Inspired by Austin Adams blog: https://austinjadams.com/blog/running-select-applications-through-openvpn/ And the NSDO tool he created: https://github.com/ausbin/nsdo His blog guide, if correctly interpreted, makes it extremely easy to run only specific applications through OpenVPN. After some configuring (explained in his blog and step by step below), you can simply execute any application via nsdo to make it run via OpenVPN! :D I have had this working in the past but now I have a clean Debian STRETCH install and need some assistance from experts. The steps according to his blog: [list=1] [*] Create '/etc/systemd/system/openvpn@.service.d/netns.conf': [code][Unit] Requires=netns@%i.service After=netns@%i.service [Service] # Needed to call setns() as ip netns does CapabilityBoundingSet=CAP_SYS_ADMIN[/code] [*] Create '/etc/systemd/system/netns@.service': [code][Unit] Description=network namespace %I [Service] Type=oneshot ExecStart=/bin/ip netns add %I ExecStop=/bin/ip netns del %I RemainAfterExit=yes[/code] [*] Make sure this part is in your openvpn.conf file (for example '/etc/openvpn/abc.conf'): [code]# ... # (my other configuration) # ... # script should run `ip`, not openvpn route-noexec ifconfig-noexec up "/usr/local/bin/vpn-ns" route-up "/usr/local/bin/vpn-ns" script-security 2[/code] [*] Create the "magic" file '/usr/local/bin/vpn-ns' and make it executable via chmod +x vpn-ns: [code]#!/bin/bash # based heavily on http://naju.se/articles/openvpn-netns [[ $EUID -ne 0 ]] && { echo "$0: this program requires root privileges. try again with 'sudo'?" >&2 exit 1 } # convert a dot-decimal mask (e.g., 255.255.255.0) to a bit-count mask # (like /24) for iproute2. this probably isn't the most beautiful way. tobitmask() { bits=0 while read -rd . octet; do (( col = 2**7 )) while (( col > 0 )); do (( octet & col )) || break 2 (( bits++ )) (( col >>= 1 )) done done

[code]WARNING: Failed running command (--route-up): external program exited with error status: 2[/code]Probably due to no $PATH I don't know about your systemd settings and I cannot support these: [quote=jazco post_id=76271 time=1516572456 user_id=43082] Inspired by Austin Adams blog: https://austinjadams.com/blog/running-s ... h-openvpn/ And the NSDO tool he created: https://github.com/ausbin/nsdo [/quote]Try asking the author ..

Your server log: [quote=TinCanTech post_id=76289 time=1516631651 user_id=37053] [code]WARNING: Failed running command (--route-up): external program exited with error status: 2[/code]Probably due to no $PATH [/quote]Does the script run outside of openvpn with acceptable errors? For example: Within openvpn ip will require path to /bin

Pff can't believe I didn't try that yet. [code] osmc@osmc:~$ sudo bash /usr/local/bin/vpn-ns /usr/local/bin/vpn-ns: unknown $script_type: '' [/code] I guess I have to figure out what the value of each of these variables should be, like eth0 or tun0 etc..

OpenVPN for specific applications via Network Namespace - almost working

jazco

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

Openvpn does not provide env for spawned process. (eg. PATH)

jazco

Ok I know what environment variables are, but don't know how it applies to this situation.

Do you mean the variables in this part need to be fully written out? for example "/etc/systemd/system/openvpn@.service.d/netns.conf'" instead of basename%.conf in this part:

# guess name of network namespace from name of config file
basename="$(basename "$config")"
ns="${basename%.conf}"
netmask="$(tobitmask "$route_netmask_1")"

? My apologies for the dumb question..

TinCanTech

WARNING: Failed running command (--route-up): external program exited with error status: 2

Probably due to no $PATH

I don't know about your systemd settings and I cannot support these:

jazco wrote Inspired by Austin Adams blog:
https://austinjadams.com/blog/running-s ... h-openvpn/

And the NSDO tool he created:
https://github.com/ausbin/nsdo

Try asking the author ..

jazco

I did, he helped me a lot figuring out some differences between his Linux distro and Debian Stretch but doesn't know how to solve this either.

TinCanTech

Your server log:

TinCanTech wrote

WARNING: Failed running command (--route-up): external program exited with error status: 2

Probably due to no $PATH

Does the script run outside of openvpn with acceptable errors?

For example: Within openvpn ip will require path to /bin

jazco

Pff can't believe I didn't try that yet.

osmc@osmc:~$ sudo bash /usr/local/bin/vpn-ns
/usr/local/bin/vpn-ns: unknown $script_type: ''

I guess I have to figure out what the value of each of these variables should be, like eth0 or tun0 etc..

TinCanTech

Perhaps this will help:
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage#lbAV