Network

Every request the server makes goes through one network layer that you control in Settings → Network. This page explains how to see which hosts the server reaches, fix spoofed DNS with DNS over HTTPS, and send chosen hosts through your own proxy.

What you'll get

TMDB, your indexers and notification channels reachable from the server, with DNS over HTTPS or your own proxy only where your network needs it.

Before you start

• Torsher is running and you can open the control panel. See Docker Compose.
• For a proxy route: a SOCKS5 or HTTP proxy of your own that the server can reach. Torsher doesn't provide one.

What these settings cover

Routes and DNS settings apply to every outgoing request of the server:

• the TMDB catalog and images;
• Prowlarr, Jackett and Torznab indexers you connected, including .torrent files they link to;
• notification channels, email included;
• the IMDb ratings download and the update check, if they are on.

They don't apply to:

• Torrent peers. The torrent engine connects to peers directly.
• Indexers inside Prowlarr or Jackett. Torsher talks to the manager, and the manager reaches its indexers itself. If an indexer site is unreachable from your network, set up a proxy in the manager's own settings.
• Your browser and TV. They connect to the Torsher server, not through it.

Check which hosts respond

The Availability card at the top of the page lists the hosts the server talks to: the TMDB catalog, TMDB images, every connected Prowlarr or Jackett and every indexer you added by hand. Indexers imported from a manager share its line: the server reaches them through the manager's address.

Select Check all. The check runs on the server, not in your browser, and keeps going if you leave the page. To check one host, open the menu at the end of its line and select Check.

The server also checks all hosts on start and every 30 minutes. A host that stops responding shows up in Needs attention on Overview, and the change is written to the log under Network.

Status	What it means	What to do
Responds	The host answered. A refusal without a key or a redirect counts too	Nothing
Responds, DNS is spoofed	The system DNS returns a wrong address, and the host works only thanks to its route	Keep the route
Name not resolved	The host name doesn't resolve	Turn on DNS over HTTPS
DoH not responding	The DNS over HTTPS provider of the route doesn't answer	Choose another provider
No answer	No answer in 8 seconds	Check the server's connection, or the proxy of the route
No connection	The connection failed	Check the address of the host, or the proxy of the route
Wrong certificate	The certificate doesn't match the host. The address may be spoofed	Turn on DNS over HTTPS
Server error	The host answered with a 5xx error	The problem is on the host's side; try later

If a host has a problem and DNS over HTTPS doesn't help, give it a route through your proxy: in the menu of its line, select Create a route for this host. The host is already filled in.

Spoofed DNS and DNS over HTTPS

Some networks answer DNS requests for some sites with a wrong address. The server then can't reach the site, or reaches a different server with the wrong certificate.

For hosts reached directly, Torsher detects this on every check. It asks the system DNS and a DNS over HTTPS (DoH) provider for the same name. If the two answers have no address in common and the request through the system DNS fails, the line says the DNS is spoofed. Different addresses alone are not a problem: large sites legitimately return different addresses to different resolvers.

To fix it for all hosts:

1. In the Default DNS card, choose DoH Quad9, DoH Google or DoH Cloudflare.
2. Select Save. New requests use it right away.
3. Select Check all.

The built-in providers are contacted by IP address, so they work even when the system DNS is spoofed. Which one works depends on your network: if the check says DoH not responding, try another one.

Custom DoH takes the address of any DNS over HTTPS server (RFC 8484), for example https://doh.example/dns-query. It must start with https://.

To use DoH for only some hosts, leave the default DNS as it is and add a route for those hosts with Direct and a DoH provider.

Routes

A route tells the server how to reach a host: directly, through a SOCKS5 proxy or through an HTTP proxy, and which DNS to use. The Routes card lists them. The last one, All other hosts, applies to every host without its own route. You can edit it, but not delete it.

Add a route

1. In the Routes card, select Add route.

2. In Host or mask, enter the host:

   • indexer.example: this host only;
   • *.indexer.example: all its subdomains, such as api.indexer.example, but not indexer.example itself. Add a second route for it if you need both.

   No scheme, port or path. An IP address works as an exact host.

3. Under How to connect, choose Direct, SOCKS5 or HTTP proxy.

4. For a proxy, enter the Proxy address as host:port, for example 192.168.1.10:1080. The port is required. A scheme is optional: socks5:// for SOCKS5, http:// for an HTTP proxy. If the proxy asks for sign-in, fill in Username and Password.

5. For Direct, choose the DNS: the system DNS or a DoH provider. A proxy route has no DNS setting: the proxy resolves host names itself, so spoofed DNS in your network doesn't affect it.

6. Select Add route.

The route works for new requests right away. Select Check all to see the result.

Proxy usernames and passwords are stored encrypted, like indexer API keys. When you edit a route, leave them empty to keep the saved ones, or select Remove to delete them.

Which route wins

• A route for the exact host beats any mask.
• Among masks, the first matching one from the top wins. Reorder them with the arrows next to each route.
• All other hosts comes last.

When a host redirects to another host, the route is chosen again for the new host. Sign-in and API key headers are not sent along to a different host, and a redirect from https to http is refused.

Send everything through a proxy

Edit All other hosts and choose SOCKS5 or HTTP proxy.

That route covers every host, including services in your own network: Prowlarr, Jackett, a notification server. If the proxy can't reach them, add a Direct route for each, for example prowlarr or 192.168.1.20.

Proxy from the environment

If the container has HTTPS_PROXY or HTTP_PROXY set, the server uses that proxy for hosts without their own route, and NO_PROXY lists the exceptions. The routes list then shows Proxy from the environment (HTTPS_PROXY) for All other hosts.

environment:
  HTTPS_PROXY: http://192.168.1.10:3128
  NO_PROXY: prowlarr,localhost

The environment proxy is a starting point

It applies only while All other hosts is left as it was installed: direct, with the system DNS. Choosing DoH or a proxy for that route turns the environment proxy off. Routes for individual hosts never use it.

Run your own proxy next to Torsher

Torsher works with any SOCKS5 or HTTP proxy. Which proxy you run and how you configure it is up to you. Two common setups:

A proxy service in the same Compose file

Add the proxy as another service under services: in docker-compose.yml, next to torsher. Services in one file share a network, so Torsher reaches the proxy by its service name. Don't publish the proxy's port: only containers in this file need it.

proxy:
  image: <proxy-image>
  container_name: proxy
  restart: unless-stopped
  # No ports: section. Only containers in this file reach the proxy

Replace <proxy-image> with the image of your proxy and configure it as its documentation says. Then create a route with SOCKS5 and the address proxy:1080, or with HTTP proxy and the port your proxy listens on.

A proxy on the host or another device

A proxy on your router, another server or the Docker host itself is reached by its address in your network, for example 192.168.1.10:1080. It must accept connections from that network, not only from 127.0.0.1.

Inside the container, localhost is the container itself, not the host. To reach a proxy on the Docker host by name, add this to the torsher service and use host.docker.internal:1080 as the proxy address (not verified):

extra_hosts:
  - 'host.docker.internal:host-gateway'

Apply changes to docker-compose.yml:

docker compose up -d

Check

• In Availability, every host says Responds or Responds, DNS is spoofed.
• The showcase shows the catalog with posters.
• Needs attention on Overview has no network items.

If something went wrong

• DNS returns a wrong address. See Troubleshooting.
• A host is unreachable. See Troubleshooting.
• Every DoH provider says it doesn't respond. The server doesn't reach them either. Add a route through your proxy for the hosts you need.
• A proxy route says No connection or No answer. The proxy is down or the server doesn't reach it. A proxy container must be in the same Compose file as Torsher or on a network the container reaches; a proxy on another machine must accept connections from the server.
• A route for this host already exists — edit it instead. Each host or mask has one route. Find it in the list and edit it.
• An indexer from Prowlarr or Jackett doesn't respond, but the manager's line is fine. The manager can't reach that indexer. Set up its proxy in the manager.

More in Troubleshooting and Logs and diagnostics.

Next

• Storage.
• Indexers.
• Remote access.