nordvpn.com [debian] OpenVPN in a Network Namespace

zilexa

I only want certain applications to connect to the outside world via OpenVPN, while my normal traffic does not go via VPN.
I have searched a lot and found the best possible way: creating a separate Network Namespace and running OpenVPN within. Launching the applications within this namespace.

I found this how to (scroll to the bottom) but a few things are still unclear to me. I am qouting that final post at the bottom:

You can start the OpenVPN link inside a namespace and then run every command you want to use that OpenVPN link inside the namespace. Details on how to do it (not my work) here: http://www.naju.se/articles/openvpn-netns.html
The idea is to provide a custom script to carry out the up and route-up phases of the OpenVPN connection inside a specific namespace instead of the global one. I quote from the above link just in case it goes offline in the future:

[1] First create an --up script for OpenVPN. This script will create the VPN tunnel interface inside a network namespace called vpn, instead of the default namespace.

$ cat > netns-up << EOF
#!/bin/sh
case $script_type in
        up)
                ip netns add vpn
                ip netns exec vpn ip link set dev lo up
                mkdir -p /etc/netns/vpn
                echo "nameserver 8.8.8.8" > /etc/netns/vpn/resolv.conf
                ip link set dev "$1" up netns vpn mtu "$2"
                ip netns exec vpn ip addr add dev "$1" \
                        "$4/${ifconfig_netmask:-30}" \
                        ${ifconfig_broadcast:+broadcast "$ifconfig_broadcast"}
                test -n "$ifconfig_ipv6_local" && \
          ip netns exec vpn ip addr add dev "$1" \
                        "$ifconfig_ipv6_local"/112
                ;;
        route-up)
                ip netns exec vpn ip route add default via "$route_vpn_gateway"
                test -n "$ifconfig_ipv6_remote" && \
          ip netns exec vpn ip route add default via \
                        "$ifconfig_ipv6_remote"
                ;;
        down)
                ip netns delete vpn
                ;;
esac
EOF

[2] Then start OpenVPN and tell it to use our --up script instead of executing ifconfig and route.

openvpn --ifconfig-noexec --route-noexec --up netns-up --route-up netns-up --down netns-up

[3] Now you can start programs to be tunneled like this:

ip netns exec vpn command

[4] The only catch is that you need to be root to invoke ip netns exec ... and maybe you do not want your application to run as root. The solution is simple:

sudo ip netns exec vpn sudo -u $(whoami) command

[/i]

The problems I am having with this method:

PROBLEM 1: When I try to run the openvpn command which calls the netns-up script, I get two errors:

~$ sudo openvpn --ifconfig-noexec --route-noexec --up netns-up --route-up netns-up --down netns-up
Options error: --up script fails with 'netns-up': Permission denied
Options error: Please correct this error.
Use --help for more information.

I tried re-creating the netns-up script with and without sudo but it didn't help. What am I doing wrong?

PROBLEM 2: Also, I assume this command is not complete because I also need to point to a .ovpn file... but I have no idea how to add that to the command?

I hope someone who is less noob can shed some light on this.

Traffic

zilexa wrote$ sudo openvpn --ifconfig-noexec --route-noexec --up netns-up --route-up runners-up --down runners-up
Options error: --up script fails with 'netns-up': Permission denied

perhaps you have forgotten the executable bit ?

zilexa wrotePROBLEM 2: Also, I assume this command is not complete because I also need to point to a .ovpn file... but I have no idea how to add that to the command?

Like so:

sudo openvpn --config config.conf --ifconfig-noexec --route-noexec --up netns-up --route-up runners-up --down runners-up

but this all sounds way too complicated ..

zilexa

Yes my mistake, I've come a lot further.

Goal: on my Raspberry Pi2, I have 2 programs running (Flexget and Transmission) that should always go via OpenVPN. Any other program (including Kodi media center) should just work as default, not via VPN. Using a network namespace seems the easiest way to do this.

so I made the script executable, I modified the command to start OpenVPN and I removed a typo from the netns-up script (the script contained the text "EOF" at the end which it should not, but I copied it from the internet, my mistake).

This is the result:

:/etc/openvpn$ sudo openvpn --ifconfig-noexec --route-noexec --up netns-up --route-up netns-up --down netns-up --config za1.nordvpn.com.tcp443.ovpn
(..)

Tue Mar 22 00:10:56 2016 [vpn-za.nordvpn.com] Peer Connection Initiated with [AF_INET]154.127.61.142:443
Tue Mar 22 00:10:59 2016 SENT CONTROL [vpn-za.nordvpn.com]: 'PUSH_REQUEST' (status=1)
Tue Mar 22 00:10:59 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 78.46.223.24,dhcp-option DNS 162.242.211.137,route 10.7.7.1,topology net30,ping 5,ping-restart 30,ifconfig 10.7.7.102 10.7.7.101'
Tue Mar 22 00:10:59 2016 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 22 00:10:59 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 22 00:10:59 2016 OPTIONS IMPORT: route options modified
Tue Mar 22 00:10:59 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Mar 22 00:10:59 2016 ROUTE_GATEWAY 192.168.1.254/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:39:7e:46
Tue Mar 22 00:10:59 2016 TUN/TAP device tun0 opened
Tue Mar 22 00:10:59 2016 TUN/TAP TX queue length set to 100
Tue Mar 22 00:10:59 2016 netns-up tun0 1500 1592 10.7.7.102 10.7.7.101 init
Tue Mar 22 00:10:59 2016 WARNING: Failed running command (--up/--down): external program exited with error status: 1
Tue Mar 22 00:10:59 2016 Exiting due to fatal error

Now I have absolutely no idea why it fails.

zilexa

I am shocked this topic is not gaining any traction. For example, if you use torrent clients on your NAS or media center device (like a Raspberry Pi 2 or 3), something A LOT of people do, you want specific apps to go through VPN, others should just bypass VPN. They don't need it, and their speed would drop if they do go through VPN.

To debug further, I executed the commands in the UP case one by one. 1 command showed me the "how to use this command" text, a sign that the command is incorrect:

sudo ip link set dev "$1" up netns vpn mtu "$2"

This is the entire script:

#!/bin/sh
case $script_type in
        up)
                ip netns add vpn
                ip netns exec vpn ip link set dev lo up
                mkdir -p /etc/netns/vpn
                echo "nameserver 8.8.8.8" > /etc/netns/vpn/resolv.conf
                ip link set dev "$1" up netns vpn mtu "$2"
                ip netns exec vpn ip addr add dev "$1" \
                        "$4/${ifconfig_netmask:-30}" \
                        ${ifconfig_broadcast:+broadcast "$ifconfig_broadcast"}
                test -n "$ifconfig_ipv6_local" && \
          ip netns exec vpn ip addr add dev "$1" \
                        "$ifconfig_ipv6_local"/112
                ;;
        route-up)
                ip netns exec vpn ip route add default via "$route_vpn_gateway"
                test -n "$ifconfig_ipv6_remote" && \
          ip netns exec vpn ip route add default via \
                        "$ifconfig_ipv6_remote"
                ;;
        down)
                ip netns delete vpn
                ;;
esac

Any help would be greatly appreciated.