Complete Guide: Setting up a Secure Torrent VPS with OpenVPN VPS on OVH Cloud (2 Instances)

[Clarke]

This tutorial will walk you through setting up two OVH Cloud VPS instances — one dedicated for torrenting (qBittorrent) and another for acting as a secure OpenVPN server.

The setup ensures:

Your torrenting VPS (TorrentVPS) never exposes its real IP.

All torrent traffic is routed through the OpenVPN VPS (OpenVPN-VPS).

You can seed and download at full speed while staying private.

Proper incoming port forwarding for maximum seeding efficiency.

1. Choosing VPS Plans​

For OVH Cloud, minimal VPS plans are enough:

TorrentVPS: 1 vCore, 2GB RAM, 20GB SSD (Ubuntu 24.04).

OpenVPN-VPS: 1 vCore, 2GB RAM, 20GB SSD (Ubuntu 24.04).

• 
  []Both should have public IPs (e.g., 123.123.123.10 for TorrentVPS and 123.123.123.20 for OpenVPN-VPS).
  []Ensure port 22 (SSH) is accessible from your computer.

2. Setup OpenVPN on OpenVPN-VPS​

Login to OpenVPN-VPS:

ssh [email protected]

Install OpenVPN and EasyRSA:

apt update && apt upgrade -y
apt install openvpn easy-rsa netfilter-persistent iptables-persistent -y

Setup EasyRSA PKI and build server certificates:

make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-dh
openvpn --genkey --secret ta.key

Create server configuration:

nano /etc/openvpn/server.conf

Paste:

port 1194
proto udp
dev tun
ca /root/openvpn-ca/pki/ca.crt
cert /root/openvpn-ca/pki/issued/server.crt
key /root/openvpn-ca/pki/private/server.key
dh /root/openvpn-ca/pki/dh.pem
tls-auth /root/openvpn-ca/ta.key 0
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3

Enable IP forwarding:

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

Add NAT masquerading (so VPN clients use the server’s public IP):

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADE
netfilter-persistent save

Start and enable OpenVPN:

systemctl enable openvpn@server
systemctl start openvpn@server

3. Create OpenVPN Client Config for TorrentVPS​

On OpenVPN-VPS, generate client certificates:

cd ~/openvpn-ca
./easyrsa gen-req tr-vps nopass
./easyrsa sign-req client tr-vps

Copy these files to TorrentVPS:

ca.crt

tr-vps.crt

tr-vps.key

ta.key

4. Setup TorrentVPS with OpenVPN Client​

Login to TorrentVPS:

ssh [email protected]

Install OpenVPN:

apt update && apt install openvpn -y

Create client config:

nano /etc/openvpn/client.conf

Paste (replace with your OpenVPN-VPS IP):

client
dev tun
proto udp
remote 123.123.123.20 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
auth SHA256
verb 3

ca ca.crt
cert tr-vps.crt
key tr-vps.key

Enable OpenVPN client service:

systemctl enable openvpn-client@client
systemctl start openvpn-client@client

5. Verify VPN Connection​

On TorrentVPS:

curl ifconfig.me

You should see the OpenVPN-VPS public IP (123.123.123.20).

For extra check:

curl --interface tun0 ifconfig.me

6. Setup qBittorrent on TorrentVPS​

Install qBittorrent-nox:

apt install qbittorrent-nox -y

Create systemd service:

nano /etc/systemd/system/qbittorrent.service

Paste:

[Unit]
Description=qBittorrent-nox
After=network.target [email protected]

[email protected]

[Service]
ExecStart=/usr/bin/qbittorrent-nox
Restart=on-failure
User=root

[Install]
WantedBy=multi-user.target

Enable service:

systemctl enable qbittorrent
systemctl start qbittorrent

Access web UI:

http://123.123.123.10:8080

(Default login: admin / adminadmin)

7. Configure Port Forwarding​

To maximize seeding, forward an incoming port (e.g., 61522) from OpenVPN-VPS → TorrentVPS.

On OpenVPN-VPS:

iptables -t nat -A PREROUTING -i ens3 -p tcp --dport 61522 -j DNAT --to-destination 10.8.0.2:61522
iptables -t nat -A PREROUTING -i ens3 -p udp --dport 61522 -j DNAT --to-destination 10.8.0.2:61522
netfilter-persistent save

Then, in qBittorrent WebUI → Preferences → Connection → Incoming Connections Port → set 61522.

8. Testing Your Setup​

1. 
   []On TorrentVPS, run:
   

   curl ifconfig.me

   → should show OpenVPN-VPS IP.
   []Add a torrent and check Peers tab. Peers should see OpenVPN-VPS IP.
2. Visit https://ipmagnet.services.cbcdn.com/[/URL ] in qBittorrent to confirm IP leak test.

9. Troubleshooting Common Issues​

Lost SSH Access: If default route is pushed by OpenVPN, you may lose SSH. Fix by disabling push "redirect-gateway def1" in server config and use policy routing. qBittorrent not accessible: Ensure firewall isn’t blocking your chosen port. Wrong IP showing: Always check with curl --interface tun0 ifconfig.me to ensure torrent traffic uses VPN.

Conclusion​

You now have a secure torrenting setup: TorrentVPS handles qBittorrent. OpenVPN-VPS hides your real IP and provides encrypted traffic. Proper port forwarding ensures fast download/upload. This setup avoids mistakes like lost SSH connectivity and ensures safe torrenting on OVH Cloud.
[/LIST]

 

[Clarke]

Fixing Stalled Torrents / Port Forwarding Issues​

Sometimes, torrents may stop seeding or peers cannot connect. Here’s how to test and fix common issues in a Torrent VPS + OpenVPN setup.

---

1. Check qBittorrent is listening​

On your Torrent VPS (`tr-vps`):

netstat -tulnp | grep 61522

- You should see `LISTEN` on your VPN IP (e.g., 10.8.0.2:61522).
- If not, check qBittorrent WebUI → Preferences → Connection → Network Interface → set to `tun0`.

---

2. Verify OpenVPN tunnel​

Check VPN interface:

ip addr show tun0
curl --interface tun0 ifconfig.me

- Public IP should be your OpenVPN VPS IP.
- If wrong, check OpenVPN client service:

systemctl status openvpn-client@client

---

3. Verify Port Forwarding on OpenVPN VPS​

On `vpn-tr-base`:

iptables -t nat -L -n -v
iptables -L FORWARD -n -v

- PREROUTING DNAT rules must exist for your qBittorrent port.
- FORWARD chain must allow traffic:

iptables -A FORWARD -i ens3 -o tun0 -p tcp --dport 61522 -j ACCEPT
iptables -A FORWARD -i ens3 -o tun0 -p udp --dport 61522 -j ACCEPT
netfilter-persistent save

---

4. Test External Connectivity​

From your local machine:

nc -zv <OpenVPN_VPS_Public_IP> 61522

- Should return `succeeded`.
- Or use online checker: https://canyouseeme.org

---

5. Monitor Live Traffic​

On `tr-vps`:

tcpdump -i tun0 port 61522

- Watch packets arriving when peers connect.
- If packets arrive but seeding still stalled → check tracker/peer availability.

---

6. Optional Automation Script​

- You can use a script to check qBittorrent, VPN, and port forwarding automatically.
- Save as `check_torrent_vpn.sh` and run periodically:

chmod +x check_torrent_vpn.sh
sudo ./check_torrent_vpn.sh

---

Following this will quickly identify and fix issues like stalled torrents, SSH loss, or port forwarding problems.


-----

Diagnostic & Test Script

Save this as check_torrent_vpn.sh on TorrentVPS:

#!/bin/bash

echo "=== Torrent VPS & VPN Check Script ==="

# 1. qBittorrent listening
echo "[1] Checking qBittorrent listening ports..."
netstat -tulnp | grep qbittorrent

# 2. VPN interface
echo "[2] Checking VPN interface tun0..."
ip addr show tun0

# 3. External IP via VPN
echo "[3] Checking public IP via VPN..."
curl --interface tun0 -s ifconfig.me

# 4. Test port forwarding from VPN VPS
echo "[4] Testing connectivity to forwarded port (example port 61522)..."
read -p "Enter OpenVPN VPS public IP: " vpn_ip
nc -zv $vpn_ip 61522

# 5. Capture live traffic for 10 seconds
echo "[5] Capturing traffic on tun0 for port 61522 (10s)..."
timeout 10 tcpdump -i tun0 port 61522 -n

echo "=== Check Complete ==="

Usage:

chmod +x check_torrent_vpn.sh
sudo ./check_torrent_vpn.sh

Enter your OpenVPN VPS public IP when prompted.

Script checks: qBittorrent listening, VPN interface, VPN public IP, port forwarding, live traffic.