Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to ensure that transmission only sends/receives traffic when the server it runs on is connected to a VPN.

I found this question which is similar but I don't want to force all traffic through the VPN and I haven't been able to find a good guide on how to use firestarter from the command line.

Instead I was thinking of using ufw, but I have little to no experience with firewalls, and I'm hoping the community can help me out.

One idea I had would be to force transmission to use a specific port, say 33442, and then only allow traffic to and from that port from the IP address of the VPN server. I checked out the Ubuntu server guide and I think could do something like this:

sudo ufw enable
sudo ufw deny port tcp from localhost to any port 33442
sudo ufa allow port tcp from localhost to VPNIP port 33442
sudo ufw deny port udp from localhost to any port 33442
sudo ufa allow port udp from localhost to VPNIP port 33442

Does this logic hold its salt? How would you do it? What would I use for VPNIP, the public IP of the VPN server, or should I specify the local subnet range that the VPN connects me to?

Thanks for your help!

share|improve this question
sudo groupadd vpnroute
sudo iptables -A OUTPUT -m owner --gid-owner vpnroute \! -o tun0 -j REJECT
sudo -g vpnroute transmission-gtk &
share|improve this answer
This is exactly what I was looking for. Thanks! – Taeram Jul 22 '13 at 23:49
This is very useful for routing traffic trough VPN from applications which do not support selecting which interface to listen to. Transmission is one of those unfortunate applications. – wojci Aug 15 '13 at 20:13
Warning: this doesn't work with Deluge, AFAICT because Deluge spawns off sup processes. I've tested it carefully and my setup is right - sudo -g vpnroute ping will show 'Destination unreachable' until I enable the VPN on tun0. But the Deluge UI can always download torrents, whether VPN is connected or not. With pgrep -G vpnroute I found it's because only the initial /usr/bin/python process is run under the vpnroute GID, spawned deluge-gtk processes seem not to be. – happyskeptic Jun 17 '14 at 20:44
Could somebody explain what each of these steps does, exactly? – ohnoplus Nov 12 '14 at 16:43
Transmission does have the ability to listen to a specific address - but not to a specific interface. When started from the command line, --bind-address-ipv4 $IP_ADDR will tell Transmission which address to bind to. This then requires the right routing rules to ensure the traffic gets to the right place. Have a look at this question for how I managed to do it. – seanlano Feb 10 '15 at 22:33

Ideally you should use a torrent client that has a feature to bind to a specific interface (the VPN interface).

Among torrent clients, Deluge does this. So you can install Deluge and configure the interface in the Preferences and you are set!

share|improve this answer
Thanks for your answer. I'm actually pretty set on using Transmission for the moment though, do you know if it's possible to bind to specific interface or IP range (so it only uses the VPN) with Transmission? Thanks! – Evan Apr 29 '11 at 21:02
@user4124 Do you know how to bind Deluged to a specific network interface via the command line or the webui? Since no one seems to know how to do this with Transmission, I've been trying Deluge but haven't had luck so far. Thanks! – Evan May 3 '11 at 1:43
@Evan you can specify ip address to bind to in Deluge with listen_interface in deluge-console or Interface in Network options. – Cas Jun 25 '11 at 21:29
@Cas, thanks, i'll try that! – Evan Jun 30 '11 at 21:39
While this is true I think this is still bad advice even if your only purpose is to hide your illegal torrent downloads you should enbrace your VPN anonymity and look for solutions that are system wide and not only working for one program. – redanimalwar May 8 '14 at 7:40

This works for a headless transmission, I am restricting traffic based on the user that is running the transmission service, is your internal network you should change it to match your network, tun0 is your OpenVPN interface, eth0 is your LAN connection.

Add sudo to commands, if you are not root:

iptables -F (We used the -F switch to flush all existing rules so we start with a clean state from which to add new rules.)

iptables -L (list current setup)

iptables -A OUTPUT -d -p tcp --sport 9091 -m owner --gid-owner debian-transmission -o eth0 -j ACCEPT
iptables -A OUTPUT -d -p udp --sport 9091 -m owner --gid-owner debian-transmission -o eth0 -j ACCEPT
iptables -A OUTPUT -m owner --gid-owner debian-transmission -o tun0 -j ACCEPT
iptables -A OUTPUT -m owner --gid-owner debian-transmission -o lo -j ACCEPT
iptables -A OUTPUT -m owner --gid-owner debian-transmission -j REJECT

make the iptables persistent after restart

apt-get install iptables-persistent
service iptables-persistent start
share|improve this answer
This one gives me the following : $ sudo iptables -A OUTPUT -d -p tcp --sport 9091 -m owner --gid-owner debian-transmission -o eth0 -j ACCEPT iptables v1.4.12: owner: Bad value for "--gid-owner" option: "debian-transmission" Am I missing something? – ohnoplus Nov 22 '14 at 17:39
Yes, @ohnoplus :) You have to create the group (or owner) debian-transmission first. And ensure you're running the application as this group or user:group. – Joachim Nov 19 '15 at 21:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.