Docs / Using Mediarium
VPN protection
Mediarium has a WireGuard VPN client built in, for torrent traffic. It runs inside the app, so the container needs no extra privileges: no NET_ADMIN and no /dev/net/tun.
Find it under Settings > Downloading > VPN and proxy. It's optional: nothing goes through a VPN until you add a connection and activate it. From then on, all torrent traffic goes through it while it's connected.
What goes through the VPN
- Torrent traffic (talking to peers, to HTTP trackers, to web seeds and fetching the details a magnet link points to), whenever a VPN is connected. UDP trackers (
udp://) cannot go through the tunnel, so they are not used while the VPN is on; HTTP trackers, the other peers and the swarm still work. - Nothing else. Searching your indexers, TMDB, subtitles, media servers and your Usenet provider all connect directly. Usenet downloads are encrypted between you and your provider, and do not show your address to other people the way a torrent swarm does. To send indexers or Usenet somewhere else too, use a proxy.
Add a connection
- Pick your provider in Add a VPN connection. The list is in alphabetical order, from AirVPN to Windscribe, with Your own WireGuard server and Not listed / any other provider at the end. Choosing a provider shows short steps for getting its WireGuard file, a link to the provider's own page, and a warning if that provider has something that trips people up. It also fills in the DNS servers for the few providers where every customer gets the same ones (Mullvad and Surfshark). It never touches your keys. Every provider ends up with the same fields, so if yours isn't on the list, pick Not listed and carry on from step 3. The provider list below says what each one needs.
- Get your WireGuard details from your provider, using the steps and link on the page. Mediarium never asks for your VPN account login. You copy the values from your provider's own page.
- The quickest way: paste your whole WireGuard
.conffile into Paste your .conf file, or press Or choose the file. Every field below is filled in from it, including the preshared key, DNS servers and allowed IPs. Only the first[Peer]is used. Or fill in the form by hand:
| Field | What to enter |
|---|---|
| Label | A name for you, for example "My VPN". |
| Endpoint | The server's address and port, like vpn.example.com:51820. A server name or an IP address both work. A name is looked up each time the connection starts, the way wg-quick does it, and the name itself is what's kept. |
| Private key | Your WireGuard private key (44 characters). |
| Peer public key | The server's public key (44 characters). |
| Preshared key | Optional. Only if your config has a PresharedKey line (Windscribe's do). Without it the tunnel never connects. |
| Local tunnel address | The address your provider gives you, like 10.2.0.2/32. Several can be separated by commas. |
| DNS servers | Optional. The DNS line of your config, like 10.2.0.1. |
| Allowed IPs | Optional. Leave empty to send everything through the tunnel (0.0.0.0/0, ::/0). |
- Press Add connection, then Activate on its row. The status at the top says Connected followed by the connection's label in brackets, once the VPN server has answered. Disconnect turns the tunnel off again.
You can store several connections; one is active at a time. Private and preshared keys are stored encrypted (with the key in secret.key) and are never shown again or written to the log.
Providers and where to get the file
This list is in alphabetical order and is not a recommendation: it only says where each provider keeps its WireGuard file and what to watch for. It was checked against the providers' own help pages in October 2026. Anything a provider's pages don't say is left out rather than guessed. Providers change their sites, so if a menu name has moved, the link on the page still gets you to the right place. "Forwarded ports" means a port the provider opens for incoming connections. Mediarium doesn't use one: it only connects out to other peers, and nothing listens through the tunnel. So you never need to turn it on.
| Provider | How to get the file | Good to know | Forwarded ports at the provider | Sources |
|---|---|---|---|---|
| AirVPN | Client Area, then Config Generator. Pick WireGuard and a server. | AirVPN makes the keys. Renewing your keys gives a new address, so download the file again. Up to 5 connections at once, and each device needs its own key. | Yes, up to 5 ports from 2048 up, set in the Client Area. | WireGuard FAQ, connections FAQ, port forwarding FAQ |
| AzireVPN | manager.azirevpn.com/wireguard, the WireGuard configuration generator. | 10 devices, 5 active at once. One address holds up to 3 public keys. | Yes, per device in the manager. | Blog, FAQ, API docs, port forwarding |
| hide.me | Members area, then WireGuard in the right-hand menu, Generate keys, pick a location, Download WireGuard config file. | Premium accounts only. Up to 10 static keys. One file per location. | Only "dynamic" port forwarding. Whether it works with a downloaded file isn't stated. | Help article, Premium only, announcement, port forwarding |
| IPVanish | my.ipvanish.com, then WireGuard in the left menu. Pick a location and press Generate. | The preshared key is left blank, so there is none. WireGuard uses UDP port 51820. | No. | Setup guide, ports, port forwarding |
| IVPN | Client Area, then the WireGuard config generator. Generate key (or add your own), pick Single or Multi-hop and a server, download the zip. | 5 devices on Standard and Plus, 10 on Pro. The usual DNS server is 172.16.0.1. The tunnel address has an IPv6 part too. | No, ended on 30 September 2023. | WireGuard FAQ, Linux guide, Windows guide, port forwarding |
| Mullvad | Log in at mullvad.net/en/account/wireguard-config. Pick a platform, Generate key, pick a server, Download file. | Up to 5 devices, one key each. DNS is 10.64.0.1 in Mullvad's own script. The lists in the file have no spaces after the commas, and AllowedIPs is written ::0/0; both work. |
No, removed in May 2023. | Windows guide, FAQ, script, port forwarding |
| NordVPN | Nord Account, then NordVPN, Advanced Settings, Set up NordVPN manually. Pick a server, Get setup configuration, choose WireGuard, Download config. | Needs your service credentials, not your Nord Account password. We couldn't see what the file contains: if it has no PrivateKey line, Mediarium can't use it. NordVPN's pages don't describe any other way to get the key, so there is no preset for one. 10 devices. |
Not on regular servers. | Download steps, Linux guide, devices, port forwarding |
| OVPN | Sign in, then the WireGuard configuration generator. It makes a key pair in your browser or takes your own public key. | 4 devices at once, plus one per year of subscription. A public key can only be connected once at a time. With your own public key the file has a placeholder where the private key goes. We couldn't see the exact menu name behind the login. | Yes, 49152 to 65535, up to 7 per account. | Generator help, sample file, connections, ports |
| Private Internet Access | No download page. PIA's own manual connection scripts write the file on your computer. | Run run_setup.sh with VPN_PROTOCOL=wireguard, PIA_CONNECT=false, PIA_USER, PIA_PASS, PREFERRED_REGION and PIA_CONF_PATH. It needs curl, jq and wireguard-tools. The address comes from PIA each time you run it and is written without a /32, which works. PIA's files are IPv4 only. If the connection stops working, run the script again. |
Yes, through the same scripts. | Repository, WireGuard script, port forwarding script |
| ProtonVPN | account.protonvpn.com, then Downloads, WireGuard configuration. Name it, pick a platform, options and a server, Create, then Download. | The free plan can create one too. Proton's own pages recommend its apps over manual files. | Yes on paid plans, with the NAT-PMP option on a P2P server. | WireGuard configurations, port forwarding |
| StrongVPN | wg.strongvpn.com, signed in with your account email and password. Pick a system and a location, Generate. | One file per device. The 13th file deletes the oldest. Its FAQ is old and still says beta. | No. | WireGuard FAQ, port forwarding |
| Surfshark | VPN, Manual setup, Desktop or mobile, WireGuard. I don't have a key pair, Generate a new key pair, then Choose a location and download. | Make the key pair before you download, or the file has no keys. The private key is only shown once. DNS servers are 162.252.172.57 and 149.154.159.92. The server is a host name, which Mediarium looks up each time it connects. | No. | Manual setup, Raspberry Pi guide, port forwarding |
| TorGuard | Config Generator (sign in). Tunnel type WireGuard, pick a location, enter your VPN username, Generate Config. | TorGuard's pages show no real example file and disagree about the port (51820 in one, 1443 in others), so check the fields after pasting. A forwarded port needs the config made for that exact IP. | Yes, as a request in the client area, up to 24 hours to approve. | DD-WRT guide, OpenWrt guide, port forwarding |
| Windscribe | My Account, then the Config Generator tab, then WireGuard. Pick a location and a port (443 if unsure), keep Generate new keypair, Download Config. | Paid accounts only. The file has a preshared key, so paste all of it. | Pro only, one temporary port at a time. | Where to find your configs, DD-WRT guide, port forwarding |
| Your own server (PiVPN, wg-easy) | PiVPN: pivpn add, then the file in the configs folder of your home folder. wg-easy: add a client in its web page. |
Both write a preshared key. wg-easy can write PostUp lines and PersistentKeepalive = 0; Mediarium ignores the first and applies its own 25 seconds when the second is 0. PiVPN's default subnet is likely 10.19.17.0/24. Your traffic leaves from wherever the server is, so a server at home still shows your home address. |
Not applicable. | PiVPN docs, PiVPN script, wg-easy docs |
The sample files the tests use to check all of this are in internal/vpn/testdata/providers. They have made-up keys. Each one is in the shape the provider documents, and the file says where its values come from.
Providers that can't be used here
A provider can only be used here if it lets you get a WireGuard file or a key pair of your own to use in any WireGuard program. These don't, as far as their own pages say:
| Provider | Why not | Source |
|---|---|---|
| CyberGhost | "Does not support manual WireGuard configuration". WireGuard works in its apps only. | Support article |
| ExpressVPN | WireGuard is in its apps only. The manual configuration page lists no WireGuard file. | Protocols, manual configuration |
| FastestVPN | We found no page to get the file. Its guides say to ask support for it. If support sends you one, pick Not listed and paste it. | Windows guide |
| Hotspot Shield | WireGuard is a setting inside its apps. No config file is documented. | Protocol article |
| Mozilla VPN | No support page for a manual config. Its client has a hidden command that exports one, which isn't documented for customers. | Client change |
| Perfect Privacy | Said in a blog post that WireGuard wasn't ready, and its site couldn't be reached when we checked. | Blog (archived copy) |
| PureVPN | The Member Area makes a file, but it has to be switched on within minutes (the articles say 5 or 30; a paid add-on stretches it to 24 hours). A stored connection can't work that way. | Add-on article, Linux guide |
| TunnelBear | "Does not currently provide manual configuration". | Help article |
| VyprVPN | Makes a WireGuard config on demand for each connection, and doesn't offer a file to download. | Help article |
| Cloudflare WARP | Uses WireGuard inside, but there is no export. The files from third-party tools are unofficial and its terms don't allow reverse engineering the app, so it isn't treated as a provider here. | Terms |
| Tailscale exit nodes | Needs the Tailscale client. There is no plain WireGuard file. | Exit nodes |
If one of these providers later adds a file download, pick Not listed and paste it.
What the status means
The status only says Connected while the tunnel is up and the VPN server has answered recently. It never says so just because a connection is switched on.
| Status | Meaning |
|---|---|
| Connected (label) | The tunnel is up and the server answers. |
| Connecting (label)… | The connection is starting, or waiting for the server to answer. It moves on by itself within a few seconds. |
| Disconnected (label) | The connection is switched on, but not working. The reason is shown under the status, for example that the server address could not be found or that the server stopped answering. |
| Disconnected | No connection is switched on. |
After a restart, Mediarium switches the connection that was on back on by itself, and keeps trying (every few seconds at first, then every minute) if the network is not ready yet. While a switched-on connection is not working, its row shows Reconnect instead of Activate, so you can also retry by hand. Disconnect turns it off for good.
While a connection is switched on but not working, torrents wait instead of connecting directly, whatever the kill switch says, so your home address is never shown by accident. Press Disconnect if you would rather download without the VPN. Removing the connection that is switched on also disconnects it.
Check my IP address appears while connected. It makes a real request through the tunnel and shows the public address the internet sees, so you can check that it is your VPN's address and not your own.
The kill switch
The switch is called Kill switch (optional): only run torrents while a VPN is connected.
While a VPN is connected, torrents always use it, whatever the switch says. The switch only decides what happens when no VPN is connected:
- On: a torrent download waits and then fails, with a message that says to connect a VPN, instead of connecting directly. There is no direct fallback. A proxy ticked for torrents counts as well: torrents then go through the proxy.
- Off: torrents connect directly, so your home address is visible to the swarm. This only applies when no connection is switched on. A connection that is switched on but not working holds torrents back, as described above.
Through the tunnel, DHT and uTP are turned off (they need a direct UDP connection, which would show your address), so magnet links rely on the trackers they carry. The torrent listen port (58264) is not used, and nothing listens on your network, so no incoming connection is ever seen. Settings shows this as "Not used while your VPN is on". Port forwarding through a VPN provider is not supported.
If you only use Usenet, you can also switch off Use the built-in torrent client under Settings > Downloading > Torrents.
A SOCKS5 or HTTP proxy instead
If you already run a proxy, such as the SOCKS5 port of a VPN container (Gluetun, for example), a seedbox or Tor, Mediarium can send traffic through it instead. The Proxy card is on the same page. OpenVPN isn't built in, because it needs the extra privileges this app doesn't ask for, but a VPN container with a SOCKS5 or HTTP proxy gives you the same result.
- Pick SOCKS5 or HTTP, and type the host (an IP address or a container name) and the port. Add a user name and password if the proxy wants them. The password is stored encrypted and never shown again.
- Tick what goes through it: - Torrents: peers, trackers and web seeds. The rules are the same as for the VPN: no direct connections, no DHT or uTP, no UDP trackers and no incoming peers. A connected VPN still takes over for torrents. - Indexers: searches, and fetching NZB and torrent files from them. - Usenet: the connections to your Usenet servers. Usually not needed, since they're already encrypted.
- Press Test. Mediarium connects through the proxy to TMDB's server (a secure connection is opened and closed, nothing is sent) and says whether it worked. Then press Save.
A change applies to new connections straight away. A download that's already running keeps the connection it has.
SOCKS5 is the better choice when you have both. Names are looked up by the proxy, not on your network. Some HTTP proxies only let secure web traffic through, so torrents and Usenet may be refused by them.
Scripts: GET /api/proxy (the password is never returned; hasPassword says whether there is one), PUT /api/proxy with {type, host, port, username, password, torrents, indexers, usenet} (type "" switches it off, leaving password out keeps the saved one) and POST /api/proxy/test with the same fields. The settings are network.proxy (encrypted) and network.proxy_for.
Checks on what you enter
The endpoint is host:port with a port from 1 to 65535, the two keys are 44-character WireGuard keys, and the tunnel address is an IP address with an optional /prefix. The page points out a problem under the field, and the server refuses the same mistakes from a script.
For scripts
The routes are GET/POST /api/vpn/configs, DELETE /api/vpn/configs/{id}, POST /api/vpn/configs/{id}/activate, POST /api/vpn/deactivate, GET /api/vpn/status (connected, state of off, connecting, connected or down, label, reason) and GET /api/vpn/egress-ip, all for administrators (API routes). The kill switch is the setting vpn.require_for_torrents. The code is in internal/vpn.