I have squid proxy installed on my ubuntu server, it works under default configuration. I also have network namespace proxy1 with openvpn running inside (I use script like this one for setting up network namespace, http://www.naju.se/articles/openvpn-netns.html, and then run ip netns exec proxy1 openvpn --daemon..)

Is it possible to run squid so that it will use vpn connection running in specified network namespace as it's tcp_outgoing_something?

Ideally I would like to have several vpn connections at once in distinct namespaces, for example usa vpn in usaNamespace and germany vpn in germanyNamespace and for each define specific port so that myproxyserver:usaPort will use usa vpn and myproxyserver:germanyPort will use germany vpn. Is it possible?


It would be possible to run squid in your network namespace if systemd allowed running processes in named network namespaces. See https://github.com/systemd/systemd/issues/2741, it looks like that is a won't fix. However, there are some workarounds listed there.

Alternatively you can run squid in the default network namespace and use tcp_outgoing_address set to the IP address of a tunnel into your net namespace. Then use policy routing (ip rule) to set the default route via the vpn/ network namespace for traffic originating from that IP address.

You don't actually need a network namespace at all; as long as your vpn does not replace your main default route, you can use policy routing to set a default route via the VPN for traffic that comes from your IP address on the vpn. This works well if you have the same IP address every time on the VPN.


systemctl start openvpn

edit /etc/iproute2/rt_tables:

101     vpn1 


ip route add default via table vpn1 (# where is the remote gateway IP on the VPN)
ip rule add from lookup vpn1 (# where is the local IP address on the VPN)

edit /etc/squid3/squid.conf:

tcp_outgoing_address [[!]aclname] ...

(Use squid acls to select the traffic you want to go via the VPN).

You can use the same technique with a named network namespace, which allows this to work even in the local and remote IP addresses on the VPN change. In that case you need to set up nat/masquerading in the namespace, and a tunnel between the default namespace and the VPN namespace. In this case, then tunnel will have static IP addresses that you assign, so that will work around the dynamic IP addresses assigned by the VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.