FAQ My NAS goes to the internet through a VPN. Can peers reach it, and is it slower?

[Silas Mariusz]

Symptoms

• Network & NAT shows IPv4 TCP port … not reachable, although the port is forwarded on your router.
• Route to the internet shows Another NAT likely before your router (IPv4).

Cause
Behind a VPN, peers see the address of the VPN, not yours. They can reach you only through a port that the VPN service forwards to you. A port forwarded on your own router does not open that port. When the NAS sends its own traffic through the VPN, Network & NAT shows Another NAT likely before your router (IPv4), because your router's WAN address differs from the public IP. This is expected behind a VPN.


Resolution

1. If the VPN runs on the NAS, bind rtorrent to the tunnel. Open Settings → Connection, press Choose… next to Bind to interface / IP, then press Use this interface on the tunnel's row. Choose the tunnel by its name, not by its address. A name follows address changes and also turns on the kill-switch.
   
   
2. Get an incoming port. In Settings → Port forwarding & VPN, set Ask the VPN for an incoming port. If your VPN service is the one named in the automatic option, choose that option. It asks the tunnel's gateway for a port over NAT-PMP and renews it every 45 seconds. Otherwise choose Manual: I have a port from my provider and type the port in port your VPN gave you. rtorrent then listens on that port.
   
   
3. Press Review & save and confirm the changes. Then press Apply now to restart rtorrent.
4. Open Network & NAT and press Check TCP port. The check tests the port on the address shown as Public IP on that page. It tests the VPN's port only if that address belongs to the VPN, which is when the NAS sends its own traffic through the VPN.

Notice & Advise

• If the VPN runs on your router, Rtorrent 16 can only ask your router for the port over UPnP or PCP / NAT-PMP. What the router does with that request depends on the router. You can also get a port from the VPN service, forward it on the router to the NAS, and choose Manual: I have a port from my provider with that port.
• Speed: We tested two NAS units on a line of about 930 Mbit/s, with rtorrent bound to the tunnel. Through WireGuard, rtorrent downloaded at the speed of the line. Through OpenVPN, the NAS's processor limited rtorrent to 35 MiB/s on one unit and 66 MiB/s on the other. With both tunnels, the first data arrived about 20 seconds later than without a VPN.

Ref. links:
Rtorrent 16 guide: Ports