github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1978] Add support for ipvlan interfaces #1327

New issue

Closed

opened 2026-05-05 07:52:15 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 07:52:15 -06:00

Owner

Originally created by @ValdikSS on GitHub (Jun 4, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1978

Firejail adds new macvlan interface when --net option is specified. While macvlan is a best choice for Ethernet interfaces, it doesn't work with 802.11 Wi-Fi.
Right now there's no easy way to use Wi-Fi with Firejail. Documentation describes routed setup, which @netblue30 recommends to use in #1600.
Linux kernel contains another interface driver which is very similar to macvlan and works with Wi-Fi: ipvlan. Contrary to macvlan, it shares the same MAC address as the master interface, which allows it to be used with 802.11.

@netblue30, is it possible to auto-detect interface type and use either macvlan for Ethernet and ipvlan for 802.11?

Here's how you can create this interface and use it in Firejail:

sudo ip link add link wlp3s0 firewifi type ipvlan mode l2; sudo ip link set firewifi up; sudo ip addr add 192.168.0.199/24 dev firewifi
firejail --interface=firewifi --noprofile

Originally created by @ValdikSS on GitHub (Jun 4, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1978 Firejail adds new macvlan interface when `--net` option is specified. While macvlan is a best choice for Ethernet interfaces, it doesn't work with 802.11 Wi-Fi. Right now there's no easy way to use Wi-Fi with Firejail. Documentation describes routed setup, which @netblue30 recommends to use in #1600. Linux kernel contains another interface driver which is very similar to macvlan and works with Wi-Fi: ipvlan. Contrary to macvlan, it shares the same MAC address as the master interface, which allows it to be used with 802.11. @netblue30, is it possible to auto-detect interface type and use either macvlan for Ethernet and ipvlan for 802.11? Here's how you can create this interface and use it in Firejail: ``` sudo ip link add link wlp3s0 firewifi type ipvlan mode l2; sudo ip link set firewifi up; sudo ip addr add 192.168.0.199/24 dev firewifi firejail --interface=firewifi --noprofile ```

gitea-mirror closed this issue

2026-05-05 07:52:16 -06:00

gitea-mirror commented

2026-05-05 07:52:20 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 4, 2018):

Let me give it a try, thanks for the idea!

@netblue30 commented on GitHub (Jun 4, 2018): Let me give it a try, thanks for the idea!

gitea-mirror commented

2026-05-05 07:52:21 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 12, 2018):

All in mainline, you can try it out, in your case:

$ firejail --net=wlp3s0 firefox

@netblue30 commented on GitHub (Jun 12, 2018): All in mainline, you can try it out, in your case: ````` $ firejail --net=wlp3s0 firefox `````

gitea-mirror commented

2026-05-05 07:52:23 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 9, 2018):

Hmm, I tried something as simple as firejail --noprofile --net=wlp60s0 and wasn't able to connect with the outside world. Trying to ping a host would resolve but time out with destination unreachable. Am I doing something wrong? Is there some extra preparation that needs to happen for this to work properly?

@chiraag-nataraj commented on GitHub (Jul 9, 2018): Hmm, I tried something as simple as `firejail --noprofile --net=wlp60s0` and wasn't able to connect with the outside world. Trying to ping a host would resolve but time out with destination unreachable. Am I doing something wrong? Is there some extra preparation that needs to happen for this to work properly?

gitea-mirror commented

2026-05-05 07:52:25 -06:00

Author

Owner

@ValdikSS commented on GitHub (Jul 18, 2018):

@netblue30 it indeed doesn't work for some reason. It doesn't add default route, but adding it manually does not fix the issue. Are you sure you set up ipvlan of type l2?

@ValdikSS commented on GitHub (Jul 18, 2018): @netblue30 it indeed doesn't work for some reason. It doesn't add default route, but adding it manually does not fix the issue. Are you sure you set up ipvlan of `type l2`?

gitea-mirror commented

2026-05-05 07:52:27 -06:00

Author

Owner

@ValdikSS commented on GitHub (Jul 18, 2018):

@netblue30 I can't see where IPVLAN_MODE_L2 is defined. It looks like there are no changes to automake/autoconf, and nobody defines it.

@ValdikSS commented on GitHub (Jul 18, 2018): @netblue30 I can't see where `IPVLAN_MODE_L2` is defined. It looks like there are no changes to automake/autoconf, and nobody defines it.

gitea-mirror commented

2026-05-05 07:52:28 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 24, 2018):

Something didn't got merged! Let me take a look, thanks!

@netblue30 commented on GitHub (Jul 24, 2018): Something didn't got merged! Let me take a look, thanks!

gitea-mirror commented

2026-05-05 07:52:29 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 25, 2018):

Should be all fixed now: b78cc58693

@netblue30 commented on GitHub (Jul 25, 2018): Should be all fixed now: https://github.com/netblue30/firejail/commit/b78cc5869307ddb93a7b1795af992356a54d1d21

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1327

No description provided.

Rows
Columns