[GH-ISSUE #1814] --interface option does not work for tun interfaces #1233

New issue

Open

opened 2026-05-05 07:41:51 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 07:41:51 -06:00

Owner

Originally created by @Boyardism on GitHub (Mar 13, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1814

expected behavior
firejail --interface=tun4 --noprofile --dns=85.214.20.141 /bin/bash

would create a sandbox with network traffic going through the tun interface until tun is torn down or something

Actual behavior: the tun does get brought into sandbox, but no traffic can go through the tun interface (nothing can be pinged, curled or wget from inside
I am aware of https://github.com/netblue30/firejail/issues/59 but thought that it only applies to --net= option.

P.S.:
I suspect that the result I want (traffic to/from the sandbox goes only through a particularly named tun (tun4) interface, applications out of sandbox remain un-affected and don't go through that particular tun4 interface) can probably be achieved via a combination of static routes, iptables rules and bridged interface (analogously to "routed bridge interfaces" from firejail tutorial) but I am not sure how to achieve that.

I am not very good with routing and environment with >1 tun interface (each set up automatically) is a bit above my linux-knowledge (in fact, I wanted to use firejail as an "easy" substitute for actually setting up the correct routes)

Originally created by @Boyardism on GitHub (Mar 13, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1814 expected behavior firejail --interface=tun4 --noprofile --dns=85.214.20.141 /bin/bash would create a sandbox with network traffic going through the tun interface until tun is torn down or something Actual behavior: the tun does get brought into sandbox, but no traffic can go through the tun interface (nothing can be pinged, curled or wget from inside I am aware of https://github.com/netblue30/firejail/issues/59 but thought that it only applies to --net= option. P.S.: I suspect that the result I want (traffic to/from the sandbox goes only through a **particularly named** tun (tun4) interface, applications out of sandbox remain un-affected and don't go through that particular tun4 interface) can probably be achieved via a combination of static routes, iptables rules and bridged interface (analogously to "routed bridge interfaces" from firejail tutorial) but I am not sure how to achieve that. I am not very good with routing and environment with >1 tun interface (each set up automatically) is a bit above my linux-knowledge (in fact, I wanted to use firejail as an "easy" substitute for actually setting up the correct routes)

gitea-mirror added the

enhancement

label 2026-05-05 07:41:51 -06:00

gitea-mirror commented

2026-05-05 07:41:55 -06:00

Author

Owner

@netblue30 commented on GitHub (Mar 14, 2018):

It is not supported in this moment. I guess we also need to bring in the sandbox the programs handling the tun (or tap) interface, just a guess. We'll try to fix it.

@netblue30 commented on GitHub (Mar 14, 2018): It is not supported in this moment. I guess we also need to bring in the sandbox the programs handling the tun (or tap) interface, just a guess. We'll try to fix it.

gitea-mirror commented

2026-05-05 07:41:57 -06:00

Author

Owner

@Boyardism commented on GitHub (Mar 24, 2018):

@netblue30 yes, it seems it needs whole VPN program in the sandbox as well.

BTW, running the tun interface setup script from inside the jail worked perfectly (thanks for pointer!)

Now I guess I need some help understanding routing (both in general and in context of firejail :) ) but that's another issue

@Boyardism commented on GitHub (Mar 24, 2018): @netblue30 yes, it seems it needs whole VPN program in the sandbox as well. BTW, running the tun interface setup script from inside the jail worked perfectly (thanks for pointer!) Now I guess I need some help understanding routing (both in general and in context of firejail :) ) but that's another issue

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1233

No description provided.

Rows
Columns