---
title: "Prowlarr + FlareSolverr — Direct Request Bug and VPN Alternatives"
aliases: [prowlarr-flaresolverr, flaresolverr-bypass, prowlarr-cloudflare, prowlarr-rutracker]
tags: [prowlarr, flaresolverr, media-stack, homelab, torrent, indexer, vpn]
sources:
  - "daily/2026-04-28.md"
  - "daily/2026-04-29.md"
created: 2026-04-28
updated: 2026-04-29
---

# Prowlarr + FlareSolverr — Direct Request Bug and VPN Alternatives

Prowlarr supports FlareSolverr integration for bypassing Cloudflare anti-bot protection on torrent indexers. However, for some indexers (notably RuTracker), Prowlarr makes direct HTTP requests rather than routing them through FlareSolverr — even when the FlareSolverr tag is correctly assigned. This is a known plugin-level bug, not a configuration error. The indexer shows as "online" in Prowlarr but search results always fail.

## Key Points

- **FlareSolverr tag assignment does not guarantee FlareSolverr is used** — some Prowlarr indexer plugins make direct requests regardless of the tag; this is a bug in those specific plugins
- **Diagnosis:** `curl rutracker.org` from the server returns 200 (network works); Prowlarr search returns errors → Prowlarr's plugin is making a direct request that gets blocked by Cloudflare, not routing through FlareSolverr
- **RuTracker specifically** was confirmed broken in Prowlarr with FlareSolverr as of April 2026 — the plugin bypasses FlareSolverr entirely
- **Pragmatic fix:** use alternative indexers (TPB, RuTor, SubsPlease, Nyaa) that don't require FlareSolverr — don't invest time debugging a known broken plugin
- **AmneziaVPN Free** only provides AmneziaWG (a proprietary WireGuard variant) — Gluetun does not support it; incompatible for qBittorrent VPN container

## Details

### How FlareSolverr Is Supposed to Work

FlareSolverr is a proxy service that uses a headless Chromium browser to solve Cloudflare challenges and return the actual page content. Prowlarr assigns indexers to a FlareSolverr "tag" in Settings → Indexers → FlareSolverr; when Prowlarr fetches that indexer, it's supposed to send the request to FlareSolverr's HTTP API instead of making a direct request.

The integration works correctly for many indexers. For others, particularly those with custom Prowlarr plugin implementations, the plugin bypasses the FlareSolverr proxy and makes direct requests.

### Confirming It's a Plugin Bug, Not a Config Error

```bash
# Step 1: Confirm network connectivity — is rutracker.org reachable from the server?
curl -I https://rutracker.org
# HTTP/1.1 200 OK → network is fine; Prowlarr is not routing through FlareSolverr

# Step 2: Check FlareSolverr itself is working
curl -X POST http://localhost:8191/v1 \
  -H "Content-Type: application/json" \
  -d '{"cmd": "request.get", "url": "https://rutracker.org", "maxTimeout": 60000}'
# {"status":"ok", ...} → FlareSolverr works; Prowlarr is not using it

# Step 3: In Prowlarr → Indexers → test the indexer
# If it fails even with FlareSolverr running and correctly tagged → plugin bug
```

If the server can reach the indexer directly (step 1) and FlareSolverr works (step 2), but Prowlarr still fails when testing the indexer, the plugin is making direct requests that get blocked.

### Which Indexers Work Without FlareSolverr

These indexers work reliably in Prowlarr without FlareSolverr and cover most use cases:

| Indexer | Content | Notes |
|---------|---------|-------|
| The Pirate Bay (TPB) | General | Most popular; works via Prowlarr public indexer |
| RuTor | General (Russian) | RuTracker alternative, no Cloudflare |
| SubsPlease | Anime (simulcast) | Reliable; no Cloudflare issues |
| Nyaa | Anime, manga, J-content | Most reliable anime indexer |
| 1337x | General | Works reliably |
| RARBG mirrors | General | Original RARBG gone; mirrors vary |

For most media setups, these 4–5 indexers provide sufficient coverage without FlareSolverr complexity.

### VPN for qBittorrent — Alternatives to Gluetun

When a VPN provider doesn't support Gluetun's protocols (OpenVPN, WireGuard standard), or when Gluetun configuration is complex, three alternatives exist:

**Option 1: SOCKS5 Proxy in qBittorrent**
The simplest option — qBittorrent has native SOCKS5 proxy support that routes torrent traffic (but not the WebUI) through a proxy:
```
qBittorrent → Options → Connection → Proxy Server
Type: SOCKS5
Host: <proxy_ip>
Port: <proxy_port>
```
Many VPN providers offer SOCKS5 endpoints as part of their service.

**Option 2: WireGuard Directly in LXC**
If the VPN provider offers WireGuard configuration files, install WireGuard directly in the qBittorrent LXC container (CT111):
```bash
apt install wireguard
# Write wg0.conf with provider's config
wg-quick up wg0
# All container traffic routes through VPN
```
This is cleaner than Gluetun for providers that offer standard WireGuard configs.

**Option 3: Router-Level VPN (TP-Link AX72)**
The TP-Link Archer AX72 router supports OpenVPN client mode. Configuring VPN at the router level routes all homelab traffic through the VPN — no per-container setup needed. Downside: all traffic goes through VPN, including services that shouldn't.

**AmneziaVPN Free Limitation:**
AmneziaVPN Free only provides AmneziaWG — a proprietary variant of WireGuard that obfuscates packets to bypass VPN blocks. Gluetun only supports standard WireGuard and OpenVPN. AmneziaVPN cannot be used with Gluetun; use a provider that offers standard WireGuard (Mullvad, ProtonVPN, etc.) if Gluetun is required.

### Media Stack Context

The homelab media stack (CT111, Proxmox LXC) includes:
- **Prowlarr** — indexer management
- **Radarr/Sonarr** — movie/TV automation
- **qBittorrent** — download client
- **FlareSolverr** — Cloudflare bypass proxy (optional, limited effectiveness)

The pragmatic approach: configure 4–5 reliable indexers that don't require FlareSolverr, skip RuTracker, and add a VPN to qBittorrent only if required by the ISP or content provider.

## Prowlarr baseUrl Trailing Slash Bug

If `baseUrl` is set to `https://rutracker.org` (no trailing slash), Prowlarr string-concatenates it with the path segment instead of joining them correctly — producing a garbled hostname like `rutracker.orgforum:443`. This causes all requests to that indexer to immediately fail with a connection error.

**Fix:** Always add a trailing slash to Prowlarr indexer `baseUrl`: `https://rutracker.org/`

This is a silent bug — Prowlarr's UI doesn't warn about it, and the test result just shows a generic failure.

## Prowlarr API Save Timeout (SQLite Direct Edit Workaround)

When adding or testing a Prowlarr indexer that is blocked by Cloudflare (e.g., the connection test hangs), the `/api/v1/indexer` POST request hangs indefinitely — Prowlarr's UI appears to freeze. The indexer is never saved.

**Workaround:** Edit the Prowlarr SQLite database directly:

```bash
# 1. Stop the Prowlarr container
docker compose stop prowlarr

# 2. Open the database
sqlite3 /path/to/prowlarr/config/prowlarr.db

# 3. View existing indexers
SELECT Id, Name, Settings FROM Indexers;

# 4. Update settings (e.g., fix baseUrl)
UPDATE Indexers SET Settings = '{"baseUrl":"https://rutracker.org/","...":"..."}' WHERE Name = 'RuTracker';

# 5. Exit and restart
.quit
docker compose start prowlarr
```

The `Settings` column stores a JSON blob. Be careful to preserve the full JSON structure — only modify the field you need.

## Docker Containers Blocked by Cloudflare (TLS Fingerprint Detection)

Cloudflare blocks requests from Docker containers even when the host machine can reach the same URL successfully. This is not simple IP-based blocking — Cloudflare detects the non-browser TLS fingerprint (JA3/JA4 fingerprint) and User-Agent of curl/Python/Go HTTP clients.

- **Host machine:** uses the system browser or curl with a browser-like TLS stack → passes Cloudflare
- **Docker container:** uses the container's OpenSSL/Go TLS stack → detected as a bot, blocked with 403 or CAPTCHA challenge

FlareSolverr solves this by running a headless Chromium browser inside the container, which produces a genuine browser TLS fingerprint. It listens on port 8191 and exposes an HTTP API that Prowlarr calls instead of fetching the indexer directly.

**Docker Compose sidecar setup:**

```yaml
services:
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    # ...

  flaresolverr:
    image: ghcr.io/flaresolverr/flaresolverr:latest
    container_name: flaresolverr
    environment:
      - LOG_LEVEL=info
    ports:
      - "8191:8191"
    restart: unless-stopped
```

**Prowlarr configuration:** Settings → Indexer Proxies → Add → FlareSolverr, URL: `http://flaresolverr:8191` (use the Docker Compose service name for container-to-container networking). FlareSolverr v3.x is the current actively maintained fork.

## RuTracker DoLogin Bypass — SQLite Cookie Injection

Even with FlareSolverr correctly configured and responding (v3.4.6, returns 200 for rutracker.org), Prowlarr's `DoLogin()` method in the RuTracker plugin uses .NET's `HttpClient` directly — it does **not** route through FlareSolverr. This is an architectural limitation, not a configuration error. FlareSolverr intercepts only GET requests sent through its proxy API; POST form logins (like RuTracker's login page) bypass it entirely.

### Root Cause

- FlareSolverr works by receiving a `request.get` command via its HTTP API and replaying it through headless Chromium
- Prowlarr's indexer plugins that use `DoLogin()` make their own `HttpClient` POST request to the login endpoint, never calling FlareSolverr's API
- The FlareSolverr tag assignment in Prowlarr controls only which requests use the proxy — it does not force all traffic through FlareSolverr

### Workaround: Browser Cookie Injection

Since `DoLogin()` cannot be fixed without patching the plugin, the practical workaround is to skip login entirely and inject a valid session cookie directly into Prowlarr's database:

1. Open a browser and log in manually to `https://rutracker.org`
2. Open DevTools → Application → Cookies → copy the `bb_session` cookie value
3. Stop the Prowlarr container and inject the cookie:

```bash
docker compose exec prowlarr sqlite3 /config/prowlarr.db \
  "UPDATE IndexerDefinition SET Cookies = '{\"bb_session\": \"<cookie_value>\"}' WHERE Name = 'RuTracker';"
```

4. Restart Prowlarr — searches will work immediately (50 results confirmed)

**Cookie location in DB:** `IndexerDefinition` table, `Cookies` JSON field (not the `Indexers` table used for settings).

**Cookie expiry:** `bb_session` expires approximately 30 days after login. Process to refresh:
1. Log in to rutracker.org in a browser
2. Copy new `bb_session` value from DevTools
3. Re-run the `UPDATE IndexerDefinition` command above

**Domain note:** `rutracker.nl` returns HTTP/2 protocol errors — always use `rutracker.org`.

## Related Concepts

- [[wiki/homelab/_index]] — media stack articles (Radarr, Sonarr, Prowlarr, qBittorrent setup)
- [[wiki/concepts/adguard-dns-rewrites-homelab]] — homelab internal DNS for media services
- [[wiki/concepts/proxmox-lxc-autostart]] — CT111 (media stack LXC) should have autostart enabled
- [[wiki/concepts/prowlarr-flaresolverr-get-only]] — standalone article: FlareSolverr GET-only architecture, SQLite cookie injection procedure, bb_session refresh cycle

## Sources

- [[daily/2026-04-28.md]] — Prowlarr indexer testing: RuTracker failed with FlareSolverr tag; `curl rutracker.org` from server returned 200 (network fine); confirmed Prowlarr makes direct request bypassing FlareSolverr; decision to keep RuTracker broken and use TPB/RuTor/SubsPlease/Nyaa; AmneziaVPN Free incompatible with Gluetun (AmneziaWG only); VPN alternatives documented
- [[daily/2026-04-29.md]] — DoLogin architectural root cause confirmed; FlareSolverr pings correctly but bypassed by .NET HttpClient; `bb_session` cookie injected via sqlite3 directly into IndexerDefinition table; 50 results confirmed after injection; rutracker.nl HTTP/2 error noted
