I’d basically like to run some containers within a VPN and some outside of it. The containers running within the VPN should not be able to send or receive any traffic from outside the VPN (except localhost maybe).

The container could be docker, podman, or even a qemu VM or some other solution if need be.

Is that possible? Dunno if this is the right place to ask.

Resolution-------

Use https://github.com/qdm12/gluetun folks.

Anti Commercial-AI license

  • BB_C@programming.dev
    link
    fedilink
    arrow-up
    6
    ·
    edit-2
    4 months ago

    start a process within a specific veth

    That sentence doesn’t make any sense.

    Processes run in network namespaces (netns), and that’s exactly what ip netns exec does.

    A newly created netns via ip netns add has no network connectivity at all. Even (private) localhost is down and you have to run ip link set lo up to bring it up.

    You use veth pairs to connect a virtual device in a network namespace, with a virtual device in the default namespace (or another namespace with internet connectivity).

    You route the VPN server address via the netns veth device and nothing else. Then you run wireguard/OpenVPN inside netns.

    Avoid using systemd since it runs in the default netns by default, even if called from a process running in another netns.

    The way I do it is:

    1. A script for all the network setup:
    ns_con AA
    
    1. A script to run a process in a netns (basically a wrapper around ip netns exec):
    ns_run AA <cmd>
    
    1. Run a termnal app using 2.
    2. Run a tmux session on a separate socket inside terminal app. e.g.
    export DISPLAY=:0 # for X11
    export XDG_RUNTIME_DIR=/run/user/1000 # to connect to already running pipewire...
    # double check this is running in AA ns
    tmux -f -f <alternative_config_file_if_needed> -L NS_AA
    

    I have this in my tmux config:

    set-option -g status-left "[#{b:socket_path}:#I] "
    

    So I always know which socket a tmux session is running on. You can include network info there if you’re still not confident in your setup.

    Now, I can detach that tmux session. Reattaching with tmux -L NS_AA attach from anywhere will give me the session still running in AA.

    • Scipitie@lemmy.dbzer0.com
      link
      fedilink
      arrow-up
      2
      ·
      4 months ago

      Yeah I had a brainfart, meant namespace…

      And thanks a lot for this writeup I think with your help I figured out where I went wrong in my train of thought and I’ll give it another try next week when I have a bit downtime.

      The time you took to write this is highly appreciated! ♥