# 2026-09-25 — qBittorrent BT net (flame / firewalled)

## Goal
Inbound BT listen **6881** tcp+udp reachable so WebUI connection status leaves the firewalled (flame) state.

## Live on koopa
- CTR `koopa-prime-qbittorrent` (linuxserver): host **6881** tcp+udp, WebUI **9023**→8080 → `bt.hacktivism.ch`
- Conf: `Session\Port=6881`, `PortForwardingEnabled=true`, `Connection\UPnP=true`
- Temp: `/downloads/incomplete/` (abc / host uid 100999)
- Durable apply: `scripts/prime/apply-qbittorrent-bt-net.sh` (+ wrapper `koopa-bt-fix.sh`)
- Clone on host: `~/koopa-admin-log/scripts/prime/`

## firewalld
- Doc: `configs/firewalld/public-ports.md` — **6881/tcp+udp**
- Agent cannot list without sudo/polkit; human opens with:
  ```bash
  sudo firewall-cmd --permanent --add-port=6881/tcp
  sudo firewall-cmd --permanent --add-port=6881/udp
  sudo firewall-cmd --reload
  ```
- WAN probe success (below) implies the path through host firewall is open.

## VeciGate (2026-09-25)
- wan `dstnat` tcp+udp **6881** → `192.168.100.95:6881`
- hairpin LAN `192.168.100.0/24` and LAN2 `192.168.88.0/24` → `212.51.151.254:6881` tcp+udp
- Comments: `koopa: qBittorrent BT …` / `hairpin: LAN[2] qBittorrent BT …`
- Detail: vecigate-admin-log `2026/2026-09-25--qbittorrent-bt-dnat.md`

## Verify (2026-09-25, from magikoopa)
| Probe | Result |
|-------|--------|
| `nc -vz 192.168.100.95 6881` | LAN_TCP_OK |
| `nc -vz 212.51.151.254 6881` | WAN_TCP_OK |
| `nc -zu 212.51.151.254 6881` | WAN_UDP_OK |

WebUI API (`/api/v2/…`) still auth-gated from agent — human glance at connection icon on `bt.hacktivism.ch`.

## Freigabe
Session Freigabe covered podman conf/restart + VeciGate NAT. No git push of admin-log unless asked.