[GH-ISSUE #2416] How to sandbox --net X11 browser over OpenVPN / Wireguard with Firejail #1610

New issue

Open

opened 2026-05-05 08:16:02 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:16:02 -06:00

Owner

Originally created by @rugabunda on GitHub (Feb 18, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2416

Whether one is running a VPN at the router, or local machine then there is a problem with Firejail's --net= command, and some necessary parameters must be laid out. In my router, only designated IPs on the local subnet may connect through the VPN. If one is running a VPN on the local machine, command --net results in firejail creating an alternate adapter that connects over a randomly generated IP on the local subnet. Given the IP is non static, this IP will operate out of the secure confines of a VPN operating on the router. The same can be said for a local machine VPN because the VPN runs souly over a designated adapter. Ok, so you run firejail --net=eth0 --ip=192.168.1.207 firefox for example... but

How do I get firejail --net command to work over VPN running directly on a local machine? I have tried this for my wireguard adapter: firejail --net=wireguardvpn --ip=192.168.1.20 I receive the error "the software is not supported for /31 networks.

Also, using --net command on my adapter breaks all internet connectivity for the app, if it is pointing to the designated VPN IP on my local subnet, it is not able to connect to the internet. I am using the correct ethernet name.

In this instance, I am using the new VPN standard known as wireguard. This is not currently compatible with my router hardware. If firejail could generate an adapter that uses a static IP, and that IP can be set to use 'wireguard' vpn, then there are no problems. How can I accomplish this, or better methods?

Thank you.

Originally created by @rugabunda on GitHub (Feb 18, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2416 Whether one is running a VPN at the router, or local machine then there is a problem with Firejail's --net= command, and some necessary parameters must be laid out. In my router, only designated IPs on the local subnet may connect through the VPN. If one is running a VPN on the local machine, command --net results in firejail creating an alternate adapter that connects over a randomly generated IP on the local subnet. Given the IP is non static, this IP will operate out of the secure confines of a VPN operating on the router. The same can be said for a local machine VPN because the VPN runs souly over a designated adapter. Ok, so you run `firejail --net=eth0 --ip=192.168.1.207 firefox` for example... but How do I get firejail --net command to work over VPN running directly on a local machine? I have tried this for my wireguard adapter: `firejail --net=wireguardvpn --ip=192.168.1.20` I receive the error "the software is not supported for /31 networks. Also, using `--net` command on my adapter breaks all internet connectivity for the app, if it is pointing to the designated VPN IP on my local subnet, it is not able to connect to the internet. I am using the correct ethernet name. In this instance, I am using the new VPN standard known as wireguard. This is not currently compatible with my router hardware. If firejail could generate an adapter that uses a static IP, and that IP can be set to use 'wireguard' vpn, then there are no problems. How can I accomplish this, or better methods? Thank you.

gitea-mirror added the

networking

label 2026-05-05 08:16:02 -06:00

gitea-mirror commented

2026-05-05 08:16:04 -06:00

Author

Owner

@rugabunda commented on GitHub (Feb 18, 2019):

Updated with,

Also, using --net command on my adapter breaks all internet connectivity for the app, if it is pointing to the designated VPN IP on my local subnet, it is not able to connect to the internet. I am using the correct ethernet name.

@rugabunda commented on GitHub (Feb 18, 2019): Updated with, > Also, using --net command on my adapter breaks all internet connectivity for the app, if it is pointing to the designated VPN IP on my local subnet, it is not able to connect to the internet. I am using the correct ethernet name.

gitea-mirror commented

2026-05-05 08:16:05 -06:00

Author

Owner

@rugabunda commented on GitHub (Feb 18, 2019):

Strange, I am no longer able to connect to the net even without a designated ip using --net=eth0 whether the local wireguard tunnel is up or down.

"Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 32385, child pid 32386

Interface MAC IP Mask Status
lo 127.0.0.1 255.0.0.0 UP
eth0-32385 32:92:39:60:68:b3 192.168.1.82 255.255.255.0 UP
Default gateway 192.168.1.1"

@rugabunda commented on GitHub (Feb 18, 2019): Strange, I am no longer able to connect to the net even without a designated ip using --net=eth0 whether the local wireguard tunnel is up or down. > > "Reading profile /etc/firejail/whitelist-var-common.inc > Parent pid 32385, child pid 32386 > > Interface MAC IP Mask Status > lo 127.0.0.1 255.0.0.0 UP > eth0-32385 32:92:39:60:68:b3 192.168.1.82 255.255.255.0 UP > Default gateway 192.168.1.1"

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1610

No description provided.

Rows
Columns