Documented 2026-07-19 after a “why does whatismyipaddress show my real Cox IP while nordvpn says Connected?!” investigation. Answer: nothing is broken — the box runs a deliberate split-tunnel, and every confusing symptom is that design working.
Goal: privacy for torrenting. Everything else is convenience.
| Layer | Config | Effect |
|---|---|---|
| Tunnel | NordLynx (WireGuard), normally a US server | default route for all traffic → VPN |
| Allowlist (~80 subnets) | Cloudflare’s entire published CIDR set (104.16/13, 172.64/13, 162.158/15, 198.41.128/17, …) + pinned /32 CloudFront & Akamai edges | CDN-fronted websites bypass the tunnel (real Cox IP). Added to make Credit Karma load / kill CDN captcha-hell. |
| qBittorrent | Session\Interface=nordlynx (bound to the VPN interface) |
Torrents are tunnel-or-nothing — if the VPN drops, torrents STOP; they can never leak out Cox. Stronger than a kill switch, scoped to exactly what needs it. |
| Kill Switch | disabled (deliberate) | On tunnel flaps, general traffic falls back to Cox so the trading/automation crons stay alive. Torrent privacy is covered by the interface binding instead. |
| Rotation cron | 0 */12 auto-change-vpn.sh: kill qbittorrent → nordvpn c united_states → restart qbittorrent |
fresh server + clean torrent session every 12h |
| DNS | Nord’s resolvers (103.86.96.100/99.100) via the tunnel; Nord intercepts ALL port-53 while connected (queries to any resolver IP get answered) | DNS never goes to Cox. Side effect: when the tunnel blips, DNS dies all at once → the 5:40 domain-monitor false alarm (now guarded — see the bwscomputerservice page). |
Net effect: torrents + non-CDN traffic exit via Nord; CDN-fronted browsing (a big slice of the web) and LAN traffic use the real Cox IP. This is “torrent privacy,” not “hide my IP from websites” privacy — a known, accepted tradeoff.
nordvpn settings → “Allowlisted subnets” is the source of truth. Each entry becomes an
ip rule … lookup main (bypass); rule ~32765 sends everything else (not fwmark 0xe1f1)
to table 205, whose only route is default dev nordlynx. See them: ip rule show and
ip route show table 205.
curl -s ifconfig.me → should be a Nord egress IP, and
nordvpn status → Connected. For torrents specifically: qBittorrent stalls to 0 peers
if the tunnel is down (binding proof).traceroute to any Cloudflare-fronted site (incl. bwscomputerservice.com) shows the
raw Cox path (10.0.0.1 → Cox → Cloudflare edge) — again by design.nordlynx interface’s 100.x address is Nord’s internal CGNAT, not a LAN device.nordvpn status “IP” (server inbound) and the observed egress IP can differ — both Nord.