Torrent privacy defaults: what the box does before you touch a setting
Every torrent client ships with defaults chosen for a laptop behind a home router. A hosted box is a different animal, and the wrong default there is at best noise and at worst a private-tracker warning. This page covers what Cresdock's torrent apps do about privacy out of the box, what one switch changes everywhere at once, and — plainly — what a default cannot promise.
1.Defaults, not padlocks
The rule behind everything on this page: Cresdock chooses a sensible starting point, and then respects your choices. A default is seeded when an app installs; it is not re-imposed behind your back. Change a setting inside your own client and it stays changed — the panel doesn't keep overruling you, because your box is yours.
That's a deliberately different promise from the resource limits, which do hold no matter what an app tries. Limits protect other people on the machine; privacy settings are your own affair.
2.No port-forwarding chatter
UPnP and NAT-PMP exist so a client behind a home router can ask it to open a port. On a hosted box there is no router to ask — the port is already published — so the vendors' default (on) just broadcasts discovery packets onto whatever network the client can see and retries forever. One real tenant's log showed a client flapping "Starting → Not forwarded" every eight seconds.
Cresdock seeds every torrent client with router port-forwarding off. Nothing is lost — connectivity comes from the published port — and the client stops announcing itself to a network that was never going to answer.
3.One switch for trackerless peer discovery
DHT, PEX and local peer discovery find peers without a tracker — the point of them on the open internet, and exactly what most private trackers forbid, because they can announce what you're sharing outside the tracker's own swarm.
Instead of hunting that setting down per client (it has a different name in every one), the operator flips a single box-wide switch and every torrent client on the box is seeded consistently: qBittorrent, Transmission, Deluge alike. New installs pick the policy up automatically; what a tracker asks of you gets answered once, for the whole box.
4.Route the apps you choose through a VPN
Each user can route chosen apps through their own VPN connection. Your torrent client's traffic leaves through the VPN; your media server, file apps and everything else stay direct, fast and reachable. If the VPN drops, routed apps lose connectivity rather than quietly leaking onto the plain connection.
Two things worth knowing before you turn it on. First, apps behind the VPN still connect to their siblings — qBittorrent behind the VPN with Sonarr outside is a supported, automatically wired setup. Second, VPN traffic still counts toward your monthly traffic allowance: metering happens where the traffic actually leaves, so routing through a VPN neither hides usage nor doubles it — and the panel tells you this the first time it meters some, rather than surprising you at the end of the month.
5.Your swarm is nobody else's business
On a shared box, privacy has a second axis: the other people on the machine. Every Cresdock user's apps live on their own private network — one user's containers cannot reach another's, and nothing about your torrent activity is visible to a neighbour's workspace. Speed and traffic caps are enforced in the kernel per user, so a busy swarm next door doesn't become your problem either.
The operator also gets the other half of that picture. The Security page shows what kind of traffic each workspace moves and which workspaces have torrents announcing to public trackers (public tracker detection) — so a private-tracker-only box can be kept that way by looking, not by guessing, and a warning names the workspace rather than the whole server.
6.The honest half
- None of this is anonymity. Defaults cut needless chatter; a VPN changes where your traffic exits. Neither makes torrenting anonymous, and no product honestly can. What you download is your responsibility, and this page is not legal advice.
- Defaults reach new installs. The seeded settings land when an app installs. A client you installed before a policy changed keeps its existing config until you reset it — deliberately, because overwriting a working client's config is worse than an old default.
- ruTorrent is the exception. Its image manages its own configuration, so the seeded defaults above don't cover it — check its settings yourself if you use it on a private tracker.
- Outbound mail relaying is blocked by design. Traffic from apps and VPN clients cannot send on port 25, so the server's address stays off spam blocklists. Normal email apps are unaffected — they submit on ports 587/465.
- The VPN is your subscription. Cresdock routes traffic through a VPN you bring (WireGuard or OpenVPN credentials from your provider); it doesn't include one.
7.Common questions
Should DHT and PEX be off for private trackers?
Most private trackers require it. On Cresdock that's one box-wide switch, seeded into every torrent client consistently, instead of a per-client settings hunt.
Can I route just my torrent client through a VPN?
Yes — per app, per user. The torrent client goes through the VPN, everything else stays direct, and a dropped VPN means no connectivity for routed apps rather than a leak. Routed traffic still counts toward your monthly allowance, and the panel tells you so the first time it meters some.
Do these defaults make torrenting anonymous?
No. They make the starting point sensible and the switches findable. Anonymity is a different, larger claim that no seedbox honestly makes.