NordLynx uses the standard WireGuard protocol. You can obtain your WireGuard private key and server endpoint using the NordVPN access token or via the CLI:

# Generate / check token or use Wireguard config generator
# NordVPN private key can be retrieved from NordAccount -> Security -> Manual Setup
# Example WireGuard interface config (/etc/wireguard/wg-nord.conf):
[Interface]
PrivateKey = <YOUR_NORD_PRIVATE_KEY>
Address = 10.5.0.2/32
DNS = 103.86.96.100, 103.86.99.100

[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = us8291.nordvpn.com:51820
AllowedIPs = 0.0.0.0/0

To allow your LAN devices to access the qBittorrent WebUI (port 8080) while keeping all torrent traffic encapsulated inside the VPN, create a pair of virtual ethernet interfaces:

#!/bin/bash
# /usr/local/bin/setup-vpn-netns.sh
set -e

# 1. Create namespace
ip netns add ns-vpn || true
ip netns exec ns-vpn ip link set dev lo up

# 2. Setup veth pair for WebUI access (10.200.1.0/24)
ip link add veth-host type veth peer name veth-vpn
ip link set veth-vpn netns ns-vpn

ip addr add 10.200.1.1/24 dev veth-host
ip link set dev veth-host up

ip netns exec ns-vpn ip addr add 10.200.1.2/24 dev veth-vpn
ip netns exec ns-vpn ip link set dev veth-vpn up

# 3. Bring up WireGuard inside ns-vpn
ip link add dev wg-nord type wireguard
ip link set wg-nord netns ns-vpn
ip netns exec ns-vpn wg setconf wg-nord /etc/wireguard/wg-nord.conf
ip netns exec ns-vpn ip addr add 10.5.0.2/32 dev wg-nord
ip netns exec ns-vpn ip link set wg-nord up
ip netns exec ns-vpn ip route add default dev wg-nord

# 4. Route WebUI port 8080 from Host LAN to Namespace
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 10.200.1.2:8080
iptables -t nat -A POSTROUTING -p tcp -d 10.200.1.2 --dport 8080 -j MASQUERADE

Systemd provides native support for network namespaces via NetworkNamespacePath. Modify /etc/systemd/system/qbittorrent-nox@mason.service.d/override.conf:

[Unit]
Requires=vpn-netns.service
After=vpn-netns.service

[Service]
NetworkNamespacePath=/run/netns/ns-vpn
# Alternatively: ExecStart=/usr/bin/ip netns exec ns-vpn /usr/bin/qbittorrent-nox

Instruct the NordVPN daemon to connect and establish the tunnel without altering the host's primary routing table:

# 1. Turn off default route management in NordVPN
nordvpn set routing off

# 2. Connect to preferred server
nordvpn connect

# 3. Verify: Host default gateway is UNTOUCHED
ip route show default
# Output remains: default via 192.168.1.254 dev enp0s31f6

Because global routing is disabled, the Linux kernel needs an explicit routing table for traffic bound to nordlynx.

# 1. Register a dedicated routing table
echo "200 vpn_traffic" | sudo tee -a /etc/iproute2/rt_tables

# 2. Add default route to table 200 via nordlynx
sudo ip route add default dev nordlynx table vpn_traffic

# 3. Direct all packets with source IP of nordlynx to table 200
NORD_IP=$(ip -4 addr show dev nordlynx | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
sudo ip rule add from $NORD_IP table vpn_traffic priority 200

# 4. Flush route cache
sudo ip route flush cache

In ~/.config/qBittorrent/qBittorrent.conf, verify that qBittorrent binds strictly to nordlynx for peer connections while keeping WebUI listening on all IPs:

[BitTorrent]
Session\Interface=nordlynx
Session\InterfaceName=nordlynx
Session\Port=6881

[Preferences]
WebUI\Address=*
WebUI\Port=8080

Whenever NordVPN reconnects, the assigned internal IP of nordlynx may change. A systemd dispatcher or small daemon monitors nordlynx state and updates the ip rule dynamically:

# /etc/systemd/system/nordvpn-pbr.service
[Unit]
Description=NordVPN Policy Routing Dispatcher
After=nordvpnd.service
BindsTo=nordvpnd.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/bin/update-nordvpn-pbr.sh

[Install]
WantedBy=multi-user.target