[GH-ISSUE #59] OpenVPN integration

gitea-mirror commented

2026-05-05 04:48:53 -06:00

Owner

Originally created by @vrs on GitHub (Sep 9, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/59

I have an OpenVPN setup that spawns the tun interface in its own namespace, thus obviating the need for bridge interfaces (detailed here).
--net and sudo exist, but I would rather pass --netns (or --net=ns:foo to stay within style) to firejail than use my rather hacky sudo line.
If necessary I could implement it myself and submit a PR, but my C is minimal.

Originally created by @vrs on GitHub (Sep 9, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/59 I have an OpenVPN setup that spawns the tun interface in its own namespace, thus obviating the need for bridge interfaces (detailed [here](http://www.synkretie.net/writings/easy%20namespaced%20openvpn.html)). --net and sudo exist, but I would rather pass --netns (or --net=ns:foo to stay within style) to firejail than use my rather hacky sudo line. If necessary I could implement it myself and submit a PR, but my C is minimal.

gitea-mirror added the

enhancement

label 2026-05-05 04:48:53 -06:00

gitea-mirror commented

2026-05-05 04:48:58 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 10, 2015):

Thanks, I'll do it myself, the network code is very convoluted in this moment.

I don't know how bringing in the sandbox an external network namespace will work. The easy way would be to bring in the tunnel interface (--net=tun2). I also have to add support to set mtu for the interface (--mtu=1500). I'll have something in the next two weeks.

@netblue30 commented on GitHub (Sep 10, 2015): Thanks, I'll do it myself, the network code is very convoluted in this moment. I don't know how bringing in the sandbox an external network namespace will work. The easy way would be to bring in the tunnel interface (--net=tun2). I also have to add support to set mtu for the interface (--mtu=1500). I'll have something in the next two weeks.

gitea-mirror commented

2026-05-05 04:49:00 -06:00

Author

Owner

@vrs commented on GitHub (Sep 10, 2015):

"to bring in the tunnel interface" I tried that but an interface that moves namespaces loses all configuration. Which is why I configure the tun again once it's in the new namespace instead of grabbing it with firejail.
Spawning in an existing network namespace is a matter of ip netns exec $ns firejail $cmd - if you want only one namespace. But ip netns exec needs root and thus my hacky sudo setup.

@vrs commented on GitHub (Sep 10, 2015): "to bring in the tunnel interface" I tried that but an interface that moves namespaces loses all configuration. Which is why I configure the tun again once it's in the new namespace instead of grabbing it with firejail. Spawning in an existing network namespace is a matter of ip netns exec $ns firejail $cmd - if you want only one namespace. But ip netns exec needs root and thus my hacky sudo setup.

gitea-mirror commented

2026-05-05 04:49:02 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 25, 2015):

I have a --interface option that moves a full network interface into a sandbox. It preserves the interface configuration. Example:

$ firejail --interface=tun2

I still have to look how can this be integrated with OpenVPN.

@netblue30 commented on GitHub (Oct 25, 2015): I have a --interface option that moves a full network interface into a sandbox. It preserves the interface configuration. Example: ``` $ firejail --interface=tun2 ``` I still have to look how can this be integrated with OpenVPN.

gitea-mirror commented

2026-05-05 04:49:05 -06:00

Author

Owner

@netblue30 commented on GitHub (Nov 20, 2015):

From an user on wordpress:

— CONFLICT between –net=eth0 and active VPN (OpenVPN) client —

When my OpenVPN client is active, I lose all –dns capability, as if the Dynamic Network Service isn’t there.

As stated in netblue30’s blog, using –net=eth0 requires –dns=x.x.x.x also.
This works well for me, whether –private is employed or not.
However, activating my OpenVPN client and then calling $ firejail –net=eth0 –dns=8.8.8.8 firefox results in Firefox loading without any DN Service whatsoever.
On the other hand, losing my network isolation above (-A OUTPUT -d 192.168.0.0/16 -j DROP) because –netfilter can’t be active during VPN sessions isn’t a loss, because I’m not concerned with hackers coming through the encrypted VPN door to access other servers on my local network

@netblue30 commented on GitHub (Nov 20, 2015): From an user on wordpress: — CONFLICT between –net=eth0 and active VPN (OpenVPN) client — When my OpenVPN client is active, I lose all –dns capability, as if the Dynamic Network Service isn’t there. As stated in netblue30’s blog, using –net=eth0 requires –dns=x.x.x.x also. This works well for me, whether –private is employed or not. However, activating my OpenVPN client and then calling $ firejail –net=eth0 –dns=8.8.8.8 firefox results in Firefox loading without any DN Service whatsoever. On the other hand, losing my network isolation above (-A OUTPUT -d 192.168.0.0/16 -j DROP) because –netfilter can’t be active during VPN sessions isn’t a loss, because I’m not concerned with hackers coming through the encrypted VPN door to access other servers on my local network

gitea-mirror commented

2026-05-05 04:49:07 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 14, 2016):

https://github.com/netblue30/firejail/issues/214

@netblue30 commented on GitHub (Jan 14, 2016): https://github.com/netblue30/firejail/issues/214

gitea-mirror commented

2026-05-05 04:49:08 -06:00

Author

Owner

@sebastianst commented on GitHub (Sep 27, 2016):

What's the current status? I still couldn't manage to restrict a firejailed application to an openvpn connection/interface.

@sebastianst commented on GitHub (Sep 27, 2016): What's the current status? I still couldn't manage to restrict a firejailed application to an openvpn connection/interface.

gitea-mirror commented

2026-05-05 04:49:09 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 27, 2016):

I didn't get a chance to look into it. I'll try to put it in the next release.

@netblue30 commented on GitHub (Sep 27, 2016): I didn't get a chance to look into it. I'll try to put it in the next release.

gitea-mirror commented

2026-05-05 04:49:11 -06:00

Author

Owner

@sebastianst commented on GitHub (Sep 27, 2016):

Thanks! I thought I missed something because you closed the issue in February ;)

@sebastianst commented on GitHub (Sep 27, 2016): Thanks! I thought I missed something because you closed the issue in February ;)

gitea-mirror commented

2026-05-05 04:49:13 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 27, 2016):

Sorry, one of them was supposed to remain open! Track this issue, I'll close it when is done.

@netblue30 commented on GitHub (Sep 27, 2016): Sorry, one of them was supposed to remain open! Track this issue, I'll close it when is done.

gitea-mirror commented

2026-05-05 04:49:14 -06:00

Author

Owner

@sebastianst commented on GitHub (Sep 28, 2016):

Is there was a way to let firejail attach to an already existing network namespace, like firejail --netns=vpn? That would be great since then I could start openvpn and let it set up the namespace and then start firejail, attaching to that namespace.

@sebastianst commented on GitHub (Sep 28, 2016): Is there was a way to let firejail attach to an already existing network namespace, like `firejail --netns=vpn`? That would be great since then I could start openvpn and [let it set up the namespace](http://unix.stackexchange.com/a/196116/26774) and then start firejail, attaching to that namespace.

gitea-mirror commented

2026-05-05 04:49:17 -06:00

Author

Owner

@COLABORATI commented on GitHub (May 5, 2017):

This is a key feature to enable multiple apps use different vpn networks, what would be fantastic - any news on this? Thank you very much for your attention!

@COLABORATI commented on GitHub (May 5, 2017): This is a key feature to enable multiple apps use different vpn networks, what would be fantastic - any news on this? Thank you very much for your attention!

gitea-mirror commented

2026-05-05 04:49:20 -06:00

Author

Owner

@netblue30 commented on GitHub (May 9, 2017):

No, still no support for VPNs.

@netblue30 commented on GitHub (May 9, 2017): No, still no support for VPNs.

gitea-mirror commented

2026-05-05 04:49:23 -06:00

Author

Owner

@cynecx commented on GitHub (Jun 29, 2017):

Is there any progress on this feature? It would be great if firejail could probably work with openvpn.

Also, I am not that much experienced here but how would this work? I am currently starting openvpn with a tun setup which does not use any default routing. Is it possible somehow to setup routes to the tun0 device inside firejail?

@cynecx commented on GitHub (Jun 29, 2017): Is there any progress on this feature? It would be great if firejail could probably work with openvpn. Also, I am not that much experienced here but how would this work? I am currently starting openvpn with a tun setup which does not use any default routing. Is it possible somehow to setup routes to the tun0 device inside firejail?

gitea-mirror commented

2026-05-05 04:49:25 -06:00

Author

Owner

@tonsimple commented on GitHub (Feb 28, 2018):

@netblue30

Do I understand correctly that as of now bringing in a tun into firejail jail is completely impossible?

I try

user@scomp:~$ firejail --noprofile --net=tun0 /bin/bash

I get:

Parent pid 10420, child pid 10421
RTNETLINK answers: Invalid argument
Error: cannot bring up interface eth0-10420
Error ioctl: network.c:208 net_if_up: No such device
Error: cannot establish communication with the parent, exiting...

Trying running firejail as root changes nothing...

@tonsimple commented on GitHub (Feb 28, 2018): @netblue30 Do I understand correctly that as of now bringing in a tun into firejail jail is completely impossible? I try user@scomp:~$ firejail --noprofile --net=tun0 /bin/bash I get: Parent pid 10420, child pid 10421 RTNETLINK answers: Invalid argument Error: cannot bring up interface eth0-10420 Error ioctl: network.c:208 net_if_up: No such device Error: cannot establish communication with the parent, exiting... Trying running firejail as root changes nothing...

gitea-mirror commented

2026-05-05 04:49:27 -06:00

Author

Owner

@Boyardism commented on GitHub (Mar 13, 2018):

FYI the --interface option also doesn't work for tun interfaces

@Boyardism commented on GitHub (Mar 13, 2018): FYI the --interface option also doesn't work for tun interfaces

Rows
Columns

[GH-ISSUE #59] OpenVPN integration #31