This document contains some hopefully helpful notes on how to set up OpenVPN together with Linux Network Namespaces (ip netns) so that applications started in the VPN's netns can only exit through the VPN - no veth trickery needed. It works by moving the tun device into the namespace once it is created and then setting all the usual stuff. Despite its simplicity, I haven't seen this approach anywhere else so I'm documenting it. I assume you're familiar with the basics of Linux Network Namespaces and OpenVPN configuration here. openvpn.conf:
# (not shown: general configuration) # we set our routes manually route-noexec script-security 2 # no down.sh needed in my case, the device is destroyed along with configuration on down anyway up /etc/openvpn/netns-up.sh
/etc/openvpn/netns-up.sh:
#!/bin/sh # I can't be bothered to parse $ifconfig_netmask preflen=24 # put something sensible here ns=nsname # create the namespace if it doesn't exist # if you're not running debian, this file may be somewhere else if ! [ -f /var/run/netns/$ns ]; then ip netns add $ns fi ipr="ip netns exec $ns ip" ip link set $dev netns $ns # moving the interface will reset its configuration so we restore it manually $ipr link set dev $dev up mtu $tun_mtu $ipr addr add dev $dev $ifconfig_local/$preflen broadcast $ifconfig_broadcast $ipr route add default via $route_vpn_gateway
/etc/sudoers.d/netns: (optional, adjust for username)
$user ALL = NOPASSWD: /sbin/ip netns exec $nsname sudo -u $user -- *
Test your setup with:
% sudo ip netns exec $nsname sudo -u $USER -- $SHELL % ip addr % ip route
Caveats: 1. No DNS included! Use a globally reachable DNS server or set up your own in the VPN. 2. If started in a netns via the sudo line, Firefox complains about lack of dbus connectivity because it breaks somewhere along the double sudo. I haven't found a fix for this yet. For an alternative approach, you can also specify --iproute to OpenVPN instead of a --up script - this ended up way too hacky for my tastes though. comments/ideas/improvements via mail to: www@ published: Sep 07 2015. epistemic status: solid.

[up]