qBittorrent Behind a VPN on Your NAS: A Safe Setup Guide

Running qBittorrent without a VPN on your NAS is essentially broadcasting your real IP address to every peer in the swarm. A single DMCA notice from your ISP, or worse, a legal threat from a copyright holder, is all it takes to turn a hobby into a headache. This guide walks through a Docker-based qBittorrent VPN setup that routes every byte of torrent traffic through a VPN tunnel, with a non-negotiable kill switch that stops all traffic if the VPN connection drops. You will learn how to pair qBittorrent with a dedicated VPN container, verify the kill switch actually works, and connect the download pipeline into the broader arr-stack automation.

Why Route Torrent Traffic Through a VPN and What a Kill Switch Protects Against

When qBittorrent connects to a swarm, it announces your real IP address to the tracker and to every peer. Your ISP sees that IP connecting to known torrent peers. A VPN replaces your real IP with the VPN server’s IP, making your activity anonymous to the ISP and third-party monitors. The VPN encrypts the entire connection, so your ISP only sees encrypted traffic to the VPN server — not the torrent protocol itself.

A kill switch is the safety net that prevents IP leaks if the VPN connection fails. Without it, a brief VPN disconnect — even a few seconds — exposes your real IP to the swarm. A proper kill switch monitors the VPN tunnel and immediately blocks all non-VPN traffic from qBittorrent. This is not optional; it is the single most critical component of any torrent client VPN NAS setup.

Docker Compose Setup: Gluetun + qBittorrent

The cleanest way to enforce a kill switch is to run qBittorrent in a Docker container whose network is entirely routed through a separate VPN container. Gluetun is the most popular open-source VPN client container for this purpose. It supports OpenVPN and WireGuard, works with dozens of providers, and includes a built-in kill switch that blocks all traffic from containers connected to its network if the VPN drops.

qBittorrent VPN Docker Compose File

Create a docker-compose.yml file in a directory on your NAS. The key is that qBittorrent uses network_mode: "service:gluetun", which forces all its traffic through Gluetun’s network stack. Gluetun’s kill switch operates at the kernel level — if the VPN tunnel goes down, it drops all packets from containers attached to its network.

version: "3.8"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=mullvad
      - VPN_TYPE=openvpn
      - VPN_USER=YOUR_USERNAME
      - VPN_PASSWORD=YOUR_PASSWORD
      - SERVER_REGIONS=us-east
      - FIREWALL_VPN_INPUT_PORTS=6881
    ports:
      - "8080:8080"
    volumes:
      - ./gluetun-data:/gluetun
    restart: unless-stopped

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: "service:gluetun"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      - WEBUI_PORT=8080
    volumes:
      - ./qbittorrent-config:/config
      - /path/to/downloads:/downloads
    depends_on:
      - gluetun
    restart: unless-stopped

Verifying the Kill Switch Actually Works

Trusting a kill switch without testing it is like trusting a parachute you never packed. You must verify that qBittorrent loses all network access when the VPN disconnects. This is the single most important step in any qBittorrent killswitch guide.

Step-by-Step Kill Switch Verification

If the kill switch fails, check that Gluetun has the NET_ADMIN capability and that no other network interfaces are accessible to the qBittorrent container. Some Docker host configurations can leak traffic through the host network — ensure qBittorrent has no ports: mapping that bypasses Gluetun.

Port Forwarding for Better Torrent Connectivity

qBittorrent behind a VPN can suffer from poor connectivity if the VPN provider does not support port forwarding. Without an open inbound port, you can only connect to peers that have open ports — you become a “firewalled” client. This reduces download speeds and limits the number of peers you can reach. Providers like Mullvad, AirVPN, and PIA offer port forwarding; others like NordVPN and ExpressVPN do not.

To enable port forwarding in Gluetun, add the environment variable VPN_PORT_FORWARDING=on for providers that support it. Then configure qBittorrent’s listening port to match the forwarded port. This is done in the Web UI under Settings > Connection > Port used for incoming connections.

Connecting the Download Folder into the Broader Arr-Stack Pipeline

A qBittorrent VPN setup is only one piece of a larger automation pipeline. Once files download, they need to be imported by Sonarr (TV shows) or Radarr (movies), then renamed, organized, and possibly transcoded by Plex or Jellyfin. The key is to map the download folder as a volume in the qBittorrent container and ensure the arr-stack containers can access the same path.

For example, if your NAS has a shared volume at /mnt/storage/media, map it into the qBittorrent container as /downloads. Then in Sonarr and Radarr, map the same host path to /media. Set qBittorrent’s download directory to /downloads/torrents and the arr apps to watch /media/torrents. After import, the arr apps move files to /media/tv or /media/movies.

• Use the same PUID and PGID across all containers to avoid permission errors.
• Set qBittorrent to “Pause torrents when disk is full” to prevent data corruption.
• Configure Sonarr/Radarr to use qBittorrent’s API with the Web UI credentials.
• If you run Jellyfin on TrueNAS SCALE, ensure the media directories are accessible to that container as well.

Which Should You Choose: Gluetun vs Built-In VPN

Some NAS operating systems like Unraid offer built-in VPN plugins for Docker containers. However, these are less reliable than a dedicated VPN container. Unraid’s “Network Type: Custom: br0” approach can leak traffic if the container restarts or if the VPN plugin fails. Gluetun’s kernel-level firewall is more robust because it blocks all non-VPN traffic at the network stack, not at the application layer.

If you are running a Docker server or a NAS that supports Docker (TrueNAS, Unraid, OMV), Gluetun is the safer choice. It is also the only option that gives you a single, auditable kill switch mechanism that you can test and verify.

RAID is not a backup. Redundancy protects against drive failure, but not accidental deletion, ransomware, or file corruption. Always maintain a separate backup of important data.

Frequently Asked Questions