Hi. Thanks for this guide. Im about to try this but first have a question. When you set the ip address 10.200.200.1/24 to vpn0, is this an arbitrary ip address of the address system of you LAN?

This is amazing. The only problem I had was that I had to disable UFW with sudo disable ufw first.

Hi, im a little late to the game - but I followed your tutorial but beforehand I did some experiements with netns. It appears to be that a namespace is destroyed upon reboot? Is there a way to prevent this?

I see well thanks for clearing that out - should be possible to run a script on boot though - that creates said ns :)

Hi again schnouki,
I just wanted to show my implementation of this into a start-stop-daemon script. :)
http://blog.mineville.nu/2015/10/31/update-rc-d-rtorrent-defaults-99/

Hi schnouki, I stumbled upon your guide, I was able to adapt it to my needs and do have an actual VPN connection inside a network namespace now. Thank you very much for that. However, I have one problem that I couldn’t resolve on my own, no matter how hard I tried. I do want to forward a port from the host system to the application running inside the namespace. Any help would be very much appreciated, please have a look: https://unix.stackexchange.com/questions/257510/port-forwarding-to-application-in-network-namespace-with-vpn

Thank you so much! With your help, I was able to accomplish exactly, what I was trying to do. If anyone else is running an application inside the namespace with a web interface and doesn’t want to connect through the vpn to it, try this: socat -4 TCP-LISTEN:<port>,reuseaddr,fork TCP:10.200.200.2:<port>

Hi. When i try doing this, the interface lost connection after 10-20 seconds. The ping command can ping google for like 15 seconds, but then the destination host is unreachable. This is without my vpn started. Why does this happen and how can i solve this?

Hi, Your tutorial is amazing. I am looking of a way to use namespace to accomodate openvpn as a server.

So lets say I have these namespace REMOTE1 and REMOTE2. The openvpn server will be running in each namespace.
REMOTE1 Openvpn server 10.10.10.1
REMOTE2 Openvon server 10.10.20.1
So if the server host has a public ip of 1.1.1.1.

How can an outside openvpn client reach the inside REMOTE vpn?

Thanks for the terrific guide. There are few issues that I see.

1.) if the connection the VPN server goes down, traffic gets routed through the default interface due to the veth link. To avoid traffic leaking outside of the VPN, how can we create a fallback route that blocks traffic?

2.) For some reason when I use transmission-gtk within the vpn namespace it does not work. other things such as ping, traceroute, or chromium work just fine. transmission-gtk also works fine if I start the VPN connection in the main namespace (i.e. not using a separate namespace as in your tutorial). So there must be some port or route that isn’t going through. Any way to debug this?

3.) It would be nice to have the update-resolv-conf script that’s run on the VPN connection coming up and down update the /etc/netns//resolv.conf that is used by the VPN namespace.

Thanks. I went ahead and came up with a complete solution that addresses the concerns I had. Instead of namespaces, I used control groups, which are in many ways superior. You can grant a non-root user access to run processes in the isolated cgroup and using two instances of dnsmasq can separate DNS queries. More at the link.

http://serverfault.com/a/766290/345463

Second question: in the not-namespace (root namespace?), I tried your iptables commands. But the result of iptables -S is just:

# iptables -A INPUT \! -i vpn0 -s 10.200.200.0/24 -j DROP  
# iptables -t nat -A POSTROUTING -s 10.200.200.0/24 -o eth0 -j MASQUERADE  
# iptables -S  
-P INPUT ACCEPT  
-P FORWARD ACCEPT  
-P OUTPUT ACCEPT  
-A INPUT -s 10.200.200.0/24 ! -i vpn0 -j DROP  

It seems to be ignoring the second one, which I think is causing problems later on. What is going wrong here? I’m on Ubuntu 14.04.5, if that’s a factor.

Oh, I needed to do iptables -t nat -v -x -n -L to see the NAT rules. It’s there (four times, in fact, because I thought maybe if I typed louder it would work).

So after fixing all that up, my real problem is: even after adding the default route (in the namespace) and enabling NAT (outside the NS), I can’t ping anything from within the namespace. I’m not even trying to use names here (I haven’t set up DNS yet). I just see (from inside the NS):

# ping 8.8.8.8  
From 10.200.200.2 icmp\_seq=1 Destination Host Unreachable  
From 10.200.200.2 icmp\_seq=2 Destination Host Unreachable  
From 10.200.200.2 icmp\_seq=3 Destination Host Unreachable  
^C  

Any suggestions?

I’ll post the answer to this here in case anyone else has this problem: on my system, the effect of ip addr add 10.200.200.1/24 dev vpn0 was being mysteriously reversed after a while by… something. Could be Network Manager.

In other words, the line from ip addr show (in the root namespace) that looked like this:

inet 10.200.200.2/24 scope global vpn1  

…was disappearing. I had to run that first command again.

Update: It was network manager! Thanks to this thread I found that if you name your virtual interface ends veth0 and veth1 they will be ignored by network manager, and everything works.

Thanks for the excellent tutorial!

@Benny:

1. Will cause problems if you actually want your VPN to set the default route (which most do, eg. with redirect-gateway def1 in the pushed parameters or config). It’ll fail with:

NOTE: unable to redirect default gateway -- Cannot read current default gateway from system

…and there will be no default route out of your namespace.

Using this with dante-server as socks proxy, this is amazing !

Thanks for your tutorial. It works, I use it widely. Do you think it’s possible to put squid proxy server in front of the system so that every proxied request will go through vpn that lives inside the network namespace?

I mean we can run ip netns exec frootvpn curl ipv4.icanhazip.com that gives us vpn’s IP, but it seems to be more convenient to run just curl ipv4.icanhazip.com -x localhost:3128. Here I assumed that we have proxy server running on 3128 port that sends every request to the vpn in frootvpn namespace. The only problem is that I can’t set it up.

We have vpn0<->vpn1 link for accessing the real world from inside the namespace. Is it possible to use it in reverse way, send something to vpn0 interface (from the root namespace) and get result from the vpn? I played with iptables rules to make curl ipv4.icanhazip.com --interface vpn0 work with no success. I also added the second vpn2<->vpn3 link and tried to send something through the following chain: root.vpn2 -> frootvpn.vpn3 -> vpn -> frootvpn.vpn1 -> root.vpn0 with no success either.

It would be great if you share any thoughts about this case.

Hello, I just managed to make this work, I had to modify the /lib/systemd/system/transmission-daemon.service under these instructions to make it working under Ubuntu 16.04. My problem is I can’t access the web interface anymore. Any suggestions;

Actually I run the system headless and I have access to it’s web gui via a local desktop. So it must be something else to do the trick. I tried with your suggestion though. Also pinging 10.200.200.2(odroid) from the local(desktop) doesn’t return anything, but it Works! Any suggestion much appreciated.

Note that you might want to limit all outgoing connections to the VPN domain and udp port, basically a killswitch:
iptables -t nat -A POSTROUTING -d $VPN_DOMAIN -p udp –dport 1195 -s 10.200.200.0/24 -o wl+ -j MASQUERADE

Thanks so much for this tutorial. I vaguely knew that (network) namespaces existed, but didn’t think they are so easy to use. This was exactly what I was looking for. Except for the Netfilter part - as I was already using nftables on that machine. Got it working with the following:

nft add rule inet filter input iif != vpn0 ip saddr 10.200.200.0/24 drop
nft add rule nat postrouting ip saddr 10.200.200.0/24 oif eth0 masquerade

Thanks again!

Hi. It doesn’t work in my case (ubuntu 17.04).

then I try to start vpn (either with .ovpn of .conf) it just gets stuck at:

Tue Dec 5 10:52:21 2017 UDP link local: (not bound)
Tue Dec 5 10:52:21 2017 UDP link remote: [AF_INET]“IP.ADD.RE.SS”:1194

I start it with:
sudo ip netns exec namedvpn openvpn fileto.ovpn
or:
sudo ip netns exec namedvpn openvpn –config /etc/openvpn/blablabal.conf.

If I just do “sudo openvpn file.ovpn” everything works fine.
Any hints for me?
(I tried both the vppn.sh and manually). zsh vppn.sh up has no error messages and creates all the stuff.

Thank you!

Giorgos: Well, you can actually use the solution you mentioned here already and it is also submitted as solution here: https://unix.stackexchange.com/questions/257510/port-forwarding-to-application-in-network-namespace-with-vpn With Transmission-daemon default web ports and config described in this tutorial your approach would be like this:

sudo apt-get install socat

socat tcp-listen:9091,reuseaddr,fork tcp-connect:10.200.200.2:9091And Schnouki btw, this post is just amazing. I have a lot to learn from this. Thank you.

@Benny: Question about 1. The kill switch seems not to work. When the VPN is down deluge is still downloading the torrent. This is what I have for routes:

ip netns exec deluge ip route add 1.2.3.4/32 via 10.200.200.1 dev vpn1 ip netns exec deluge ip route add 8.8.8.8 via 10.200.200.1 dev vpn1 (default route removed) Any way to fix it ?