Is this enough to use wireguard-go?

[leona]

I'd like to be able route everything through wireguard-go and have a single container running my vpn and torrent client.

Here is the ClientConfig I've tested, with the tnet.DialContext coming from wireguard-go.

clientConfig := torrent.NewDefaultClientConfig()

clientConfig.HTTPDialContext = tnet.DialContext

clientConfig.HTTPProxy = nil

clientConfig.ClientTrackerConfig.TrackerDialContext = tnet.DialContext

I tried the torrent leak test at https://ipleak.net/ and only the VPN IP shows. Is it that simple or am I missing something? Also I'm using Mullvad so no port forwarding support.

[anacrolix]

I think the things you've specified cover HTTP and WebRTC trackers.

You might want to set ListenHost to ensure connections are dialed out from the correct network interface. I'm not sure that's sufficient, but you can override the dialers with torrent.Dialer to get exactly the behaviour you want.

I think you also need TrackerListenPacket for UDP trackers, setting it to the correct network host again.

DHT should work through wireguard (passive mode because you don't have port forwarding) if you have the correct UDP host as above.

When you have the client running, maybe check that all the connections you're seeing from the process using anacrolix/torrent have local IPs as you'd expect.

I'm assuming when you embed wireguard-go that you an extra network interface and so the above is necessary.

[leona]

Thanks for the help. I don't think it's creating an extra interface, it doesn't need anything installed or access to /dev/tun. Here's the example I based it off https://github.com/WireGuard/wireguard-go/blob/master/tun/netstack/examples/http_client.go
Would I still need ListenHost and ListenPacket then? Not sure how to implement them but something like this maybe?

func ListenHost(network string) string {
	return wireguardClient.PublicAddress // Public or local address?
}

func ListenPacket(network, address string) (net.PacketConn, error) {
	// No idea what to put here
	return net.ListenPacket(network, wireguardClient.PublicAddress) // ??
}

func MakeTorrentclient() {
	clientConfig := torrent.NewDefaultClientConfig()

	clientConfig.HTTPDialContext = wireguardClient.Tnet.DialContext
	clientConfig.HTTPProxy = nil
	clientConfig.ClientTrackerConfig.TrackerDialContext = wireguardClient.Tnet.DialContext
	clientConfig.ClientTrackerConfig.TrackerListenPacket = ListenPacket
	clientConfig.ListenHost = ListenHost
	client, err := torrent.NewClient(clientConfig)
}

Also I ran ss -tunap when downloading something and it starts like below, then a bunch of ESTAB ones show up with random IPs and ports. So I presume that's not good.

tcp      TIME-WAIT     0          0                 172.22.0.2:37872         45.83.redacted.redacted:443                                       
tcp      TIME-WAIT     0          0                 172.22.0.2:51342         45.83.redacted.redacted:443                                       
tcp      ESTAB         0          0                 172.22.0.2:47178         45.83.redacted.redacted:443   

172.22.0.2 is my containers address, I presume the 45.83 one is a trackers host as it's not my VPN for sure, so that's worrying.

[anacrolix]

I don't know enough about VPNs to say. I do use Mullvad, and would expect that all your traffic is routed from the container though Mullvad if you use the default configuration. Certainly when using my torrent client and Mullvad, everything goes through it without any special configuration. To that end I would expect that as long as your VPN is running and it is the default route you do not need to do any special configuration at all, including what was in your original comment.

[anacrolix]

I should add that you should start your VPN before starting the client, as it will determine your public IP and then keep it for the life of the client.