How to Set Up qBittorrent with VPN, Sonarr, Radarr & Prowlarr on TrueNAS Scale

Homelab  ·  TrueNAS

📅 April 12, 2026 ✍ Bikram Bhujel ⏱ 12 min read

📋 Table of Contents

1. What We Are Building
2. The Full Stack Explained
3. Prerequisites
4. Setting Up Dockge on TrueNAS Scale
5. The Docker Compose File
6. Configuring ProtonVPN WireGuard with Gluetun
7. Connecting Prowlarr, Sonarr and Radarr
8. Adding FlareSolverr for 1337x
9. Pointing Jellyfin at Your Media Folders
10. Frequently Asked Questions

What We Are Building

Running a home media server is one thing. Running one that automatically finds, downloads, organises, and streams your content all while keeping your traffic private behind a VPN  is a completely different level. That is exactly what this guide covers.

By the end, your TrueNAS Scale NAS will have a fully automated media pipeline. Prowlarr manages your torrent indexers. Sonarr handles TV shows. Radarr handles movies. qBittorrent does the actual downloading. And Gluetun wraps all of it inside a ProtonVPN WireGuard tunnel so your ISP never sees what you are doing. Jellyfin then picks up the finished files and serves them to every screen in your home.

💡

This guide was built and tested on TrueNAS Scale Community Edition with an Intel N100 processor and 16 GB RAM. The same approach works on any TrueNAS Scale system running Docker via Dockge.

The Full Stack Explained

Before touching any configuration, understand what each piece does and why it belongs in the setup.

VPN

Gluetun

A lightweight VPN client container. Every other container routes its traffic through Gluetun. Built-in kill switch if the VPN drops, downloads stop immediately.

Downloader

qBittorrent

The actual torrent client. Runs inside Gluetun's network so all peer connections happen over ProtonVPN, not your real IP address.

Automation

Sonarr

TV show automation. Monitors RSS feeds, grabs new episodes, renames files, and moves them to your library automatically.

Automation

Radarr

Same as Sonarr but for movies. Add a movie once Radarr finds it, downloads the best available quality, and organises it.

Indexer

Prowlarr

Central indexer manager. Add your torrent sites once in Prowlarr and it syncs them automatically to both Sonarr and Radarr.

Proxy

FlareSolverr

Bypasses Cloudflare protection on indexer sites like 1337x that block VPN IP addresses. Required for most major public indexers.

Prerequisites

• TrueNAS Scale installed and accessible on your local network
• A storage pool created this guide uses a pool named Pool
• Jellyfin installed with your media dataset already configured
• A paid ProtonVPN account the free tier lacks port forwarding and uses throttled servers
• Dockge installed from the TrueNAS community app catalog
• Basic comfort navigating the TrueNAS web interface

🔑

Never share your WireGuard Private Key publicly. It authenticates your identity to the VPN server. Anyone with it can use your VPN quota and get your ProtonVPN account flagged. Treat it exactly like a password if you accidentally share it, generate a new one immediately.

Setting Up Dockge on TrueNAS Scale

Dockge is a visual Docker Compose manager that runs as a TrueNAS app. It gives you a clean UI to deploy and manage multi-container stacks without touching the command line for most tasks.

1. Go to Apps → Discover Apps and search for Dockge
2. Install it, pointing Dockge Stacks Storage to /mnt/Pool/dockge as a Host Path
3. Note the WebUI port number shown after installation completes
4. Access Dockge at http://YOUR_TRUENAS_IP:PORT in your browser

Once inside Dockge, any compose stacks you deploy appear in the left sidebar with real-time container status. It also streams logs from every container in one place, which makes troubleshooting straightforward.

The Docker Compose File

All six services live in a single compose file. Every container except Gluetun itself uses network_mode: service:gluetun this means they share Gluetun's network interface and all their traffic routes through the VPN tunnel automatically.

In Dockge, click + Compose, name your stack media-stack, and paste the following:

docker-compose.yml YAML

version: "3"
services:

  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    dns:
      - 8.8.8.8
      - 1.1.1.1
    ports:
      - "8081:8080"   # qBittorrent WebUI
      - "8989:8989"   # Sonarr
      - "7878:7878"   # Radarr
      - "9696:9696"   # Prowlarr
      - "8191:8191"   # FlareSolverr
    environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=<YOUR_PRIVATE_KEY_HERE>
      - WIREGUARD_ADDRESSES=10.2.0.2/32
      - SERVER_COUNTRIES=Singapore
      - DOT=off
      - FIREWALL_OUTBOUND_SUBNETS=192.168.0.0/24
    restart: unless-stopped

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    network_mode: service:gluetun
    environment:
      - PUID=568
      - PGID=568
      - TZ=Asia/Kathmandu
      - WEBUI_PORT=8080
    volumes:
      - /mnt/Pool/config/qbittorrent:/config
      - /mnt/Pool/Jellyfin/JellyFin_Content:/downloads
    depends_on:
      - gluetun
    restart: unless-stopped

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
    network_mode: service:gluetun
    environment:
      - PUID=568
      - PGID=568
      - TZ=Asia/Kathmandu
    volumes:
      - /mnt/Pool/config/sonarr:/config
      - /mnt/Pool/Jellyfin/JellyFin_Content:/media
    depends_on:
      - gluetun
    restart: unless-stopped

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    network_mode: service:gluetun
    environment:
      - PUID=568
      - PGID=568
      - TZ=Asia/Kathmandu
    volumes:
      - /mnt/Pool/config/radarr:/config
      - /mnt/Pool/Jellyfin/JellyFin_Content:/media
    depends_on:
      - gluetun
    restart: unless-stopped

  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
    network_mode: service:gluetun
    environment:
      - PUID=568
      - PGID=568
      - TZ=Asia/Kathmandu
    volumes:
      - /mnt/Pool/config/prowlarr:/config
    depends_on:
      - gluetun
    restart: unless-stopped

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    network_mode: service:gluetun
    environment:
      - LOG_LEVEL=info
      - TZ=Asia/Kathmandu
    depends_on:
      - gluetun
    restart: unless-stopped

networks: {}

⚠️

Replace <YOUR_PRIVATE_KEY_HERE> with your actual WireGuard private key from ProtonVPN. Also update volume paths if your pool or dataset names differ from this guide.

Configuring ProtonVPN WireGuard with Gluetun

WireGuard is the right choice over OpenVPN here. It is faster, uses less CPU, and establishes connections in milliseconds. On a low-power processor like the Intel N100, the difference is meaningful under sustained load.

Getting Your WireGuard Config from ProtonVPN

1. Log in at account.proton.me and go to VPN → Downloads → WireGuard configuration
2. Select a server with low load percentage — servers at 10–20% load give the best performance
3. Select WireGuard as the protocol and download the config file
4. Copy the PrivateKey value from the [Interface] section and paste it into your compose file

Key Environment Variables Explained

Variable	Value	Purpose
VPN_SERVICE_PROVIDER	protonvpn	Tells Gluetun which provider's server list to use
VPN_TYPE	wireguard	Protocol selection WireGuard is faster than OpenVPN
WIREGUARD_ADDRESSES	10.2.0.2/32	Your VPN tunnel IP from the ProtonVPN config file
DOT=off	off	Disables DNS-over-TLS, preventing DNS resolution failures on startup
FIREWALL_OUTBOUND_SUBNETS	192.168.0.0/24	Allows containers to reach your local network for qBittorrent and Jellyfin communication

Verifying the VPN is Working

After deploying the stack, open the Gluetun container logs in Dockge. A successful connection shows:

Gluetun container log LOG

INFO [wireguard] Connecting to 149.50.211.164:51820
INFO [vpn] wireguard setup is complete
INFO [ip getter] Public IP address is 159.26.115.129 (Singapore, Singapore)

That Singapore IP confirms your traffic is leaving through ProtonVPN and not your real ISP connection. Every container sharing Gluetun's network uses this same tunnel.

Connecting Prowlarr, Sonarr and Radarr

With all containers running, the wiring is straightforward. Prowlarr acts as the central hub — configure indexers once there and it pushes them to both Sonarr and Radarr automatically.

Step 1: Connect Apps in Prowlarr

1. Open Prowlarr at http://YOUR_NAS_IP:9696 and go to Settings → Apps → Add
2. Add Sonarr — Server: http://localhost:8989 — API Key: copy from Sonarr → Settings → General
3. Add Radarr — Server: http://localhost:7878 — API Key: copy from Radarr → Settings → General
4. Both should show Full Sync status when connected successfully

Step 2: Add Indexers in Prowlarr

Go to Indexers → Add Indexer and add the following. Test each one before saving:

• YTS best for high-quality movie releases, works reliably through VPN
• EZTV solid TV show indexer
• Nyaa.si essential if you watch anime
• 1337x general purpose, requires FlareSolverr (see next section)
• TorrentGalaxy good fallback for both movies and TV

Step 3: Add qBittorrent as Download Client

In both Sonarr and Radarr, go to Settings → Download Clients → Add → qBittorrent and enter your NAS IP, qBittorrent port, username, and password. Click Test if it returns green, save it.

Step 4: Set Root Folders

In Radarr → Settings → Media Management → Root Folders, add /media/Movies. In Sonarr, add /media/TV. These paths match the volume mounts defined in the compose file.

Adding FlareSolverr for 1337x and Cloudflare-Protected Sites

Many popular torrent indexers use Cloudflare bot protection. When Prowlarr running behind a VPN IP tries to access sites like 1337x, Cloudflare blocks the request. FlareSolverr sits between Prowlarr and the indexer, handling the challenge automatically.

1. Go to Prowlarr → Settings → Indexers → Indexer Proxies → Add
2. Select FlareSolverr as the proxy type
3. Set the URL to http://localhost:8191
4. Click Test you should see a green success response
5. When adding 1337x as an indexer, assign this FlareSolverr proxy to it in the indexer settings

💡

Use localhost:8191 not your NAS IP because FlareSolverr and Prowlarr share the same Gluetun network namespace and communicate internally without leaving the container network.

Pointing Jellyfin at Your Media Folders

If you already have Jellyfin running as a native TrueNAS app, connecting it to your download folders is quick. Under Storage Configuration → Additional Storage, add these host path entries:

Mount Path (inside Jellyfin container)	Host Path (on TrueNAS disk)
/Movies	/mnt/Pool/Jellyfin/JellyFin/Movies
/TV	/mnt/Pool/Jellyfin/JellyFin/TV
/Documentary	/mnt/Pool/Jellyfin/JellyFin/Documentary

When Radarr downloads a movie and moves it to /media/Movies inside its container, that maps directly to /mnt/Pool/Jellyfin/JellyFin_Content/Movies on disk exactly where Jellyfin is looking. Download finishes, Jellyfin picks it up automatically, it appears in your library within minutes.

Frequently Asked Questions

Can I use ProtonVPN free tier with qBittorrent on TrueNAS Scale?

Technically yes, but it is not practical for a media server. The free tier throttles speeds, limits you to three server locations, and does not support port forwarding. Without port forwarding, qBittorrent operates in passive mode with fewer peer connections and slower downloads. A paid ProtonVPN plan removes all these restrictions.

Does Gluetun have a kill switch?

Yes and it is always enabled by default. Gluetun uses iptables rules to block all outbound internet traffic for containers sharing its network unless that traffic routes through the VPN tunnel. If the WireGuard connection drops, qBittorrent immediately loses internet access. Your real IP is never exposed.

What is FlareSolverr and why do I need it?

FlareSolverr is a headless browser proxy that solves Cloudflare bot challenges. When Prowlarr queries indexers like 1337x from a VPN IP address, Cloudflare often returns a 403 block. FlareSolverr handles the JavaScript challenge automatically and passes the result back to Prowlarr, making the indexer accessible through the VPN.

Why use WireGuard instead of OpenVPN with Gluetun?

WireGuard is faster, more efficient, and simpler than OpenVPN. It uses modern cryptography, has a codebase roughly 100 times smaller which reduces the attack surface, and establishes tunnels in under a second. On a 24/7 NAS handling multiple workloads, WireGuard's lower CPU overhead is a meaningful advantage.

Do Sonarr and Radarr need to be inside the VPN tunnel?

They do not strictly need to be, but running them inside Gluetun's network is best practice. It ensures all their outbound traffic indexer queries, metadata fetches, update checks — also routes through the VPN. It also simplifies networking since all containers communicate over localhost rather than needing your NAS IP address.

How do I verify my torrent traffic is going through the VPN?

Check the Gluetun container logs in Dockge. Look for the line starting with "Public IP address is" — it shows the VPN server's IP and location. You can also add a test magnet link from ipleak.net to qBittorrent, which reports the IP address used for that torrent connection. It should show the VPN IP, not your real ISP IP.

---

Written from a real homelab build. Tested on TrueNAS Scale Community Edition · Intel N100 · 8 GB DDR4 · April 2026

Tags: TrueNAS Homelab Docker ProtonVPN Sonarr Radarr Prowlarr Jellyfin Self-Hosted qBittorrent WireGuard