From d71bd0fe3c7bb54aeb4156b46796d10b6ad45f24 Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Mon, 20 Mar 2023 00:13:10 +0000
Subject: [PATCH 01/11] update: workflow/docker-image.yml - try and build arm64

---
 .github/workflows/docker-image.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index b33c915..9af0a5e 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -17,6 +17,7 @@ on:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
+  TARGET_PLATFORMS: linux/amd64,linux/arm64
 
 jobs:
   build-and-push-image:
@@ -49,3 +50,4 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          platforms: ${{ env.TARGET_PLATFORMS }}

From 5eef3416187117a318b885984ca3413ec9e4ef55 Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Mon, 20 Mar 2023 00:21:37 +0000
Subject: [PATCH 02/11] update: workflow/docker-image.yml - try and build arm64
 (2)

---
 .github/workflows/docker-image.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 9af0a5e..b70a59f 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -30,6 +30,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v3
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          platforms: ${{ env.TARGET_PLATFORMS }}
+
       - name: Log in to the Container registry
         uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
         with:

From 103b4d5e64580c6d4701f0bde23c4af93d410337 Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Mon, 20 Mar 2023 02:22:57 +0000
Subject: [PATCH 03/11] update: data/start.sh - reorder some code and add more
 error checking

---
 data/start.sh | 40 +++++++++++++++++++++++++++++++++-------
 1 file changed, 33 insertions(+), 7 deletions(-)

diff --git a/data/start.sh b/data/start.sh
index 5e87e10..bf72f93 100755
--- a/data/start.sh
+++ b/data/start.sh
@@ -13,6 +13,7 @@ findconfiguredport() {
 }
 
 findactiveport() {
+    natpmpc -g ${VPN_GATEWAY} -a 0 0 udp ${NAT_LEASE_LIFETIME} >/dev/null 2>&1
     natpmpc -g ${VPN_GATEWAY} -a 0 0 tcp ${NAT_LEASE_LIFETIME} | grep -oP '(?<=Mapped public port.).*(?=.protocol.*)'
 }
 
@@ -25,18 +26,23 @@ qbt_changeport(){
     return $?
 }
 
-public_ip=$(getpublicip)
-qbt_sid=$(qbt_login)
-configured_port=$(findconfiguredport ${qbt_sid})
-active_port=''
+qbt_checksid(){
+    if echo $(curl -s --header "Referer: http://${QBITTORRENT_SERVER}:${QBITTORRENT_PORT}" --cookie "${qbt_sid}" http://${QBITTORRENT_SERVER}:${QBITTORRENT_PORT}/api/v2/app/version) | grep -qi forbidden; then
+        return 1
+    else
+        return 0
+    fi
+}
 
 get_portmap() {
     res=0
     public_ip=$(getpublicip)
 
-    if echo $(curl -s --header "Referer: http://${QBITTORRENT_SERVER}:${QBITTORRENT_PORT}" --cookie "${qbt_sid}" http://${QBITTORRENT_SERVER}:${QBITTORRENT_PORT}/api/v2/app/version) | grep -qi forbidden; then
+    if ! qbt_checksid; then
         echo "$(timestamp) | qBittorrent Cookie invalid, getting new SessionID"
         qbt_sid=$(qbt_login)
+    else
+        echo "$(timestamp) | qBittorrent SessionID Ok!"
     fi
 
     configured_port=$(findconfiguredport ${qbt_sid})
@@ -49,11 +55,14 @@ get_portmap() {
     if [ ${configured_port} != ${active_port} ]; then
         if qbt_changeport ${qbt_sid} ${active_port}; then
             docker exec ${VPN_CT_NAME} /sbin/iptables -A INPUT -i ${VPN_IF_NAME} -p tcp --dport ${active_port} -j ACCEPT
-            docker exec ${VPN_CT_NAME} /sbin/iptables -D INPUT -i ${VPN_IF_NAME} -p tcp --dport ${configured_port} -j ACCEPT
+            docker exec ${VPN_CT_NAME} /sbin/iptables -A INPUT -i ${VPN_IF_NAME} -p udp --dport ${active_port} -j ACCEPT
+            if docker exec ${VPN_CT_NAME} /sbin/iptables -L INPUT -n | grep -qP "^ACCEPT.*${configured_port}.*"; then
+                docker exec ${VPN_CT_NAME} /sbin/iptables -D INPUT -i ${VPN_IF_NAME} -p tcp --dport ${configured_port} -j ACCEPT
+                docker exec ${VPN_CT_NAME} /sbin/iptables -D INPUT -i ${VPN_IF_NAME} -p udp --dport ${configured_port} -j ACCEPT
+            fi
             if docker exec ${VPN_CT_NAME} /sbin/iptables -L INPUT -n | grep -qP "^ACCEPT.*${active_port}.*"; then
                 echo "$(timestamp) | IPTables rule added for port ${active_port} on ${VPN_CT_NAME} container"
             fi
-            sleep 3
             echo "$(timestamp) | Port Changed to: $(findconfiguredport ${qbt_sid})"
         else
             echo "$(timestamp) | Port Change failed."
@@ -66,6 +75,7 @@ get_portmap() {
     return $res
 }
 
+pre_reqs() {
 while read var; do
     [ -z "${!var}" ] && { echo "$(timestamp) | ${var} is empty or not set."; exit 1; }
 done << EOF
@@ -82,6 +92,22 @@ EOF
 
 [ ! -S /var/run/docker.sock ] && { echo "$(timestamp) | Docker socket doesn't exist or is inaccessible"; exit 2; }
 
+return 0
+}
+
+load_vals(){
+    public_ip=$(getpublicip)
+    qbt_sid=$(qbt_login)
+    configured_port=$(findconfiguredport ${qbt_sid})
+    active_port=''
+}
+
+if pre_reqs; then load_vals; fi
+
+[ -z ${public_ip} ] && { echo "$(timestamp) | Unable to grab VPN Public IP. Please check configuration"; exit 3; }
+[ -z ${configured_port} ] && { echo "$(timestamp) | qBittorrent configured port value is empty(?). Please check configuration"; exit 4; }
+[ -z ${qbt_sid} ] && { echo "$(timestamp) | Unable to grab qBittorrent SessionID. Please check configuration"; exit 5; }
+
 while true;
 do
     if get_portmap; then

From ca1bcb994c2b01275463a72cf6fa7f326ae0fdc3 Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Mon, 20 Mar 2023 02:23:34 +0000
Subject: [PATCH 04/11] update: Dockerfile - remove unneeded ''s

---
 Dockerfile | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index fa02f47..018f1c1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@ FROM ubuntu:jammy
 LABEL org.opencontainers.image.source="https://github.com/soxfor/qbittorrent-natmap"
 LABEL org.opencontainers.image.base.name="ubuntu:jammy"
 LABEL description="Map port via NAT-PMP and update qBittorrent configuration"
-LABEL version="1.0.2"
+LABEL version="1.0.3"
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -24,15 +24,15 @@ RUN apt install --no-install-suggests --no-install-recommends -y natpmpc curl bc
 RUN rm -rf /var/lib/apt/lists/* /var/cache/apt/*
 RUN apt clean
 
-ENV QBITTORRENT_SERVER=''
-ENV QBITTORRENT_PORT='8080'
-ENV QBITTORRENT_USER='admin'
-ENV QBITTORRENT_PASS='adminadmin'
-ENV VPN_GATEWAY=''
-ENV VPN_CT_NAME='gluetun'
-ENV VPN_IF_NAME='tun0'
-ENV CHECK_INTERVAL='300'
-ENV NAT_LEASE_LIFETIME='300'
+ENV QBITTORRENT_SERVER=
+ENV QBITTORRENT_PORT=8080
+ENV QBITTORRENT_USER=admin
+ENV QBITTORRENT_PASS=adminadmin
+ENV VPN_GATEWAY=
+ENV VPN_CT_NAME=gluetun
+ENV VPN_IF_NAME=tun0
+ENV CHECK_INTERVAL=300
+ENV NAT_LEASE_LIFETIME=300
 
 COPY --from=docker-cli /usr/bin/docker /usr/bin/docker
 COPY data/start.sh /start.sh

From 74badb1d1edd7346d3cbb0fd0dcd97e6a290b0c1 Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Mon, 20 Mar 2023 02:25:21 +0000
Subject: [PATCH 05/11] update: docker-compose.yml - move default info to the
 line below; add depends_on param

---
 docker-compose.yml | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 0209b8a..d2c9049 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,12 +8,24 @@ services:
     environment:
       - TZ=Etc/UTC
       - QBITTORRENT_SERVER=ip.a.dd.r
-      # - QBITTORRENT_PORT=   # Defaults to 8080
-      # - QBITTORRENT_USER=   # Defaults to admin
-      # - QBITTORRENT_PASS=   # Defaults to adminadmin
-      # - VPN_CT_NAME=        # Defaults to gluetun
+      # - QBITTORRENT_PORT=   
+      # Defaults to 8080
+      # - QBITTORRENT_USER=   
+      # Defaults to admin
+      # - QBITTORRENT_PASS=   
+      # Defaults to adminadmin
+      # - VPN_CT_NAME=        
+      # Defaults to gluetun
       - VPN_GATEWAY=ip.a.dd.r
-      # - VPN_IF_NAME=        # Defaults to tun0
-      # - CHECK_INTERVAL=     # Defaults to 300sec
-      # - NAT_LEASE_LIFETIME= # Defaults to 300sec
+      # - VPN_IF_NAME=        
+      # Defaults to tun0
+      # - CHECK_INTERVAL=     
+      # Defaults to 300sec
+      # - NAT_LEASE_LIFETIME= 
+      # Defaults to 300sec
+    depends_on:
+      # VPN Container Name
+      - gluetun
+      # qBittorrent Container Name
+      - qbittorrent
     network_mode: "container:gluetun" # Specify the VPN container name here

From f4c79937c4d1d2a79d77fc87dd3f899c91d99efe Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Wed, 22 Mar 2023 01:02:12 +0000
Subject: [PATCH 06/11] update: docker-compose.yml - reference other
 network_mode possibility

---
 docker-compose.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index d2c9049..eb8f699 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -29,3 +29,5 @@ services:
       # qBittorrent Container Name
       - qbittorrent
     network_mode: "container:gluetun" # Specify the VPN container name here
+    # or
+    # network_mode: "service:gluetun" # if defined on the same docker-compose file

From 72fbf1bdbdd7b7e16d9f8a3362cd5560d6851abd Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Wed, 22 Mar 2023 01:02:31 +0000
Subject: [PATCH 07/11] update: README.md - improve details and instructions

---
 README.md | 65 ++++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 50 insertions(+), 15 deletions(-)

diff --git a/README.md b/README.md
index 221817c..abbfa87 100644
--- a/README.md
+++ b/README.md
@@ -1,21 +1,56 @@
-# qbittorrent-natmap
+# qBittorrent-NatMap 
 
-Docker container to maintain and update the NAT-PMP/UPnP forwarded port to qBittorrent.
+The objective of this container is to run a script that requests a port forward (via NAT-PMP) from the VPN provider and upon success changes the listening port of the qBittorrent client when running in Docker
 
-Tested with Gluetun using ProtonVPN (Wireguard) and qBittorrent.
+This solution is currently in use and tested with [Gluetun](https://github.com/qdm12/gluetun) and [qBittorrent](https://github.com/linuxserver/docker-qbittorrent) from Linuxserver.io and with VPN fron ProtonVPN using Wireguard.
 
-This solution can probably need a few tweaks and error handling, also some work in opening only the needed port on the VPN container.
+## What made me do this?
 
-In the repo a sample docker-compose.yml can be found.
+The need to improve the seeding/upload performance and not finding any work done for this scenario (qBittorrent using docker'ized VPN), but finding [this post on reddit](https://old.reddit.com/r/ProtonVPN/comments/10owypt/successful_port_forward_on_debian_wdietpi_using/) by u/TennesseeTater for Deluge made me try and do something similar. His post is also referenced in the [ProtonVPN Guide][1].
 
-The following variables can be set:
+## Why not modify the Gluetun image and include natpmpc there?
 
-- QBITTORRENT_SERVER    (Default: <not set>)*
-- QBITTORRENT_PORT      (Default: 8080)
-- QBITTORRENT_USER      (Default: admin)
-- QBITTORRENT_PASS      (Default: adminadmin)
-- VPN_CT_NAME           (Default: gluetun)
-- VPN_IF_NAME           (Default: tun0)
-- VPN_GATEWAY*          (Default: <not set>)*
-- CHECK_INTERVAL        (Default: 300s)
-- NAT_LEASE_TIME        (Default: 300s)
+Well, as far as I could find, Alpine Linux doesn't have natively the binary for **natpmpc**, the NAT-PMP client used to request the *port forward* as per the instructions for [manual mapping][1] on ProtonVPN. Gluetun is using alpine as it's base image.
+
+On AlpineLinux package info: [natpmpc binary not found][2] and [here][3] a request still in open state.
+
+If I had the binary needed on the Gluetun container a script running on the host system instead of the container would probably suffice, allowing the following action: doing "docker exec <container> natpmpc <args>"
+
+## What does the script do/modify?
+
+So far:
+
+* Evaluates the required variables for execution (for now, if they're set) and if **docker.sock** was mapped from the host into the container
+* If the above succeeds:
+    * Get the VPN public IP
+    * Grab the SessionID cookie from qBittorrent
+    * Grab the current listen port from qBittorrent
+* After the configured checks pass, a function to request and verify the port mapping starts
+    * Using *natpmpc* a port mapping request is made to the address defined in `VPN_GATEWAY` for udp and tcp
+    * Comparison is made between the current configured port in qBittorrent and the currently active mapped port from the VPN
+    * If a condition of different port is found:
+        * The new port is configured in qBittorrent, along with that it's also disabled the random port setting and UPnP mapping from the torrent client
+        * A couple of commands are executed to add/remove iptables rules regarding the previous active and new active mapped port on the VPN container
+
+These actions are performed continuously (in a loop, every 5 minutes (default, can be lowered/increased)), most likely an option to set a failure count will be added in the future.
+
+## Configurable variables:
+
+* QBITTORRENT_SERVER (Defaults to empty, **needs to be set**)
+    * If setting here an address not related to the `VPN_IF_NAME` (default: tun0) a few users have [reported](https://old.reddit.com/r/ProtonVPN/comments/11ubgvi/port_forward_with_qbittorrent_and_protonvpn_on/jcxirts/) needing to set `FIREWALL_OUTBOUND_SUBNETS` for the Gluetun/VPN container
+    * For ProtonVPN using Wireguard and qBittorrent container using `VPN_CT_NAME` as network_mode this would be set to **10.2.0.2**
+* QBITTORRENT_PORT (Defaults to **8080**)
+* QBITTORRENT_USER (Defaults to **admin**)
+* QBITTORRENT_PASS (Defaults to **adminadmin**)
+* VPN_GATEWAY (Defaults to empty, **needs to be set**)
+    * The value for this variable will be the `VPN_IF_NAME` (default: tun0) gateway address, not the `VPN_ENDPOINT_IP` from the Gluetun/VPN Container when using Wireguard, [more info here](https://github.com/qdm12/gluetun/wiki/Custom-provider#wireguard-only).
+    * For ProtonVPN using Wireguard this would be set to **10.2.0.1**
+* VPN_CT_NAME (Defaults to **gluetun**)
+* VPN_IF_NAME (Defaults to **tun0**)
+* CHECK_INTERVAL (Defaults to **300s**)
+* NAT_LEASE_LIFETIME (Defaults to **300s**)
+    * Ideally both `CHECK_INTERVAL` and `NAT_LEASE_LIFETIME` should be set equal or the check interval lower than the lease lifetime, but never above.
+
+[1]: https://protonvpn.com/support/port-forwarding-manual-setup/
+[2]: https://pkgs.alpinelinux.org/contents?file=natpmpc&path=&name=&branch=edge
+[3]: https://gitlab.alpinelinux.org/alpine/awall/-/issues/2220

From 7d4b211884f5fa3da44400685c813ac9362812bf Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Wed, 22 Mar 2023 01:04:36 +0000
Subject: [PATCH 08/11] update: Dockerfile - bump patch level

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 018f1c1..99d8f52 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@ FROM ubuntu:jammy
 LABEL org.opencontainers.image.source="https://github.com/soxfor/qbittorrent-natmap"
 LABEL org.opencontainers.image.base.name="ubuntu:jammy"
 LABEL description="Map port via NAT-PMP and update qBittorrent configuration"
-LABEL version="1.0.3"
+LABEL version="1.0.4"
 
 ARG DEBIAN_FRONTEND=noninteractive
 

From e8bdd43dbf388c55ad16545d69cde5d35b07e93a Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Wed, 22 Mar 2023 01:51:27 +0000
Subject: [PATCH 09/11] update: check if qBittorrent is reachable, and quit if
 not

---
 Dockerfile    |  2 +-
 data/start.sh | 14 ++++++++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 99d8f52..c8ba2ad 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,7 +20,7 @@ LABEL version="1.0.4"
 ARG DEBIAN_FRONTEND=noninteractive
 
 RUN apt update
-RUN apt install --no-install-suggests --no-install-recommends -y natpmpc curl bc
+RUN apt install --no-install-suggests --no-install-recommends -y natpmpc curl bc ncat
 RUN rm -rf /var/lib/apt/lists/* /var/cache/apt/*
 RUN apt clean
 
diff --git a/data/start.sh b/data/start.sh
index bf72f93..4a2d403 100755
--- a/data/start.sh
+++ b/data/start.sh
@@ -34,6 +34,11 @@ qbt_checksid(){
     fi
 }
 
+qbt_isreachable(){
+    (sleep 3; echo "^C") | ncat -4 --wait 5 ${QBITTORRENT_SERVER} ${QBITTORRENT_PORT} 2>/dev/null &>/dev/null
+    return $?
+}
+
 get_portmap() {
     res=0
     public_ip=$(getpublicip)
@@ -97,8 +102,13 @@ return 0
 
 load_vals(){
     public_ip=$(getpublicip)
-    qbt_sid=$(qbt_login)
-    configured_port=$(findconfiguredport ${qbt_sid})
+    if qbt_isreachable; then
+        qbt_sid=$(qbt_login)
+        configured_port=$(findconfiguredport ${qbt_sid})
+    else
+        echo "$(timestamp) | Unable to reach qBittorrent at ${QBITTORRENT_SERVER}:${QBITTORRENT_PORT}"
+        exit 6
+    fi
     active_port=''
 }
 

From 00450e4d3a4892c92226b8a9e5be6cf2bc75b46a Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Thu, 23 Mar 2023 22:54:20 +0000
Subject: [PATCH 10/11] Exit if qBittorrent is unreable and validate iptables
 rules before add/del update: Dockerfile - substitute ncat with netcat-openbsd
 fix: data/start.sh - use correct command to validate connection to
 qBittorrent fix: data/start.sh - always check if port is open on firewall
 (fixes issue when starting and VPN mapped port is already equal to
 configured, fw check was skipped)

---
 Dockerfile    |  2 +-
 data/start.sh | 34 ++++++++++++++++++++++++----------
 2 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index c8ba2ad..64ec6ca 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,7 +20,7 @@ LABEL version="1.0.4"
 ARG DEBIAN_FRONTEND=noninteractive
 
 RUN apt update
-RUN apt install --no-install-suggests --no-install-recommends -y natpmpc curl bc ncat
+RUN apt install --no-install-suggests --no-install-recommends -y natpmpc curl bc netcat-openbsd
 RUN rm -rf /var/lib/apt/lists/* /var/cache/apt/*
 RUN apt clean
 
diff --git a/data/start.sh b/data/start.sh
index 4a2d403..f74bd81 100755
--- a/data/start.sh
+++ b/data/start.sh
@@ -35,8 +35,24 @@ qbt_checksid(){
 }
 
 qbt_isreachable(){
-    (sleep 3; echo "^C") | ncat -4 --wait 5 ${QBITTORRENT_SERVER} ${QBITTORRENT_PORT} 2>/dev/null &>/dev/null
-    return $?
+    nc -4 -vw 5 ${QBITTORRENT_SERVER} ${QBITTORRENT_PORT} 2>&1 &>/dev/null
+}
+
+fw_delrule(){
+    if (docker exec ${VPN_CT_NAME} /sbin/iptables -L INPUT -n | grep -qP "^ACCEPT.*${configured_port}.*"); then
+        docker exec ${VPN_CT_NAME} /sbin/iptables -D INPUT -i ${VPN_IF_NAME} -p tcp --dport ${configured_port} -j ACCEPT
+        docker exec ${VPN_CT_NAME} /sbin/iptables -D INPUT -i ${VPN_IF_NAME} -p udp --dport ${configured_port} -j ACCEPT
+    fi
+}
+
+fw_addrule(){
+    if ! (docker exec ${VPN_CT_NAME} /sbin/iptables -L INPUT -n | grep -qP "^ACCEPT.*${active_port}.*"); then
+        docker exec ${VPN_CT_NAME} /sbin/iptables -A INPUT -i ${VPN_IF_NAME} -p tcp --dport ${active_port} -j ACCEPT
+        docker exec ${VPN_CT_NAME} /sbin/iptables -A INPUT -i ${VPN_IF_NAME} -p udp --dport ${active_port} -j ACCEPT
+        return 0
+    else
+        return 1
+    fi
 }
 
 get_portmap() {
@@ -59,14 +75,8 @@ get_portmap() {
 
     if [ ${configured_port} != ${active_port} ]; then
         if qbt_changeport ${qbt_sid} ${active_port}; then
-            docker exec ${VPN_CT_NAME} /sbin/iptables -A INPUT -i ${VPN_IF_NAME} -p tcp --dport ${active_port} -j ACCEPT
-            docker exec ${VPN_CT_NAME} /sbin/iptables -A INPUT -i ${VPN_IF_NAME} -p udp --dport ${active_port} -j ACCEPT
-            if docker exec ${VPN_CT_NAME} /sbin/iptables -L INPUT -n | grep -qP "^ACCEPT.*${configured_port}.*"; then
-                docker exec ${VPN_CT_NAME} /sbin/iptables -D INPUT -i ${VPN_IF_NAME} -p tcp --dport ${configured_port} -j ACCEPT
-                docker exec ${VPN_CT_NAME} /sbin/iptables -D INPUT -i ${VPN_IF_NAME} -p udp --dport ${configured_port} -j ACCEPT
-            fi
-            if docker exec ${VPN_CT_NAME} /sbin/iptables -L INPUT -n | grep -qP "^ACCEPT.*${active_port}.*"; then
-                echo "$(timestamp) | IPTables rule added for port ${active_port} on ${VPN_CT_NAME} container"
+            if fw_delrule; then
+                echo "$(timestamp) | IPTables rule deleted for port ${configured_port} on ${VPN_CT_NAME} container"
             fi
             echo "$(timestamp) | Port Changed to: $(findconfiguredport ${qbt_sid})"
         else
@@ -77,6 +87,10 @@ get_portmap() {
         echo "$(timestamp) | Port OK (Act: ${active_port} Cfg: ${configured_port})"
     fi
 
+    if fw_addrule; then
+        echo "$(timestamp) | IPTables rule added for port ${active_port} on ${VPN_CT_NAME} container"
+    fi
+
     return $res
 }
 

From db5f6f70e8ecf61cf36f72d747b3bb5e60e366fe Mon Sep 17 00:00:00 2001
From: soxfor <7237915+soxfor@users.noreply.github.com>
Date: Thu, 23 Mar 2023 22:58:09 +0000
Subject: [PATCH 11/11] update: Dockerfile - bump patch level

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 64ec6ca..a83e826 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@ FROM ubuntu:jammy
 LABEL org.opencontainers.image.source="https://github.com/soxfor/qbittorrent-natmap"
 LABEL org.opencontainers.image.base.name="ubuntu:jammy"
 LABEL description="Map port via NAT-PMP and update qBittorrent configuration"
-LABEL version="1.0.4"
+LABEL version="1.0.5"
 
 ARG DEBIAN_FRONTEND=noninteractive