensic goose chase
- kusha 4y ago
  This is a great container! Been using this for years. (I've contributed!) The only downside is that @haugene has gone missing for sometime now, as such there are no firm releases. If you want new features/bug fixes, you have to pull dev, which isn't very ideal. Otherwise the maintainers are doing a great job (shout out to @pkishino!)
flatiron 4y ago
I run my torrent client in a container and have that container only go out the vpn. Works very well without screwing with computer wide network settings.
jon_adler 4y ago
I’ve got a home lab with proxmox as the hypervisor. I’m running openwrt (x86) for my household router (in a qemu VM) and I’ve got transmission running in a (lxc) container. When the transmission container boots up, it gets its IP address via DHCP (server in openwrt). I configured dhcp to allocate the same lP address to the container every time. You could also just use a static ipconfig in the container. Within openwrt, I’ve installed WireGuard and OpenVPN for accessing different vpns. Finally, again in openwrt, I installed the policy based routing package[1]. This package makes it super easy to route all traffic from the transmission container to the VPN network. There are probably many ways you could do this, but this setup is great for me! 1: https://docs.openwrt.melmac.net/pbr/ https://docs.openwrt.melmac.net/pbr/
- anderspitman 4y ago
  Sounds like a lot of fun, and a huge time sink.
- unethical_ban 4y ago
  Tldr: use OpenWRT to create a static IP reservation for a dedicated torrent instance, then use source-based routing to send traffic over a VPN running on the router. Sounds pretty awesome. I've not dabbled with PBR on home equipment. We did use it in prior employment to force all PCI traffic over a dedicated physical network between datacenters.
bjoli 4y ago
Under Linux you can run transmission as another user and have an iptables rule to only allow outbound traffic through a specific interface.
- remram 4y ago
  Or as your user in a cgroup, probably.
- megous 4y ago
  Or just uidrange based policy for a separate routing table that just routes to the VPN. Just one thing to set up.
- colinsane 4y ago
  you don't even need the extra user: use a network namespace. - ip netns add vpnonly # create an empty namespace - ip netns exec vpnonly wg quick ... # connect to your VPN later, launch transmission inside this namespace: - ip netns exec vpnonly transmission has the nice property that as long as you do that exec step right (or even half right), the failure mode is no connectivity rather than accidentally sending traffic in the clear.
loloquwowndueo 4y ago
If you don’t trust yourself to not make a mistake with firewall config, why do you trust yourself not to make one when setting up an allow list? One wrong digit or dot and you’ll be in the same place. Start with a default policy of deny and work from there, if you’re only creating rules for allowing traffic explicitly then there’s less possibility for error.
stjohnswarts 4y ago
Not ragging on Transmission here but qbittorrent has zero problems getting out of my network and I didn't open up any ports or upnp either, give it a try. Transmission just has issues on my network that I don't care to figure out or open up ports for, qbit is quite good at navigating through NAT.
thedougd 4y ago
Lately I've noticed that public trackers are behind Cloudflare. If you're on a VPN, you have a high likelihood of getting the Cloudflare captcha. Your bittorrent client will be unable to scrape those trackers, or bootstrap DHT, etc because of the cloudflare block.
pmarreck 4y ago
bitport.io cloud torrenting and done (after downloading at high speeds from their site), for me at least.
Pilottwave 4y ago
alternatively qbittorrent has this built in.
anderspitman 4y ago
Agreed. Users shouldn't have to understand firewall rules, containers, VMs, or even VPNs in order to tunnel traffic for a specific app through a (more) trusted third party. We need an open protocol for establishing tunnel/VPN connections. Apps implement the protocol, which lets you enter your tunnel provider and go through a quick OAuth flow to establish a tunnel. This would be a big win for VPN providers as well because people would be sending only specific traffic through them instead of everything.
- vorpalhex 4y ago
  Users should understand how to use their computer. Asking users to comprehend a firewall or a vpn (if using a vpn) is not unreasonable. Coddling users is harmful.
  - CharlesW 4y ago
    Making secure practices simple (or automatic) for less-technical users is not “coddling”.
    - vorpalhex 4y ago
      "Hey why are my torrent downloads running super slow?" "Oh, well, your torrent client decided to automatically use your vpn because it saw one running and somebody decided that was the right behavior because they thought you were dumb." Users have preferences. Users can read. Let them learn and sort it out. Don't ruin a simple program with tarred assumptions of what is correct for users. Prefer simplicity. Also don't assume using a vpn is more secure. That is a wrong assumption.
      - ByThyGrace 4y ago
        I don't have a horse in this race, but I think you're presuming simplicity where there is none. A bittorrent client, even in CLI form, is not simple software at all. Have you ever taken a look at the myriad of available settings? Most GUI clients have a sort of "wizard" that helps you pick acceptable connection parameters. This feature alone has a truckload of assumptions coded in. And that kind of feature exists for a reason: no nonsense-seeking users. They're the majority. Just let me download my file bro.
singlow 4y ago
Set http_proxy environment variable to a socks proxy that goes through the vpn. Some vpn clients offer a socksproxy built in. That way if the vpn is not connected the proxy address is dead.

tssva 4y ago

It already has the ability to specify an IP address to bind to. I use an OpenVPN up script to stop any running instance, replace the bind address with the current VPN interface address and start an instance.

tambourine_man 4y ago

I have to agree with them, it’s antithetical to what torrent is about.

captainmuon 4y ago
Depends on what torrent is about. For me, it is about watching shows that you can't officially watch where I live yet. Once I week, I hit up a site and, click a magnet link, and a couple of minutes later I can watch my favorite show. (The cost of the VPN is incidentally about the same as a streaming subscription. I think for this reason it is tolerated by the powers that be.) I don't expect torrents to be available for a long time. Only very few people keep the torrent entry in their client alive for long, even though I keep around all the files. This is as opposed to eMule and older systems, where you can download any file in the user's media folder.
- dkdbejwi383 4y ago
  I believe the previous commenter meant that sequential downloads are orthogonal to the design of Bit Torrent.
- PcChip 4y ago
  >(The cost of the VPN is incidentally about the same as a streaming subscription. I think for this reason it is tolerated by the powers that be.) I really don't follow you there
gpvos 4y ago
Why? It doesn't need to prevent concurrent uploading.
pessimizer 4y ago
Superseeding (and whatever you would call it from the client point of view) allows for peer-to-peer broadcasting.

MaxMatti 4y ago

I'm using namespaced-openvpn to restrict transmission to one network and you could limit the amount of concurrently active files to one, effectively downloading them sequentially. Or do you want to download each file sequentially?

defrost 4y ago
I would hazard they are asking for file-block sequential downloads from start of file to end, so they can start watching a movie while it is still downloading and be assured that the first parts of the moview are present without gaps ... This goes against the general cluster inter-peer everybody swaps what they have so far w/out reference to file position for maximising transmission within a swarm design of the torrent protocol.

pveierland 4y ago

This is a plug-and-play solution bundling Transmission and the most common VPN configurations in a Docker container, ensuring that all torrent traffic goes via an active VPN connection. After configuring it, you just run "docker-compose up" and can then access Transmission via its web UI. It could be nice to have this built into the client, but using a container feels safer. https://github.com/haugene/docker-transmission-openvpn https://github.com/haugene/docker-transmission-openvpn

Cyph0n 4y ago
I’ve been using this for a while now, and it has been working like a charm!
pvillano 4y ago
For me, the real power of containers is that all the mistakes I could've made during the install are in ~a single file instead of a long forensic goose chase
kusha 4y ago
This is a great container! Been using this for years. (I've contributed!) The only downside is that @haugene has gone missing for sometime now, as such there are no firm releases. If you want new features/bug fixes, you have to pull dev, which isn't very ideal. Otherwise the maintainers are doing a great job (shout out to @pkishino!)

flatiron 4y ago

I run my torrent client in a container and have that container only go out the vpn. Works very well without screwing with computer wide network settings.

jon_adler 4y ago

I’ve got a home lab with proxmox as the hypervisor. I’m running openwrt (x86) for my household router (in a qemu VM) and I’ve got transmission running in a (lxc) container. When the transmission container boots up, it gets its IP address via DHCP (server in openwrt). I configured dhcp to allocate the same lP address to the container every time. You could also just use a static ipconfig in the container. Within openwrt, I’ve installed WireGuard and OpenVPN for accessing different vpns. Finally, again in openwrt, I installed the policy based routing package[1]. This package makes it super easy to route all traffic from the transmission container to the VPN network. There are probably many ways you could do this, but this setup is great for me! 1: https://docs.openwrt.melmac.net/pbr/ https://docs.openwrt.melmac.net/pbr/

anderspitman 4y ago
Sounds like a lot of fun, and a huge time sink.
unethical_ban 4y ago
Tldr: use OpenWRT to create a static IP reservation for a dedicated torrent instance, then use source-based routing to send traffic over a VPN running on the router. Sounds pretty awesome. I've not dabbled with PBR on home equipment. We did use it in prior employment to force all PCI traffic over a dedicated physical network between datacenters.

bjoli 4y ago

Under Linux you can run transmission as another user and have an iptables rule to only allow outbound traffic through a specific interface.

remram 4y ago
Or as your user in a cgroup, probably.
megous 4y ago
Or just uidrange based policy for a separate routing table that just routes to the VPN. Just one thing to set up.
colinsane 4y ago
you don't even need the extra user: use a network namespace. - ip netns add vpnonly # create an empty namespace - ip netns exec vpnonly wg quick ... # connect to your VPN later, launch transmission inside this namespace: - ip netns exec vpnonly transmission has the nice property that as long as you do that exec step right (or even half right), the failure mode is no connectivity rather than accidentally sending traffic in the clear.

loloquwowndueo 4y ago

If you don’t trust yourself to not make a mistake with firewall config, why do you trust yourself not to make one when setting up an allow list? One wrong digit or dot and you’ll be in the same place. Start with a default policy of deny and work from there, if you’re only creating rules for allowing traffic explicitly then there’s less possibility for error.

stjohnswarts 4y ago

Not ragging on Transmission here but qbittorrent has zero problems getting out of my network and I didn't open up any ports or upnp either, give it a try. Transmission just has issues on my network that I don't care to figure out or open up ports for, qbit is quite good at navigating through NAT.

thedougd 4y ago

Lately I've noticed that public trackers are behind Cloudflare. If you're on a VPN, you have a high likelihood of getting the Cloudflare captcha. Your bittorrent client will be unable to scrape those trackers, or bootstrap DHT, etc because of the cloudflare block.

pmarreck 4y ago

bitport.io cloud torrenting and done (after downloading at high speeds from their site), for me at least.

Pilottwave 4y ago

alternatively qbittorrent has this built in.

anderspitman 4y ago

Agreed. Users shouldn't have to understand firewall rules, containers, VMs, or even VPNs in order to tunnel traffic for a specific app through a (more) trusted third party. We need an open protocol for establishing tunnel/VPN connections. Apps implement the protocol, which lets you enter your tunnel provider and go through a quick OAuth flow to establish a tunnel. This would be a big win for VPN providers as well because people would be sending only specific traffic through them instead of everything.

vorpalhex 4y ago
Users should understand how to use their computer. Asking users to comprehend a firewall or a vpn (if using a vpn) is not unreasonable. Coddling users is harmful.
- CharlesW 4y ago
  Making secure practices simple (or automatic) for less-technical users is not “coddling”.
  - vorpalhex 4y ago
    "Hey why are my torrent downloads running super slow?" "Oh, well, your torrent client decided to automatically use your vpn because it saw one running and somebody decided that was the right behavior because they thought you were dumb." Users have preferences. Users can read. Let them learn and sort it out. Don't ruin a simple program with tarred assumptions of what is correct for users. Prefer simplicity. Also don't assume using a vpn is more secure. That is a wrong assumption.
    - ByThyGrace 4y ago
      I don't have a horse in this race, but I think you're presuming simplicity where there is none. A bittorrent client, even in CLI form, is not simple software at all. Have you ever taken a look at the myriad of available settings? Most GUI clients have a sort of "wizard" that helps you pick acceptable connection parameters. This feature alone has a truckload of assumptions coded in. And that kind of feature exists for a reason: no nonsense-seeking users. They're the majority. Just let me download my file bro.

singlow 4y ago

Set http_proxy environment variable to a socks proxy that goes through the vpn. Some vpn clients offer a socksproxy built in. That way if the vpn is not connected the proxy address is dead.