lollipopcloud/advanced/namespaced-openvpn.md

namespaced-openvpn setup

Network namespace isolated VPN

Install

cd /opt
git clone https://github.com/slingamn/namespaced-openvpn.git
cd namespaced-openvpn
make install

/usr/local/sbin/namespaced-openvpn --config /etc/openvpn/chicago.conf --auth-user-pass /etc/openvpn/auth.txt

ip netns list

ip netns exec protected links http://ifconfig.co

namespaced-openvpn systemd services

cat > /etc/systemd/system/namespaced-openvpn.service <<EOF
# This service is actually a systemd target,
# but we are using a service since targets cannot be reloaded.

[Unit]
Description=OpenVPN service in netns
After=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/true
ExecReload=/bin/true
WorkingDirectory=/etc/openvpn

[Install]
WantedBy=multi-user.target
EOF


cat > /etc/systemd/system/namespaced-openvpn@.service <<EOF
[Unit]
Description=OpenVPN connection to %i in netns=protected-%i
PartOf=namespaced-openvpn.service
ReloadPropagatedFrom=openvpn.service
Before=systemd-user-sessions.service

[Service]
PrivateTmp=true
KillMode=mixed
Type=simple
Restart=always
ExecStart=/usr/local/sbin/namespaced-openvpn --config %i.conf --namespace protected-%i
PIDFile=/run/namespaced-openvpn/%i.pid
ExecReload=/bin/kill -HUP $MAINPID
WorkingDirectory=/etc/openvpn
# Likely need CAP_SYS_ADMIN -- disable bounding for now
#ProtectSystem=yes
#CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
#LimitNPROC=10
#DeviceAllow=/dev/null rw
#DeviceAllow=/dev/net/tun rw

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable namespaced-openvpn@toronto
systemctl restart namespaced-openvpn@toronto
journalctl -fu namespaced-openvpn@toronto

ip netns list # Should see protected-toronto

Service bridging

/usr/bin/socat tcp-listen:8000,fork,reuseaddr \
  exec:'ip netns exec protected-%i socat STDIO tcp-connect\:127.0.0.1\:8000',nofork