Stand Alone NordLynx

[instantdreams]

I like all my microservices to be isolated from each other. Because of this, I have a set of docker-compose.yml files in separate directories.

What I'd like to do is have NordLynx connect in a container and expose its network connection using Docker networking, and then route other containers.

To do this I believe I have to do the following:

• Stand up a NordVPN container
• Use the command sudo docker run --rm --cap-add=NET_ADMIN -e USER=[username] -e PASS=[password] ghcr.io/bubuntux/nordvpn nord_private_key to retrieve my private key
• Stand up a NordLynx container and pass the private key in
• Configure a container to use NordLynx and refresh it, then confirm the networking is passing through NordLynx

Does this seem like the correct approach?
If I'm using docker-compose.yml files (and .env files for the details), do I need to expose the ports from my other container to NordLynx, like many of the examples I've seen for NordVPN seem to do?

It's quite hard to find examples of implementations online for this so far, so any help is appreciated.

[instantdreams]

I'd like to share my configuration so far.

nordlynx docker-compose.yml

version: "3"
services:
  nordlynx:
    image: ghcr.io/bubuntux/nordlynx
    container_name: nordlynx
    networks:
      connection:
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.rp_filter=2 # Set Reverse Path filter to loose mode
      - net.ipv6.conf.all.disable_ipv6=1  # Disable ipv6 - recommended if using ipv4 only
    ports:
      - 8112:8112 # Deluge
      - 6881:6881 # Deluge
      - 6881:6881/udp # Deluge
    environment:              
      - PRIVATE_KEY=${PRIVATEKEY}
      - NET_LOCAL=${LOCALIP}
    restart: unless-stopped 
networks:
  connection:
    driver: bridge
    name: connection

deluge docker-compose.yml

version: "2.1"
services:
  deluge:
    image: lscr.io/linuxserver/deluge
    container_name: deluge
    network_mode: container:nordlynx
    environment:
      - PUID=${PUID} # default user id, defined in .env
      - PGID=${PGID} # default group id, defined in .env
      - TZ=${TZ} # timezone, defined in .env
      - DELUGE_LOGLEVEL=error #optional
    volumes:
      - ${APPDATA}:/config
      - ${TORRENTS}:/downloads
    restart: unless-stopped

This seems to work, in that the two containers come up with no issues.

If I sudo docker-compose exec nordlynx bash into the vpn container, the following commands all seem to work:

1. Test curl response

bash-5.1# curl www.nordvpn.com -I
HTTP/1.1 301 Moved Permanently
Date: Sat, 25 Dec 2021 05:36:45 GMT
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sat, 25 Dec 2021 06:36:45 GMT
Location: https://nordvpn.com/
Server: cloudflare
CF-RAY: 6c2fb6a9da87842c-YVR

2. Test ping response

bash-5.1# ping -c 1 www.nordvpn.com
PING www.nordvpn.com (104.17.49.74): 56 data bytes
64 bytes from 104.17.49.74: seq=0 ttl=60 time=14.893 ms

--- www.nordvpn.com ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 14.893/14.893/14.893 ms

My only issue is confirming the Nordlynx connection is up. I tried this:

3. Grep curl response from https://www.dnsleaktest.com

bash-5.1# curl https://www.dnsleaktest.com/ -v | grep hello
1                               <p class="hello">Hello [ip address]</p>

The IP returned is not my ISP assigned IP address which should indicate everything is working - but Deluge has no down speed entries for any active downloads, and many have a tracker status of "Error: Timed out".

Any ideas what I can do to resolve this?

[ThxAndBye]

You should put the VPN and the service that use it into the same compose file.
Not only does this make it much simpler to start and stop, but you are also able to control dependencies (Deluge depends on the VPN).
Just have deluge as a service in the same compose file and add to the deluge service:

    depends_on:
      - nordlynx

This will make sure that deluge gets started after the VPN container is running and gets stopped before the VPN container.

To check if the connection is established you can add this health-check to the NordLynx container:

healthcheck:
      test: ["CMD-SHELL", "curl https://api.nordvpn.com/vpn/check/full | grep '\"status\":\"Protected\"' && exit 0 || exit 1"]

As long as the container is showing a good health, it has established a connection to a NordVPN server.

Also I'd recommend you to connect to a p2p server from NordVPN as they seem to work better for torrents.
Just add as an environment variable to the NordLynx container:
QUERY=filters\[servers_groups\]\[identifier\]=legacy_p2p

If you want to access a service (e.g. the WebUI from Deluge) then you need to add the port forwards to the NordLynx container only as that is the one responsible for all networks. By adding network_mode: container:nordlynx you basically disable any network parts that this container had and replace them with the networks from the designated container.

[instantdreams]

I appreciate that is the generally accepted approach, but I want to keep the containers separate, in part to see how it could be done. I'd like the containers to be inter-dependent rather that intra-dependent.

My Deluge container has been downloading some Linux ISOs, but not all of them. Some are still timing out. It's better than I expect.

I'll add the healthcheck to my Nordlynx container docker-compose file, thank you for that. I'm assuming that result will show in the container logs?

I shall certainly add that p2p query to my Nordlynx container and test the results.

All my service ports are in the Nordlynx container only, and are not in the origin container. I was previously trying to link to the Nordlynx created network using network_mode: service:nordlynx, or service:nordlynx_nordlynx, or even service:connection, but this was never the correct reference to the network stack created. I found a post that suggested referencing the container directly was the right way to go.

I'm experimenting right now, and enjoying the process. I hope I can document this along the way to help others playing with this Nordlynx docker image. I do appreciate your feedback and suggestions, and will apply them.

[instantdreams]

Well, @ThxAndBye, I think you've fixed all my issues. :) Posting the details for reference.

My deluge/docker-compose.yml file:

version: "2.1"
services:
  deluge:
    image: lscr.io/linuxserver/deluge
    container_name: deluge
    network_mode: container:nordlynx
    environment:
      - PUID=${PUID} # default user id, defined in .env
      - PGID=${PGID} # default group id, defined in .env
      - TZ=${TZ} # timezone, defined in .env
      - DELUGE_LOGLEVEL=error #optional
    volumes:
      - ${APPDATA}:/config
      - ${TORRENTS}:/downloads
    restart: unless-stopped

My nordlynx/docker-compose.yml file:

version: "3"
services:
  nordlynx:
    image: ghcr.io/bubuntux/nordlynx
    container_name: nordlynx
    networks:
      connection:
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.rp_filter=2 # Set Reverse Path filter to loose mode
      - net.ipv6.conf.all.disable_ipv6=1  # Disable ipv6 - recommended if using ipv4 only
    ports:
      - 8112:8112 # Deluge
      - 6881:6881 # Deluge
      - 6881:6881/udp # Deluge
    environment:              
      - PRIVATE_KEY=${PRIVATEKEY}
      - QUERY=filters\[servers_groups\]\[identifier\]=legacy_p2p
      - NET_LOCAL=${LOCALIP}
    healthcheck:
          test: ["CMD-SHELL", "curl https://api.nordvpn.com/vpn/check/full | grep '\"status\":\"Protected\"' && exit 0 || exit 1"]
    restart: unless-stopped 
networks:
  connection:
    driver: bridge
    name: connection

The process to start this stack:

$ sudo docker-compose -f /srv/nordlynx/docker-compose.yml up -d
Creating network "connection" with driver "bridge"
Creating nordlynx ... done

$ sudo docker-compose -f /srv/deluge/docker-compose.yml up -d
Creating deluge ... done

$ sudo docker ps
IMAGE                                  COMMAND   CREATED          STATUS                    NAMES
lscr.io/linuxserver/deluge             "/init"   12 minutes ago   Up 12 minutes             deluge
ghcr.io/bubuntux/nordlynx              "/init"   13 minutes ago   Up 13 minutes (healthy)   nordlynx

I could also start this stack using the following command:

$  sudo docker-compose -f /srv/nordlynx/docker-compose.yml -f /srv/deluge/docker-compose.yml up -d

This should start the Nordlynx container first then the Deluge container that depends on it. Not tested this yet, will try at some point later.

I shall monitor the containers over the next few days to see how they behave, but so far this is the behaviour I was hoping for. I'm certainly going to explore the healthcheck: options for other containers. Thank you again!

[instantdreams]

Revisiting this to say that my separate container approach has been working well for 10 months now.

nordlynx docker-compose.yml

version: "3"
services:
  nordlynx:
    image: ghcr.io/bubuntux/nordlynx
    container_name: nordlynx
    networks:
      - nordlynx_net
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - 8112:8112
      - 6881:6881
      - 6881:6881/udp
    environment:              
      - PRIVATE_KEY=${PRIVATEKEY}
      - QUERY=filters\[servers_groups\]\[identifier\]=legacy_p2p
      - NET_LOCAL=${LOCALIP}
    sysctls:
      - net.ipv4.conf.all.rp_filter=2     # Set Reverse Path filter to loose mode
      - net.ipv6.conf.all.disable_ipv6=1  # Disable ipv6 - recommended if using ipv4 only
    healthcheck:
          test: ["CMD-SHELL", "curl https://api.nordvpn.com/vpn/check/full | grep '\"status\":\"Protected\"' && exit 0 || exit 1"]
    restart: unless-stopped 
networks:
  nordlynx_net:
    driver: bridge
    name: nordlynx_net

deluge docker-compose.yml

version: "2.1"
services:
  deluge:
    image: lscr.io/linuxserver/deluge:amd64-2.0.5-0202202181752ubuntu20.04.1-ls140
    container_name: deluge
    network_mode: container:nordlynx
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
      - DELUGE_LOGLEVEL=error
    volumes:
      - ${APPDATA}:/config
      - ${DOWNLOADS}:/downloads
    restart: unless-stopped

Note that at the moment I am using a specific version of deluge until the issue with downloads has been resolved.

[jonyskids]

Still running?

[instantdreams]

Yup - just using Transmission for the time being.

[jonyskids]

Also how do set where Nord is connecting through? Say Sweden instead of US?