Can't get FlareSolverr to play nice with Prowlarr inside VPN

[PeachMan]

I can install Flaresolverr and access its JSON page, but for some reason I can't make it visible to Prowlarr (which is going through my VPN via Gluetun).

Here's the Flaresolverr section in my docker-compose.custom.yaml:

Code: Select all

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    environment:
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - LOG_HTML=${LOG_HTML:-false}
      - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none}
      - TZ=America/New_York
    ports:
      - "${PORT:-8191}:8191"
    restart: unless-stopped

When I first set this up and it didn't work, I assumed it was because Prowlarr was inside the VPN and Flaresolverr was outside. So, I tried to put Flaresolverr inside as well, basically following the same steps in your Prowlarr+VPN guide: https://yams.media/advanced/prowlarr-behind-vpn/

Code: Select all

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    network_mode: "service:gluetun"
    environment:
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - LOG_HTML=${LOG_HTML:-false}
      - CAPTCHA_SOLVER=${CAPTCHA_SOLVER:-none}
      - TZ=America/New_York
      - WEBUI_PORT=8191 #added for gluetun
    #ports:
    #  - "${PORT:-8191}:8191"
    restart: unless-stopped

Also added "8191:8191/tcp" to my Gluetun ports in docker-compose.yaml. I'm not sure if that "WEBUI_PORT" line is actually necessary, since Flaresolverr doesn't really have a web UI....

But whether I set up Flaresolverr inside or outside of the Gluetun network, Prowlarr can't see it: "Http request timed out." If I ALSO take Prowlarr OUT of Gluetun, then it can actually see Flaresolverr! But I do need to keep Prowlarr going through VPN, I get all sorts of indexer failures when it's out.

I feel like there's some very obvious detail that I'm missing here.

[rogs]

Hey @PeachMan!

I do not use Flaresolver, but I think it should be part of the same network as Prowlarr in order to work, so you'll need to put it behind the VPN as well. Also, WEBUI_PORT=8191 is a setting for qBittorrent, you can remove it safely.

If Flaresolver runs in port 8191 natively, you'll need to add it to Gluetun as well to make it public. That should make it at least run. If it doesn't, check the logs and see if it's telling you an error.

Cheers!

Roger.

[PeachMan]

Oh, wait, now Prowlarr can't see ANY other apps. The hostnames aren't resolving: "Unable to complete application test, cannot connect to Radarr. Name does not resolve (radarr:7878)"

Here's my prowlarr config:

Code: Select all

prowlarr:
    image: lscr.io/linuxserver/prowlarr
    container_name: prowlarr
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - WEBUI_PORT=9696 #if routing through VPN
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${INSTALL_DIRECTORY}/config/prowlarr:/config
    #ports:
    #  - 9696:9696
    network_mode: "service:gluetun" #to route through VPN
    restart: unless-stopped

And my gluetun config:

Code: Select all

  devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8003:8000/tcp # Admin
      - 8080:8080/tcp # gluetun
      - 8081:8081/tcp # gluetun
      - 8191:8191/tcp # flaresolverr
      - 9696:9696/tcp # added for prowlarr over VPN
    environment:
      - VPN_SERVICE_PROVIDER=${VPN_SERVICE}
      - VPN_TYPE=openvpn
      - OPENVPN_USER=${VPN_USER}
      - OPENVPN_PASSWORD=${VPN_PASSWORD}
      - SERVER_REGIONS=CA Ontario,CA Montreal,CA Toronto
      - OPENVPN_CIPHERS=AES-256-GCM
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on
      - FIREWALL_OUTBOUND_SUBNETS=172.18.0.0/24
    restart: unless-stopped

I must be missing something here. Do I need to have ALL of the apps that communicate with Prowlarr going through Gluetun?

[rogs]

Now that Prowlarr is behind the VPN, you'll need to connect to the services using their Docker IP addresses. You can find the IP by using Portainer or by running the following command:

First, go to your install directory:

Code: Select all

cd /your/install/directory

Then, run:

Code: Select all

docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $(docker compose ps -q sonarr)

This command will give you the IP address for Sonarr. Just replace sonarr at the end with radarr or any other service name in YAMS to get their respective IPs.

Cheers!

Roger.

[PeachMan]

Okay, so, some very unexpected things happen. First, I realized that the internal docker IP's assigned are not static???? They change each time I make these changes to the .yaml and restart.

Second, each time I restart yams, SOME services don't even get an internal IP! Last time, it was prowlarr, but this time it was qbittorrent. Any idea what's going on there?

Can I assign the IP's somehow?

Code: Select all

  # Prowlarr is our torrent indexer/searcher. Sonarr/Radarr use Prowlarr as a source
  # https://prowlarr.com/
  prowlarr:
    image: lscr.io/linuxserver/prowlarr
    container_name: prowlarr
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - WEBUI_PORT=9696 #uncomment if routing through VPN
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${INSTALL_DIRECTORY}/config/prowlarr:/config
    #ports:
    #  - 9696:9696
    network_mode: "service:gluetun" #to route through VPN
    restart: unless-stopped

  # Gluetun is our VPN, so you can download torrents safely
  gluetun:
    image: qmcgaw/gluetun:v3
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
      - 8003:8000/tcp # Admin
      - 8080:8080/tcp # gluetun
      - 8081:8081/tcp # gluetun
      #- 8191:8191/tcp # flaresolverr
      - 9696:9696/tcp # added for prowlarr over VPN
    environment:
      - VPN_SERVICE_PROVIDER=${VPN_SERVICE}
      - VPN_TYPE=openvpn
      - OPENVPN_USER=${VPN_USER}
      - OPENVPN_PASSWORD=${VPN_PASSWORD}
      - SERVER_REGIONS=CA Ontario,CA Montreal,CA Toronto
      - OPENVPN_CIPHERS=AES-256-GCM
      - PORT_FORWARD_ONLY=on
      - VPN_PORT_FORWARDING=on
      - FIREWALL_OUTBOUND_SUBNETS=172.18.0.0/24
    restart: unless-stopped

[rogs]

Yep, by default Docker assigns dynamic IPs, so they can change on every restart. And when you use network_mode: "service:gluetun", the container shares Gluetun’s network namespace. It won’t get its own IP, which is why qbittorrent or prowlarr sometimes seem “missing.”

If you want static IPs (for services not using network_mode), you can do this:

First, define a custom network

Code: Select all

networks:
  media_net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.18.0.0/24

Then, assign static IPs per container:

Code: Select all

sonarr:
  networks:
    media_net:
      ipv4_address: 172.18.0.10

Only do this for containers not using network_mode: service:gluetun.

[rogs]

Hey @PeachMan!

I've updated the "Running Prowlarr Behind the VPN" documentation, and the networking is working as expected now! Feel free to check the changes here: https://yams.media/advanced/prowlarr-behind-vpn/ and the code changes here: https://gitlab.com/rogs/yams/-/commit/9 ... f8766416e6

Cheers!

Roger.