[GH-ISSUE #403] Change iptables rules

gitea-mirror commented

2026-05-05 05:32:29 -06:00

Owner

Originally created by @nick75e on GitHub (Apr 1, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/403

iptables rules can only be set when starting a sandbox.
Is it possible to have an option to load a different config file while a sandbox is running.

Thanks.

Originally created by @nick75e on GitHub (Apr 1, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/403 `iptables` rules can only be set when starting a sandbox. Is it possible to have an option to load a different config file while a sandbox is running. Thanks.

gitea-mirror added the

enhancement

label 2026-05-05 05:32:29 -06:00

gitea-mirror commented

2026-05-05 05:32:32 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 2, 2016):

Use --join-network. It is very flexible, you can do much more than changing netfilter, you can also change IP addresses, add interfaces etc. Example:

# start firefox
$ firejail --net=eth0 --name=browser firefox &

# change netfilter configuration
$ sudo firejail --join-network=browser "cat /etc/firejail/nolocal.net | /sbin/iptables-restore"

# verify netfilter configuration
$ sudo firejail --join-network=browser "/sbin/iptables -vL"

# verify and change IP addresses
$ sudo firejail --join-network=browser ifconfig
Switching to pid 1604, the first child process inside the sandbox
eth0-1603 Link encap:Ethernet  HWaddr 26:5a:88:89:86:6c  
          inet addr:192.168.1.163  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::245a:88ff:fe89:866c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1945 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1829 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1849883 (1.7 MiB)  TX bytes:217050 (211.9 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
$ sudo firejail --join-network=browser "ifconfig eth0-1603 192.168.1.180"

@netblue30 commented on GitHub (Apr 2, 2016): Use --join-network. It is very flexible, you can do much more than changing netfilter, you can also change IP addresses, add interfaces etc. Example: ``` # start firefox $ firejail --net=eth0 --name=browser firefox & # change netfilter configuration $ sudo firejail --join-network=browser "cat /etc/firejail/nolocal.net | /sbin/iptables-restore" # verify netfilter configuration $ sudo firejail --join-network=browser "/sbin/iptables -vL" # verify and change IP addresses $ sudo firejail --join-network=browser ifconfig Switching to pid 1604, the first child process inside the sandbox eth0-1603 Link encap:Ethernet HWaddr 26:5a:88:89:86:6c inet addr:192.168.1.163 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::245a:88ff:fe89:866c/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1945 errors:0 dropped:0 overruns:0 frame:0 TX packets:1829 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1849883 (1.7 MiB) TX bytes:217050 (211.9 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) $ sudo firejail --join-network=browser "ifconfig eth0-1603 192.168.1.180" ```

gitea-mirror commented

2026-05-05 05:32:34 -06:00

Author

Owner

@nick75e commented on GitHub (Apr 2, 2016):

It works, thanks! But there's something weird. I tried ifconfig and it gives me an ipv6 address even though I have added these lines to /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

and protocol doesn't contain inet6. Does that mean I still have a ipv6 connection in any way?

@nick75e commented on GitHub (Apr 2, 2016): It works, thanks! But there's something weird. I tried `ifconfig` and it gives me an ipv6 address even though I have added these lines to `/etc/sysctl.conf`: ``` net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 net.ipv6.conf.lo.disable_ipv6 = 1 ``` and `protocol` doesn't contain `inet6`. Does that mean I still have a ipv6 connection in any way?

gitea-mirror commented

2026-05-05 05:32:36 -06:00

Author

Owner

@NoAgendaIT commented on GitHub (Apr 12, 2016):

First you might want to verify if those settings are still active by running sysctl net.ipv6.conf.all.disable_ipv6 net.ipv6.conf.default.disable_ipv6 net.ipv6.conf.lo.disable_ipv6 because some network managers (and dhcp clients) just set these back to 0. sysctl.conf is normally only read once: at boot time.

Did you try ifconfig inside the jail or on the host? And the address, is it an address that starts with fe80:? And if so, does the other end of the veth pair (the one on the host with a name like veth1234eth0) also have an fe80:: address?

What do you mean with "protocol doesn't contain inet6"?

To answer your question of "does it mean you have an IPv6 connection in any way" the honest answer is yes, at least partially, iff both endpoints have that fe80 address. I'll briefly try to explain.

What I mean is, the fe80: address you see is called a link local address. It is not routed, meaning that the address is only reachable by "the other end". (virtual or physical). I was tempted to explain more about what the address is used for among other things, but I deleted all of that, figuring it's better to keep it at this rather than go into all kinds of scenarios. Instead I'd like to advice you, in order to be sure whether ipv6 traffic is flowing across, to play around with tcpdump, and see if you can capture such traffic for yourself.

@NoAgendaIT commented on GitHub (Apr 12, 2016): First you might want to verify if those settings are still active by running `sysctl net.ipv6.conf.all.disable_ipv6 net.ipv6.conf.default.disable_ipv6 net.ipv6.conf.lo.disable_ipv6` because some network managers (and dhcp clients) just set these back to `0`. sysctl.conf is normally only read once: at boot time. Did you try ifconfig inside the jail or on the host? And the address, is it an address that starts with `fe80:`? And if so, does the other end of the veth pair (the one on the host with a name like `veth1234eth0`) also have an fe80:: address? What do you mean with "protocol doesn't contain `inet6`"? To answer your question of "does it mean you have an IPv6 connection in any way" the honest answer is yes, at least partially, iff both endpoints have that fe80 address. I'll briefly try to explain. What I mean is, the `fe80:` address you see is called a link local address. It is not routed, meaning that the address is only reachable by "the other end". (virtual or physical). I was tempted to explain more about what the address is used for among other things, but I deleted all of that, figuring it's better to keep it at this rather than go into all kinds of scenarios. Instead I'd like to advice you, in order to be sure whether ipv6 traffic is flowing across, to play around with tcpdump, and see if you can capture such traffic for yourself.

gitea-mirror commented

2026-05-05 05:32:39 -06:00

Author

Owner

@nick75e commented on GitHub (Apr 13, 2016):

I've just checked and sysctl net.ipv6.conf.*.disable_ipv6 = 1
ifconfig was inside a jail.

What do you mean with "protocol doesn't contain inet6"?

I never use inet6 with protocol

Since I use openvpn, I was worried about ipv6 leaking. Then I remembered that it was inside a bridge and my system doesn't support ipv6 so there's probably no risks but I still created a netfilter6 config file blocking everything. Better be safe than sorry!

@nick75e commented on GitHub (Apr 13, 2016): I've just checked and `sysctl net.ipv6.conf.*.disable_ipv6` = `1` `ifconfig` was inside a jail. > What do you mean with "protocol doesn't contain inet6"? I never use `inet6` with `protocol` Since I use `openvpn`, I was worried about ipv6 leaking. Then I remembered that it was inside a bridge and my system doesn't support ipv6 so there's probably no risks but I still created a `netfilter6` config file blocking everything. Better be safe than sorry!

gitea-mirror commented

2026-05-05 05:32:41 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 13, 2016):

I still have to look into it. I think that net.ipv6.conf entries are per-namespace. It could be possible to totally disable ipv6 or ipv4 as requested in --protocol command.

@netblue30 commented on GitHub (Apr 13, 2016): I still have to look into it. I think that net.ipv6.conf entries are per-namespace. It could be possible to totally disable ipv6 or ipv4 as requested in --protocol command.

gitea-mirror commented

2026-05-05 05:32:43 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 19, 2018):

@nick75e Is this still an issue?

@chiraag-nataraj commented on GitHub (Aug 19, 2018): @nick75e Is this still an issue?

gitea-mirror commented

2026-05-05 05:32:45 -06:00

Author

Owner

@nick75e commented on GitHub (Aug 20, 2018):

yes, I still get an IPv6 address.
Linux Mint 19, firejail 0.9.54

@nick75e commented on GitHub (Aug 20, 2018): yes, I still get an IPv6 address. Linux Mint 19, firejail 0.9.54

gitea-mirror commented

2026-05-05 05:32:47 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Oct 3, 2018):

Hmm, this is definitely not ideal. Inside the jail (firejail --noprofile --net=wlp60s0 --protocol=inet,netlink,unix), sysctl net.ipv6.conf.all.disable_ipv6 returns 0, suggesting firejail (or whatever it calls) is resetting that somehow during its network setup. This does not happen when --net= is not used.

@chiraag-nataraj commented on GitHub (Oct 3, 2018): Hmm, this is definitely not ideal. Inside the jail (`firejail --noprofile --net=wlp60s0 --protocol=inet,netlink,unix`), `sysctl net.ipv6.conf.all.disable_ipv6` returns `0`, suggesting `firejail` (or whatever it calls) is resetting that somehow during its network setup. This does not happen when `--net=` is not used.

gitea-mirror commented

2026-05-05 05:32:48 -06:00

Author

Owner

@smitsohu commented on GitHub (Jun 19, 2019):

Some sysctl settings are per network namespace, net.ipv4.tcp_syncookies is affected as well.

@smitsohu commented on GitHub (Jun 19, 2019): Some sysctl settings are per network namespace, `net.ipv4.tcp_syncookies` is affected as well.

gitea-mirror referenced this issue

2026-05-05 10:04:12 -06:00

[PR #293] [MERGED] Fix memory leak #3587

Rows
Columns

[GH-ISSUE #403] Change iptables rules #293