koopa-admin-log/2026/2026-09-25--qbittorrent-bt-net.md

2026-09-25 — qBittorrent BT net (flame / firewalled)

Goal

Inbound BT listen 6881 tcp+udp reachable so WebUI connection status leaves the firewalled (flame) state.

Live on koopa

• CTR koopa-prime-qbittorrent (linuxserver): host 6881 tcp+udp, WebUI 9023→8080 → bt.hacktivism.ch
• Conf: Session\Port=6881, PortForwardingEnabled=true, Connection\UPnP=true
• Temp: /downloads/incomplete/ (abc / host uid 100999)
• Durable apply: scripts/prime/apply-qbittorrent-bt-net.sh (+ wrapper koopa-bt-fix.sh)
• Clone on host: ~/koopa-admin-log/scripts/prime/

firewalld

• Doc: configs/firewalld/public-ports.md — 6881/tcp+udp
• Agent cannot list without sudo/polkit; human opens with:

  sudo firewall-cmd --permanent --add-port=6881/tcp
  sudo firewall-cmd --permanent --add-port=6881/udp
  sudo firewall-cmd --reload
  

• WAN probe success (below) implies the path through host firewall is open.

VeciGate (2026-09-25)

• wan dstnat tcp+udp 6881 → 192.168.100.95:6881
• hairpin LAN 192.168.100.0/24 and LAN2 192.168.88.0/24 → 212.51.151.254:6881 tcp+udp
• Comments: koopa: qBittorrent BT … / hairpin: LAN[2] qBittorrent BT …
• Detail: vecigate-admin-log 2026/2026-09-25--qbittorrent-bt-dnat.md

Verify (2026-09-25, from magikoopa)

Probe	Result
nc -vz 192.168.100.95 6881	LAN_TCP_OK
nc -vz 212.51.151.254 6881	WAN_TCP_OK
nc -zu 212.51.151.254 6881	WAN_UDP_OK

WebUI API (/api/v2/…) still auth-gated from agent — human glance at connection icon on bt.hacktivism.ch.

Freigabe

Session Freigabe covered podman conf/restart + VeciGate NAT. No git push of admin-log unless asked.