I've finally set up the netns veth openvpn connection that works, made overrides to systemd service files so openvpn depended on netns single shot service and tor of openvpn service. Tor works, at least by its logs it is, but I can't access it. My current netns-vpn.service file is:

# netns
ExecStartPre=-ip netns delete openvpn
ExecStartPre= ip netns add openvpn

# links
ExecStartPre=ip link add vpn0 type veth peer name vpn1
ExecStartPre=ip link set vpn1 netns openvpn

# set links and localhost for vpn
ExecStartPre=ip            link set dev vpn0 up
ExecStartPre=ip -n openvpn link set dev   lo up
ExecStartPre=ip -n openvpn link set dev vpn1 up

# assign ips to them, and loop traffic from vpn1 to vpn0
ExecStartPre=ip            addr  add dev vpn0
ExecStartPre=ip -n openvpn addr  add dev vpn1
ExecStartPre=ip -n openvpn route add default via

# port forwarding
ExecStartPre=iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 9049 -j DNAT --to-destination
ExecStartPre=iptables -t nat -A PREROUTING -p udp -i eth0 --dport 9049 -j DNAT --to-destination
ExecStartPre=iptables -A FORWARD -p tcp -d --dport 9049 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
ExecStartPre=iptables -A FORWARD -p udp -d --dport 9049 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# packet forwarding from eth0 to vpn0 and back
ExecStartPre=iptables -A FORWARD -i eth0 -o vpn0 -j ACCEPT
ExecStartPre=iptables -A FORWARD -o eth0 -i vpn0 -j ACCEPT

# idk
ExecStartPre=iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

the port forwarding part doesn't work for socks5 proxy. From what I gathered I need to use filters or -A OUTPUT, but I can't find an example with network namespaces and socks5 proxy to make sense of it. It's all new to me. Tcp forwarding works, tested it with python http.server, I guess udp should too. I'm not looking for socat or any other proxy across namespaces solution.

  • I'm not sure I'm sure grasping what you're trying to do, but if you're just trying to connect a client in one netns to a port in another, the veth is enough, IP forwarding isn't adding anything, you're not even enabling IP forwarding in the kernel. Also assigning to an interface smells weird to me, I would make it<--> Dec 5 at 13:28


You must log in to answer this question.

Browse other questions tagged .