Nordvpn client's version or changelog: 3.18.4 (24/08/20)
30/03/2024: --privileged required for client >= 3.17.0. problem stopping container with client 3.17.x. 26/06/2023: moving to debian bookworm.
/!\ please consider this project as a work in progress especially concerning iptables/leak management when not using nordvpn client (ie: NORDVPN_PRIVKEY found).
/!\ since v4 for transmission, building package takes too long for github, gen_image_buildx.sh -ap
generates debian packages for different architecture arm64, amd64, arm v7, then deb files are uploaded to not rebuild transmission at each image build.
purpose: compare wireguard and nordlynx speed transmisssion.
This is a docker container that connects to the recommended NordVPN servers through nordvpn client or wireguard, and starts a SOCKS5 proxy (dante), an http proxy (tinyproxy) and torrent client (transmission). plain wireguard and nordlynx's wireguard technology are available.
this container is build for amd64, arm64, arm/v7, arm/v6, two tags are available. As of 08/04/22, V3/v4 will be built regularly, as v4 is the version I use. I stopped the automatic launch for latest's workflow building. v3: transmission v3 + latest nordvpn client. v4: transmission v4 + latest nordvpn client. latest: transmission v3 + latest nordvpn client.
Whenever the connection is lost, nordvpn client has a killswitch to obliterate the connection.
check IP, DNS, Torrent or another torrent leaks or torrent check guard
This image is a variation of nordlynx-proxy and has two ways to run.
you can then expose ports
1080
from the container to access the VPN connection via the SOCKS5 proxy.8888
from the container to access the VPN connection via http proxy.9091
from the container to access transmission web UI.To sum up, this container:
eth0
to nordlynx.wg0
with dante-server.The main advantages are:
please note, that to avoid dns problem when the dns service is on the same server, /etc/resolv.conf is set to google DNS (1.1.1.1). That DNS is used only during startup (check latest nordvpn version)
AS of 22/03/29, not all nordvpn client's features are implemented in plain wireguard:
The container may use environment variable to select a server, otherwise the best recommended server is selected: see environment variables to get all available options or nordVpn support.
adding
sysclts:
- net.ipv6.conf.all.disable_ipv6=1 # disable ipv6
might be needed, if nordvpn cannot change the settings itself.
curl -LSs https://api.nordvpn.com/v1/technologies | jq '[.[].identifier] | @csv' | tr -d '\\"'
curl -LSs https://api.nordvpn.com/v1/servers/countries | jq '[.[].cities[].name ] | @csv' | tr -d '\\"'
see haugene's poject for transsmission's variables.
Nordvpn, wireguard private key, transmission rpc and tinyproxy credentials may be available throught secrets (/run/secrets/nordvpn_creds, /run/secrets/tiny_creds) In the setup scripts, secrets values override any env values. Secrets names are fixed values: NORDVPN_CREDS, NORDVPN_PRIVKEY, RPC_CREDS, TINY_CREDS.
file: ./nordvpn_creds #file with username/token in 1st line, passwd in 2nd line. file: ./tiny_creds #file with username/password in 1st line, passwd in 2nd line. these credentials can also be set with secrets.
docker run -it --rm --cap-add NET_ADMIN -p 1081:1080 -p 8888:8888 -p 9091:9091
--device /dev/net/tun -e NORDVPN_LOGIN=<email> -e NORDVPN_PASS='<pass>' -e COUNTRY=Poland
-e edgd1er/nordlynx-transmission
version: '3.8'
services:
transmission:
image: edgd1er/nordlynx-transmission:latest
restart: unless-stopped
ports:
- "1080:1080"
- "8888:8888"
- "9091:9091"
devices:
- /dev/net/tun
sysctls:
- net.ipv4.conf.all.src_valid_mark=1 # remove need to have privilegied
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.rp_filter=2 # Loose Reverse Path: https://access.redhat.com/solutions/53031
- net.ipv6.conf.all.disable_ipv6=1 # disable ipv6
- net.ipv6.conf.all.forwarding=1
# - net.ipv4.conf.all.rp_filter=2 # Loose Reverse Path: https://access.redhat.com/solutions/53031
cap_add:
- NET_ADMIN # Required
# - SYS_MODULE # Required for TECHNOLOGY=NordLynx
environment:
- TZ=America/Chicago
- CONNECT=uk
- TECHNOLOGY=NordLynx
- DEBUG=
- NORDVPN_LOGIN=<email> #Not required if using secrets
- NORDVPN_PASS=<pass> #Not required if using secrets
- TRANSMISSION_RPC_USERNAME=<username> # not required if using secrets
- TRANSMISSION_RPC_PASSWORD=<password> # not required if using secrets
#- TINYUSER: optional, enforces authentication over tinyproxy when set with TINYPASS. set dante password also
#- TINYPASS: optional, enforces authentication over tinyproxy when set with TINYUSER. set dante password also. add authorization with danteuser:${TINYPASS} to socks proxy
secrets:
- NORDVPN_CREDS
- NORDVPN_PRIVKEY
- RPC_CREDS
- TINY_CREDS
secrets:
NORDVPN_CREDS:
file: ./nordvpn_creds # login and password on two separate lines, or token in oneline.
NORDVPN_PRIVKEY:
file: ./nordvpn_privkey # wireguard extracted private key
RPC_CREDS:
file: ./rpc_creds # login and password on two separate lines for transmission auth.
TINY_CREDS:
file: ./tiny_creds # login and password on two separate lines for tinyproxy and dante auth.