2

I am trying to use a network namespace for VPN-specific traffic, using this guide: https://schnouki.net/posts/2014/12/12/openvpn-for-a-single-application-on-linux/ on Debian.

Everything works with regard to setting up the namespace, and the bride, as shown here. The namespace is named piavpn, the veth on the namespace side is vpn1 and on the main side is vpn0. However, I cannot access the internet nor the main network from the namespace.

On the namespace:

sudo ip netns exec piavpn ip addr list
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
7: vpn1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether da:8f:25:6f:47:74 brd ff:ff:ff:ff:ff:ff
    inet 10.200.200.2/24 scope global vpn1
       valid_lft forever preferred_lft forever
    inet6 fe80::d88f:25ff:fe6f:4774/64 scope link 
       valid_lft forever preferred_lft forever

On the normal network:

ip addr list
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether 00:90:f5:eb:90:24 brd ff:ff:ff:ff:ff:ff
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 68:17:29:90:f5:ba brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.16/24 brd 192.168.0.255 scope global dynamic wlan0
       valid_lft 80406sec preferred_lft 80406sec
    inet6 fe80::6a17:29ff:fe90:f5ba/64 scope link 
       valid_lft forever preferred_lft forever
4: vmnet1: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether 00:50:56:c0:00:01 brd ff:ff:ff:ff:ff:ff
5: vmnet8: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether 00:50:56:c0:00:08 brd ff:ff:ff:ff:ff:ff
8: vpn0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 2a:19:71:d5:79:29 brd ff:ff:ff:ff:ff:ff
    inet 10.200.200.1/24 scope global vpn0
       valid_lft forever preferred_lft forever
    inet6 fe80::2819:71ff:fed5:7929/64 scope link 
       valid_lft forever preferred_lft forever

Pinging works both ways:

ping 10.200.200.2
PING 10.200.200.2 (10.200.200.2) 56(84) bytes of data.
64 bytes from 10.200.200.2: icmp_seq=1 ttl=64 time=0.084 ms
64 bytes from 10.200.200.2: icmp_seq=2 ttl=64 time=0.068 ms

sudo ip netns exec piavpn ping 10.200.200.1
PING 10.200.200.1 (10.200.200.1) 56(84) bytes of data.
64 bytes from 10.200.200.1: icmp_seq=1 ttl=64 time=0.088 ms
64 bytes from 10.200.200.1: icmp_seq=2 ttl=64 time=0.040 ms

However, I cannot access the internet nor the main network from the namespace. I think it must be an iptables issue as I have ipv4 forwarding enabled in sysctl.

My iptables rules are here: https://gist.github.com/anonymous/a1b440f1d3538be6557d

The NAT iptables rules are:

sudo iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.200.200.0/24      anywhere            
MASQUERADE  all  --  10.200.200.0/24      anywhere            
MASQUERADE  all  --  10.200.200.0/24      anywhere            
MASQUERADE  all  --  10.200.200.0/24      anywhere            
MASQUERADE  all  --  anywhere             anywhere            
MASQUERADE  all  --  10.0.0.0/8           anywhere

Clearly it's become messy where I've tried multiple times. But it should be permissive.

Until I get general connectivity from the namespace there is no point in worrying about the VPN.

jamesmcm
  • 41
  • 5
  • For other readers having problems like this, remember to check all the iptables tables, not just the NAT table. – plugwash Dec 02 '16 at 03:13

1 Answers1

2

It turned out the trick was to disable ufw:

sudo ufw disable

And then I flushed the iptables and re-added the rules, and re-wrote /etc/resolv.conf after NetworkManager overwrote it for some reason.

Now it all works perfectly.

jamesmcm
  • 41
  • 5