90 lines
2.1 KiB
Markdown
90 lines
2.1 KiB
Markdown
# namespaced-openvpn setup
|
|
|
|
Network namespace isolated VPN
|
|
|
|
## Install
|
|
|
|
``` bash
|
|
|
|
cd /opt
|
|
git clone https://github.com/slingamn/namespaced-openvpn.git
|
|
cd namespaced-openvpn
|
|
make install
|
|
|
|
/usr/local/sbin/namespaced-openvpn --config /etc/openvpn/chicago.conf --auth-user-pass /etc/openvpn/auth.txt
|
|
|
|
ip netns list
|
|
|
|
ip netns exec protected links http://ifconfig.co
|
|
|
|
```
|
|
|
|
## namespaced-openvpn systemd services
|
|
|
|
``` bash
|
|
|
|
cat > /etc/systemd/system/namespaced-openvpn.service <<EOF
|
|
# This service is actually a systemd target,
|
|
# but we are using a service since targets cannot be reloaded.
|
|
|
|
[Unit]
|
|
Description=OpenVPN service in netns
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/bin/true
|
|
ExecReload=/bin/true
|
|
WorkingDirectory=/etc/openvpn
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
|
|
cat > /etc/systemd/system/namespaced-openvpn@.service <<EOF
|
|
[Unit]
|
|
Description=OpenVPN connection to %i in netns=protected-%i
|
|
PartOf=namespaced-openvpn.service
|
|
ReloadPropagatedFrom=openvpn.service
|
|
Before=systemd-user-sessions.service
|
|
|
|
[Service]
|
|
PrivateTmp=true
|
|
KillMode=mixed
|
|
Type=simple
|
|
Restart=always
|
|
ExecStart=/usr/local/sbin/namespaced-openvpn --config %i.conf --namespace protected-%i
|
|
PIDFile=/run/namespaced-openvpn/%i.pid
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
WorkingDirectory=/etc/openvpn
|
|
# Likely need CAP_SYS_ADMIN -- disable bounding for now
|
|
#ProtectSystem=yes
|
|
#CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
|
|
#LimitNPROC=10
|
|
#DeviceAllow=/dev/null rw
|
|
#DeviceAllow=/dev/net/tun rw
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable namespaced-openvpn@toronto
|
|
systemctl restart namespaced-openvpn@toronto
|
|
journalctl -fu namespaced-openvpn@toronto
|
|
|
|
ip netns list # Should see protected-toronto
|
|
|
|
```
|
|
|
|
## Service bridging
|
|
|
|
``` bash
|
|
|
|
/usr/bin/socat tcp-listen:8000,fork,reuseaddr \
|
|
exec:'ip netns exec protected-%i socat STDIO tcp-connect\:127.0.0.1\:8000',nofork
|
|
|
|
```
|