github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4122] firefox: How to specify proxy servers with --x11=xpra? #2544

New issue

Open

opened 2026-05-05 09:13:09 -06:00 by gitea-mirror · 9 comments

gitea-mirror commented

2026-05-05 09:13:09 -06:00

Owner

Originally created by @muziker on GitHub (Mar 21, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4122

With xpra running, how do i specify proxy servers for firefox to use? It seems like the environment variables aren't available to xpra, so firefox is unable to connect to proxy servers.

Originally created by @muziker on GitHub (Mar 21, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4122 With xpra running, how do i specify proxy servers for firefox to use? It seems like the environment variables aren't available to xpra, so firefox is unable to connect to proxy servers.

gitea-mirror added the

information_old

networking

labels 2026-05-05 09:13:09 -06:00

gitea-mirror commented

2026-05-05 09:13:11 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 21, 2021):

Firefox' proxy settings can be found at about:preferences -> General -> Network Settings -> Settings -> Configure Proxy Access to the Internet. You can also set environment variables in firejail profiles with env KEY=VALUE.

@rusty-snake commented on GitHub (Mar 21, 2021): Firefox' proxy settings can be found at about:preferences -> General -> Network Settings -> Settings -> Configure Proxy Access to the Internet. You can also set environment variables in firejail profiles with `env KEY=VALUE`.

gitea-mirror commented

2026-05-05 09:13:12 -06:00

Author

Owner

@muziker commented on GitHub (Mar 22, 2021):

But, for example, if i use --net=eth2 with --ip=192.168.0.3/24 , should there be additional tweaks to the routing table to get networking to work? I had assumed any hosts on the same segment would be addressable, but the host address on the same machine 192.168.0.2 is non reachable. I've sysctl enabled ip forwarding, arp proxy and the host has no firewall rules.

@muziker commented on GitHub (Mar 22, 2021): But, for example, if i use --net=eth2 with --ip=192.168.0.3/24 , should there be additional tweaks to the routing table to get networking to work? I had assumed any hosts on the same segment would be addressable, but the host address on the same machine 192.168.0.2 is non reachable. I've sysctl enabled ip forwarding, arp proxy and the host has no firewall rules.

gitea-mirror commented

2026-05-05 09:13:13 -06:00

Author

Owner

@muziker commented on GitHub (Mar 22, 2021):

Should the ip masquerading be enabled for this host to use xpra and getting firefox to use a proxy server?

@muziker commented on GitHub (Mar 22, 2021): Should the ip masquerading be enabled for this host to use xpra and getting firefox to use a proxy server?

gitea-mirror commented

2026-05-05 09:13:14 -06:00

Author

Owner

@matu3ba commented on GitHub (Mar 22, 2021):

Depends on what is in your netfilter-default /etc/iptables.iptables.rules. See firejail.config for more information or tweak --net options. It feels very wrong to use a network filter that maps back to localhost.

Why are you using the netfilter option, when you access localhost?

@matu3ba commented on GitHub (Mar 22, 2021): Depends on what is in your `netfilter-default /etc/iptables.iptables.rules`. See firejail.config for more information or tweak `--net` options. It feels very wrong to use a network filter that maps back to localhost. Why are you using the netfilter option, when you access localhost?

gitea-mirror commented

2026-05-05 09:13:15 -06:00

Author

Owner

@ckorder commented on GitHub (Mar 23, 2021):

@rusty-snake would it be possible to implement something like proxychains4 support, currently the usage with proxychains is sadly not working.

@ckorder commented on GitHub (Mar 23, 2021): @rusty-snake would it be possible to implement something like [proxychains4](https://packages.debian.org/buster/proxychains4) support, currently the usage with proxychains is sadly not working.

gitea-mirror commented

2026-05-05 09:13:17 -06:00

Author

Owner

@muziker commented on GitHub (Mar 23, 2021):

Once the --net is specified, the program is run not in the system network namespace. So to access a tcp socket endpoint on the host, should there be further configuration of iptables or routes? It seems like the --net= is implemented as a macvlan. Unfortunately from the host, it doesn't seem possible to view any of the new interfaces. So commands like ip netns don't show any of the interfaces, making it difficult to tweak them to bridge the interfaces.

@muziker commented on GitHub (Mar 23, 2021): Once the --net is specified, the program is run not in the system network namespace. So to access a tcp socket endpoint on the host, should there be further configuration of iptables or routes? It seems like the --net=<interface> is implemented as a macvlan. Unfortunately from the host, it doesn't seem possible to view any of the new interfaces. So commands like ip netns don't show any of the interfaces, making it difficult to tweak them to bridge the interfaces.

gitea-mirror commented

2026-05-05 09:13:17 -06:00

Author

Owner

@muziker commented on GitHub (Mar 23, 2021):

lsns -n -t net | awk '{print$4}' | while read a ; do B=nsenter -t "$a" -n ip a ; echo "$a $B" ; done

A quick way to enumerate interfaces in each net namespace. ln -sT /proc//ns/net /var/run/netns/ to allow ip netns to exec in that namespace context. But unfortunately the bridge utils and iproute2 bridge commands don't seem to work

@muziker commented on GitHub (Mar 23, 2021): lsns -n -t net | awk '{print$4}' | while read a ; do B=`nsenter -t "$a" -n ip a ` ; echo "$a $B" ; done A quick way to enumerate interfaces in each net namespace. ln -sT /proc/<pid>/ns/net /var/run/netns/<pid> to allow ip netns to exec in that namespace context. But unfortunately the bridge utils and iproute2 bridge commands don't seem to work

gitea-mirror commented

2026-05-05 09:13:18 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 23, 2021):

TBH I've no knowledge of the networking features but you can give --net a bridge interface

--net=bridge_interface
Enable a new network namespace and connect it to this bridge interface. Unless specified with option --ip and
--defaultgw, an IP address and a default gateway will be assigned automatically to the sandbox. The IP address is
verified using ARP before assignment. The address configured as default gateway is the bridge device IP address.
Up to four --net options can be specified.

Example:
 $ sudo brctl addbr br0
 $ sudo ifconfig br0 10.10.20.1/24
 $ sudo brctl addbr br1
 $ sudo ifconfig br1 10.10.30.1/24
 $ firejail --net=br0 --net=br1

@rusty-snake commented on GitHub (Mar 23, 2021): TBH I've no knowledge of the networking features but you can give `--net` a bridge interface > **--net=bridge_interface** > Enable a new network namespace and connect it to this bridge interface. Unless specified with option `--ip` and > `--defaultgw`, an IP address and a default gateway will be assigned automatically to the sandbox. The IP address is > verified using ARP before assignment. The address configured as default gateway is the bridge device IP address. > Up to four `--net` options can be specified. > > Example: > ``` > $ sudo brctl addbr br0 > $ sudo ifconfig br0 10.10.20.1/24 > $ sudo brctl addbr br1 > $ sudo ifconfig br1 10.10.30.1/24 > $ firejail --net=br0 --net=br1 > ```

gitea-mirror commented

2026-05-05 09:13:18 -06:00

Author

Owner

@muziker commented on GitHub (Mar 24, 2021):

I found the --netns=, and i did this ip netns add fire, but invoking with --net=eth0 and --netns=fire didn't cause firefox to appear. In any case, i'm wondering why the --net=eth0 creating a macvlan doesn't generate a corresponding namespace that ip netns can handle.

@muziker commented on GitHub (Mar 24, 2021): I found the --netns=<net namespace>, and i did this `ip netns add fire`, but invoking with --net=eth0 and --netns=fire didn't cause firefox to appear. In any case, i'm wondering why the --net=eth0 creating a macvlan doesn't generate a corresponding namespace that ip netns can handle.

gitea-mirror referenced this issue

2026-05-05 10:19:16 -06:00

[PR #2544] [MERGED] Alphabetical ordering of firecfg.config #4394

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2544

No description provided.

Rows
Columns