VPN struggles. Radarr and sonarr unable to connect to sabnzbd when routing through vpn

January 1Jan 1

Using PIA, I've followed this video to a T https://www.youtube.com/watch?v=yBF9c0u2wCE and for the life of me I can't get Radarr or Sonarr to connect to Sabnzbd while Sab is running through the vpn. This seems like the easier option than running everything through one container other than the problem im having right now.

Quote

January 1Jan 1

Community Expert

I don't think anyone can help without more information. Diagnostics attached could help with that

Quote

January 1Jan 1

Author

tower-diagnostics-20260101-1420.zip

true

Quote

January 2Jan 2

Community Expert

for the ars stack, I prefer to use the docker compose method...

as you will need to setup the VPN network and data to use the PIA vpn in conjunction with the docker network to maintain communication...

Review rule of thumb for docker networks
https://bmartino1.weebly.com/guide-dockernetworks.html

General Guide...

Create your new Unraid folder layout to match for compose

Run once on Unraid (terminal):

mkdir -p \
  /mnt/user/appdata/{pia,prowlarr,sonarr,radarr,sabnzbd,transmission} \
  /mnt/user/ARS/media/{tv,movies} \
  /mnt/user/ARS/torrents/{incomplete,completed,watch}

I have to assume a default pathing to adjust mounts accordingly...

New `docker-compose.yml for example setup`

Notes:

VPN container is named pia.

SAB + Transmission share the VPN network namespace, so they’re reached at pia’s IP (either 172.45.0.10 on the docker bridge, or 192.168.1.42 on LAN via br0).

By setting up a docker bridge for isolation for arrs network and br0 external LAN network. (I recommend using macvlan...) this helps multi network setups where things that acquire content use the VPN IP.

I recommend compose to help fix unraid network docker weirdness to communicate with vpn and multiple docker network stacks.

networks:
  arrs:
    driver: bridge
    ipam:
      config:
        - subnet: 172.45.0.0/24
  br0:
    external: true

services:
  ###########################################################################
  # PIA WireGuard Gateway (the “VPN container”)
  # SABnzbd and Transmission live inside THIS network namespace
  ###########################################################################
  pia:
    image: thrnz/docker-wireguard-pia:latest
    container_name: pia
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
#    env_file:
#      - /mnt/user/appdata/.env
    environment:
      - PIA_USER=${PIA_USER}
      - PIA_PASS=${PIA_PASS}
      - PIA_REGION=${PIA_REGION}
      - LOCAL_NETWORK=172.45.0.0/24,192.168.1.0/24
      - VPN_DNS=1.1.1.1,9.9.9.9
      - PORT_FORWARDING=1
      - RECONNECT=1
      - ACTIVE_HEALTHCHECKS=1
    volumes:
      - /mnt/user/appdata/pia:/config
      - /lib/modules:/lib/modules:ro
    networks:
      arrs:
        ipv4_address: 172.45.0.10
        aliases:
          # These names are what Radarr/Sonarr should use as download clients
          - sabnzbd
          - transmission
      br0:
        # Change me – LAN IP used to access SAB + Transmission WebUIs also update lables for webUI...
        ipv4_address: 192.168.1.42
    healthcheck:
      test: ["CMD-SHELL", "ip link show wg0 >/dev/null 2>&1"]
      interval: 10s
      timeout: 3s
      retries: 30
    restart: unless-stopped
    labels:
      folder.view: "ars"
      net.unraid.docker.managed: "composeman"
      net.unraid.docker.webui: "https://10.0.0.1"   # PIA control page (non-critical)
      net.unraid.docker.icon: "https://raw.githubusercontent.com/thrnz/docker-wireguard-pia/master/assets/pia.png"
      com.centurylinklabs.watchtower.enable: "true"

  ###########################################################################
  # SABnzbd (forced through VPN)
  # IMPORTANT: WebUI is accessed via the PIA container IP
  ###########################################################################
  sabnzbd:
    image: lscr.io/linuxserver/sabnzbd:latest
    container_name: sabnzbd
#    env_file:
#      - /mnt/user/appdata/.env
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - /mnt/user/appdata/sabnzbd:/config
      - /mnt/user/ARS/torrents/incomplete:/incomplete-downloads
      - /mnt/user/ARS/torrents/completed:/downloads
      - /mnt/user/ARS:/data
    network_mode: "service:pia"
    depends_on:
      pia:
        condition: service_healthy
    restart: unless-stopped
    labels:
      folder.view: "ars"
      net.unraid.docker.managed: "composeman"
      # WebUI runs on PIA IP :8080
      net.unraid.docker.webui: "http://192.168.1.42:8080"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sabnzbd-logo.png"
      com.centurylinklabs.watchtower.enable: "true"

  ###########################################################################
  # Transmission (forced through VPN)
  # IMPORTANT: WebUI is accessed via the PIA container IP
  ###########################################################################
  transmission:
    image: lscr.io/linuxserver/transmission:latest
    container_name: transmission
#    env_file:
#      - /mnt/user/appdata/.env
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - /mnt/user/appdata/transmission:/config
      - /mnt/user/ARS/torrents:/downloads
      - /mnt/user/ARS/torrents:/data/torrents
      - /mnt/user/ARS/torrents/watch:/watch
    network_mode: "service:pia"
    depends_on:
      pia:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9091"]
      interval: 30s
      timeout: 5s
      retries: 10
    restart: unless-stopped
    labels:
      folder.view: "ars"
      net.unraid.docker.managed: "composeman"
      # WebUI runs on PIA IP :9091
      net.unraid.docker.webui: "http://192.168.1.42:9091"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/transmission-logo.png"
      com.centurylinklabs.watchtower.enable: "true"

  ###########################################################################
  # Indexers / Orchestrators (NOT through VPN)
  ###########################################################################
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    container_name: prowlarr
#    env_file:
#      - /mnt/user/appdata/.env
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - /mnt/user/appdata/prowlarr:/config
      - /mnt/user/ARS:/data
      - /mnt/user/ARS/torrents/completed:/downloads
    ports:
      - "9697:9696"
    networks:
      arrs:
        ipv4_address: 172.45.0.3
    restart: unless-stopped
    labels:
      folder.view: "ars"
      net.unraid.docker.managed: "composeman"
      net.unraid.docker.webui: "http://[IP]:9696/system/status"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/prowlarr-logo.png"
      com.centurylinklabs.watchtower.enable: "true"

  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    container_name: sonarr
#    env_file:
#      - /mnt/user/appdata/.env
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - /mnt/user/appdata/sonarr:/config
      - /mnt/user/ARS/torrents/completed:/downloads
      - /mnt/user/ARS/media/tv:/tv
      - /mnt/user/ARS:/data
    ports:
      - "8989:8989"
    networks:
      arrs:
        ipv4_address: 172.45.0.4
    depends_on:
      - prowlarr
      - pia
    restart: unless-stopped
    labels:
      folder.view: "ars"
      net.unraid.docker.managed: "composeman"
      net.unraid.docker.webui: "http://[IP]:8989/system/status"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/sonarr-logo.png"
      com.centurylinklabs.watchtower.enable: "true"

  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
 #   env_file:
 #     - /mnt/user/appdata/.env
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - /mnt/user/appdata/radarr:/config
      - /mnt/user/ARS/torrents/completed:/downloads
      - /mnt/user/ARS/media/movies:/movies
      - /mnt/user/ARS:/data
    ports:
      - "7878:7878"
    networks:
      arrs:
        ipv4_address: 172.45.0.5
    depends_on:
      - prowlarr
      - pia
    restart: unless-stopped
    labels:
      folder.view: "ars"
      net.unraid.docker.managed: "composeman"
      net.unraid.docker.webui: "http://[IP]:7878/system/status"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/radarr-logo.png"
      com.centurylinklabs.watchtower.enable: "true"

Your `.env` file (example with compose above)

Usually generated in a folder specified at creation....: example /mnt/user/appdata/.env

PUID=99
PGID=100
TZ=America/Chicago

# PIA (required)
PIA_USER=your_pia_username
PIA_PASS=your_pia_password
PIA_REGION=us_chicago

(Region strings depend on the image/version; the thrnz container docs are the authority. GitHub)

The actual fix: how Radarr/Sonarr talk to SAB/Transmission

Because SAB and Transmission are inside the pia network namespace, you must point Radarr/Sonarr to the pia container:

Use one of these (pick ONE style)

A) Docker-bridge addressing (recommended for stability):

SAB host: 172.45.0.10 port 8080
Transmission host: 172.45.0.10 port 9091

B) LAN addressing (if you prefer):

SAB host: 192.168.1.42 port 8080
Transmission host: 192.168.1.42 port 9091

C) Alias style (works because we added aliases on pia):

SAB host: sabnzbd port 8080
Transmission host: transmission port 9091

SABnzbd “Host whitelist” gotcha

If SAB refuses connections even though the port is reachable, add allowed hostnames/IPs in:
SABnzbd → Config → Special → host_whitelist (or equivalent in your version).

Example entries:

sonarr,radarr,prowlarr,pia,sabnzbd,172.45.0.0/24,192.168.1.0/24

This specific “SAB whitelist blocks the *arrs” failure mode is common. example found: https://forum.yams.media/viewtopic.php?t=187

Edited January 2Jan 2 by bmartino1
Data - typo

Quote

VPN struggles. Radarr and sonarr unable to connect to sabnzbd when routing through vpn

Featured Replies

Create your new Unraid folder layout to match for compose

New `docker-compose.yml for example setup`

Your `.env` file (example with compose above)

The actual fix: how Radarr/Sonarr talk to SAB/Transmission

Use one of these (pick ONE style)

SABnzbd “Host whitelist” gotcha

Join the conversation

Account

Navigation

Search

Configure browser push notifications

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)

Create your new Unraid folder layout to match for compose

New docker-compose.yml for example setup

Your .env file (example with compose above)

The actual fix: how Radarr/Sonarr talk to SAB/Transmission

Use one of these (pick ONE style)

SABnzbd “Host whitelist” gotcha

Join the conversation

Configure browser push notifications

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)

New `docker-compose.yml for example setup`

Your `.env` file (example with compose above)