[GH-ISSUE #6760] firefox: program not in sync with network adapter changes (VPN)

gitea-mirror commented

2026-05-05 09:56:22 -06:00

Owner

Originally created by @aminvakil on GitHub (May 28, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6760

Description

Firefox does not pick network adapter changes (vpn connection / disconnection) and still uses old IP in new network interface.

Steps to Reproduce

Open firefox and connect a VPN system-wide.
Or connect a VPN system-wide, open firefox and then disconnect VPN.

Expected behavior

Use correct IP address in each interface.

Actual behavior

Firefox gets disconnected. I've checked using wireshark and it's using previous IP in new interface.
For example my wifi IP is 192.168.1.2/24 and my VPN local IP is 10.0.0.2/24, when I connect VPN, it uses 192.168.1.2/24 in vpn network interface.
It does not get fixed until a complete restart.
It happens the same when disconnecting, it uses 10.0.0.2/24 in wifi interface which does not work.

Behavior without a profile

$ LC_ALL=C firejail --noprofile /usr/bin/firefox 
firejail version 0.9.74

Parent pid 9617, child pid 9618
Base filesystem installed in 0.04 ms
Child process initialized in 19.94 ms
[3] Sandbox: CanCreateUserNamespace() clone() failure: EPERM

Additional context

I cannot remember exactly when this starts to happen, about a couple of months ago
https://bugzilla.mozilla.org/show_bug.cgi?id=1960897

Environment

Name/version/arch of the Linux kernel: Linux 6.14.8-hardened1-1-hardened x86_64
Name/version of the Linux distribution: Arch Linux
Name/version of the relevant program(s)/package(s): firefox 139.0-1
Version of Firejail: firejail version 0.9.74
If you use a development version of firejail, also the commit from which it
was compiled (git rev-parse HEAD): No

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /usr/bin/firefox

$ LC_ALL=C firejail /usr/bin/firefox 
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-proc.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
firejail version 0.9.74

Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Warning: /usr/bin/xdg-dbus-proxy was not found, downgrading dbus-user policy to allow.
To enable DBus filtering, install the xdg-dbus-proxy program.
Ignoring "dbus-user.own org.mozilla.*" and 2 other dbus-user filter rules.
Parent pid 9092, child pid 9093
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Private /etc installed in 61.84 ms
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Base filesystem installed in 138.45 ms
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Warning: Replacing profile instead of stacking it. It is a legacy behavior that can result in relaxation of the protection. It is here as a temporary measure to unbreak the software that has been broken by switching to the stacking behavior.
Child process initialized in 290.38 ms
[40] Sandbox: CanCreateUserNamespace() clone() failure: EPERM

Output of LC_ALL=C firejail --debug /usr/bin/firefox

It's outputing lots of details from system which I prefer not to share publicly.

Originally created by @aminvakil on GitHub (May 28, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6760 ### Description Firefox does not pick network adapter changes (vpn connection / disconnection) and still uses old IP in new network interface. ### Steps to Reproduce Open firefox and connect a VPN system-wide. Or connect a VPN system-wide, open firefox and then disconnect VPN. ### Expected behavior Use correct IP address in each interface. ### Actual behavior Firefox gets disconnected. I've checked using wireshark and it's using previous IP in new interface. For example my wifi IP is 192.168.1.2/24 and my VPN local IP is 10.0.0.2/24, when I connect VPN, it uses 192.168.1.2/24 in vpn network interface. It does not get fixed until a complete restart. It happens the same when disconnecting, it uses 10.0.0.2/24 in wifi interface which does not work. ### Behavior without a profile ``` $ LC_ALL=C firejail --noprofile /usr/bin/firefox firejail version 0.9.74 Parent pid 9617, child pid 9618 Base filesystem installed in 0.04 ms Child process initialized in 19.94 ms [3] Sandbox: CanCreateUserNamespace() clone() failure: EPERM ``` ### Additional context I cannot remember exactly when this starts to happen, about a couple of months ago https://bugzilla.mozilla.org/show_bug.cgi?id=1960897 ### Environment - Name/version/arch of the Linux kernel: Linux 6.14.8-hardened1-1-hardened x86_64 - Name/version of the Linux distribution: Arch Linux - Name/version of the relevant program(s)/package(s): firefox 139.0-1 - Version of Firejail: firejail version 0.9.74 - If you use a development version of firejail, also the commit from which it was compiled (`git rev-parse HEAD`): No ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /usr/bin/firefox</code></summary> <p> ``` $ LC_ALL=C firejail /usr/bin/firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-proc.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc firejail version 0.9.74 Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Warning: /usr/bin/xdg-dbus-proxy was not found, downgrading dbus-user policy to allow. To enable DBus filtering, install the xdg-dbus-proxy program. Ignoring "dbus-user.own org.mozilla.*" and 2 other dbus-user filter rules. Parent pid 9092, child pid 9093 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Private /etc installed in 61.84 ms Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Base filesystem installed in 138.45 ms Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Warning: Replacing profile instead of stacking it. It is a legacy behavior that can result in relaxation of the protection. It is here as a temporary measure to unbreak the software that has been broken by switching to the stacking behavior. Child process initialized in 290.38 ms [40] Sandbox: CanCreateUserNamespace() clone() failure: EPERM ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /usr/bin/firefox</code></summary> <p> It's outputing lots of details from system which I prefer not to share publicly. </p> </details>

gitea-mirror added the

networking

label 2026-05-05 09:56:22 -06:00

gitea-mirror commented

2026-05-05 09:56:24 -06:00

Author

Owner

@kmk3 commented on GitHub (May 28, 2025):

Firefox does not pick network adapter changes (vpn connection /
disconnection) and still uses old IP in new network interface.

Does it work with the following in ~/.config/firejail/firefox.local?

ignore net
ignore private-dev

@kmk3 commented on GitHub (May 28, 2025): > Firefox does not pick network adapter changes (vpn connection / > disconnection) and still uses old IP in new network interface. Does it work with the following in ~/.config/firejail/firefox.local? ``` ignore net ignore private-dev ```

gitea-mirror commented

2026-05-05 09:56:25 -06:00

Author

Owner

@aminvakil commented on GitHub (May 28, 2025):

No, the problem is the same, I can still see previous IP in new interface in wireshark.

I can also confirm it's reading config

$ LC_ALL=C firejail /usr/bin/firefox 
Reading profile /etc/firejail/firefox.profile
Reading profile /home/username/.config/firejail/firefox.local
Reading profile /etc/firejail/firefox-common.profile
...

@aminvakil commented on GitHub (May 28, 2025): No, the problem is the same, I can still see previous IP in new interface in wireshark. I can also confirm it's reading config ``` $ LC_ALL=C firejail /usr/bin/firefox Reading profile /etc/firejail/firefox.profile Reading profile /home/username/.config/firejail/firefox.local Reading profile /etc/firejail/firefox-common.profile ... ```

gitea-mirror commented

2026-05-05 09:56:26 -06:00

Author

Owner

@aminvakil commented on GitHub (May 28, 2025):

Firefox does not pick network adapter changes (vpn connection /
disconnection) and still uses old IP in new network interface.

Does it work with the following in ~/.config/firejail/firefox.local?
ignore net
ignore private-dev

Ah, it's working indeed, it just does not pick DNS changes, as DNS server in VPN network is not available it does not work.

But when I browse an IP, it uses correct IP.

@aminvakil commented on GitHub (May 28, 2025): > > Firefox does not pick network adapter changes (vpn connection / > > disconnection) and still uses old IP in new network interface. > > Does it work with the following in ~/.config/firejail/firefox.local? > > ``` > ignore net > ignore private-dev > ``` Ah, it's working indeed, it just does not pick DNS changes, as DNS server in VPN network is not available it does not work. But when I browse an IP, it uses correct IP.

gitea-mirror commented

2026-05-05 09:56:27 -06:00

Author

Owner

@pranaovs commented on GitHub (Jun 8, 2025):

Network connectivity to firefox is disconnected when I stop my VPN (TUN/TAP interface).

Flow:

Turn on VPN
Launch firefox
Turn off VPN

I have to relaunch firefox if i want to continue using it without a VPN interface.

How do i allow firefox to continue working even if network interfaces change?

I have already tried ignore net and ignore private-dev but in vain.

@pranaovs commented on GitHub (Jun 8, 2025): Network connectivity to firefox is disconnected when I stop my VPN (TUN/TAP interface). Flow: 1. Turn on VPN 2. Launch firefox 3. Turn off VPN I have to relaunch firefox if i want to continue using it without a VPN interface. How do i allow firefox to continue working even if network interfaces change? I have already tried `ignore net` and `ignore private-dev` but in vain.

gitea-mirror commented

2026-05-05 09:56:28 -06:00

Author

Owner

@aminvakil commented on GitHub (Jun 9, 2025):

@pranaovs Can you check browsing an IP? My problem has been fixed with ignore net and ignore private-dev, but DNS is not getting changed, which I think it's most probably because of firefox not picking up changes.

@aminvakil commented on GitHub (Jun 9, 2025): @pranaovs Can you check browsing an IP? My problem has been fixed with `ignore net` and `ignore private-dev`, but DNS is not getting changed, which I think it's most probably because of firefox not picking up changes.

gitea-mirror commented

2026-05-05 09:56:29 -06:00

Author

Owner

@aminvakil commented on GitHub (Jun 9, 2025):

Firefox does pick up changes in /etc/resolv.conf when VPN gets connected / disconnected when it has been run without firejail.

@aminvakil commented on GitHub (Jun 9, 2025): Firefox does pick up changes in /etc/resolv.conf when VPN gets connected / disconnected when it has been run without firejail.

gitea-mirror commented

2026-05-05 09:56:29 -06:00

Author

Owner

@pranaovs commented on GitHub (Jun 9, 2025):

Can you check browsing an IP? My problem has been fixed with ignore net and ignore private-dev, but DNS is not getting changed, which I think it's most probably because of firefox not picking up changes.

Okay this is interesting. I am able to enter ip addresses of sites and firefox is able to connect to those ip addresses.
Some cases, the ip is being redirected to the (correct) domain name and firefox fails (example, 1.1.1.1 -> one.one.one.one and 1.1.1.2 -> https://one.one.one.one/family), and in some cases, the websites don't redirect and I get some HTML back (example 96.7.128.198).

I am not able to find a simple website i can test connecting using just the IP. But i can confirm I'm able to reach because I get various errors like "Cloudflare: direct connection not allowed" or some other errors.

But this works even without ignore net and ignore private-dev

Interestingly, if i enable maximum protection in firefox DNS setting, it says DNS is active, but thats all. No improvements.

It's not DNS
There's no way it's DNS
It was DNS
-SSBroski

@pranaovs commented on GitHub (Jun 9, 2025): > Can you check browsing an IP? My problem has been fixed with `ignore net` and `ignore private-dev`, but DNS is not getting changed, which I think it's most probably because of firefox not picking up changes. Okay this is interesting. I am able to enter ip addresses of sites and firefox is able to connect to those ip addresses. Some cases, the ip is being redirected to the (correct) domain name and firefox fails (example, 1.1.1.1 -> one.one.one.one and 1.1.1.2 -> https://one.one.one.one/family), and in some cases, the websites don't redirect and I get some HTML back (example 96.7.128.198). I am not able to find a simple website i can test connecting using just the IP. But i can confirm I'm able to reach because I get various errors like "Cloudflare: direct connection not allowed" or some other errors. But this works even without `ignore net` and `ignore private-dev` Interestingly, if i enable maximum protection in firefox DNS setting, it says DNS is active, but thats all. No improvements. _It's not DNS There's no way it's DNS It was DNS -SSBroski_

gitea-mirror commented

2026-05-05 09:56:31 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 9, 2025):

Interestingly, if i enable maximum protection in firefox DNS setting, it says DNS is active, but thats all. No improvements.

OT: Because Firefox still uses the system DNS to initialy resolve the configured DoH server domain.

@rusty-snake commented on GitHub (Jun 9, 2025): > Interestingly, if i enable maximum protection in firefox DNS setting, it says DNS is active, but thats all. No improvements. OT: Because Firefox still uses the system DNS to initialy resolve the configured DoH server domain.

gitea-mirror commented

2026-05-05 09:56:31 -06:00

Author

Owner

@kmk3 commented on GitHub (Jun 9, 2025):

Potential duplicate of:

#3649

@kmk3 commented on GitHub (Jun 9, 2025): Potential duplicate of: * #3649

gitea-mirror commented

2026-05-05 09:56:32 -06:00

Author

Owner

@kmk3 commented on GitHub (Jun 9, 2025):

Does it work with the following in ~/.config/firejail/firefox.local?

ignore net
ignore private-dev
ignore private-etc

Was this working with a previous version of firefox/firejail?

If so, which versions?

Also, what is the name/version of the system dns manager?

@kmk3 commented on GitHub (Jun 9, 2025): Does it work with the following in ~/.config/firejail/firefox.local? ``` ignore net ignore private-dev ignore private-etc ``` Was this working with a previous version of firefox/firejail? If so, which versions? Also, what is the name/version of the system dns manager?

gitea-mirror commented

2026-05-05 09:56:34 -06:00

Author

Owner

@pranaovs commented on GitHub (Jun 9, 2025):

Does it work with the following in ~/.config/firejail/firefox.local?
ignore net
ignore private-dev
ignore private-etc

It works with these lines in firefox.local. I am able to disconnect my active VPN connection and still have firefox work. Thank you very much.

Mozilla Firefox 139.0.1

$ firejail --version
firejail version 0.9.74

Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- IDS support is disabled
	- Landlock support is enabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-lib support is disabled
	- private-cache and tmpfs as user enabled
	- sandbox check is enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

Also, what is the name/version of the system dns manager?

I don't know how to find that so here's a bunch of logs:

$ resolvectl
Global
           Protocols: +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported
    resolv.conf mode: foreign
Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net 8.8.8.8#dns.google 2606:4700:4700::1111#cloudflare-dns.com 2620:fe::9#dns.quad9.net
                      2001:4860:4860::8888#dns.google

Link 2 (enp0s31f6)
    Current Scopes: none
         Protocols: -DefaultRoute +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported
     Default Route: no

Link 3 (wlan0)
    Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6
         Protocols: +DefaultRoute +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 192.168.100.1
       DNS Servers: 192.168.100.1 8.8.8.8 4.4.4.4
     Default Route: yes

$ cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 192.168.100.1
nameserver 8.8.8.8
nameserver 4.4.4.4

@pranaovs commented on GitHub (Jun 9, 2025): > Does it work with the following in ~/.config/firejail/firefox.local? > > ``` > ignore net > ignore private-dev > ignore private-etc > ``` > It works with these lines in firefox.local. I am able to disconnect my active VPN connection and still have firefox work. Thank you very much. Mozilla Firefox 139.0.1 ```console $ firejail --version firejail version 0.9.74 Compile time support: - always force nonewprivs support is disabled - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file transfer support is enabled - IDS support is disabled - Landlock support is enabled - networking support is enabled - output logging is enabled - overlayfs support is disabled - private-home support is enabled - private-lib support is disabled - private-cache and tmpfs as user enabled - sandbox check is enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled ``` > Also, what is the name/version of the system dns manager? I don't know how to find that so here's a bunch of logs: ```console $ resolvectl Global Protocols: +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported resolv.conf mode: foreign Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net 8.8.8.8#dns.google 2606:4700:4700::1111#cloudflare-dns.com 2620:fe::9#dns.quad9.net 2001:4860:4860::8888#dns.google Link 2 (enp0s31f6) Current Scopes: none Protocols: -DefaultRoute +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported Default Route: no Link 3 (wlan0) Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6 mDNS/IPv4 mDNS/IPv6 Protocols: +DefaultRoute +LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported Current DNS Server: 192.168.100.1 DNS Servers: 192.168.100.1 8.8.8.8 4.4.4.4 Default Route: yes ``` ```console $ cat /etc/resolv.conf # Generated by NetworkManager nameserver 192.168.100.1 nameserver 8.8.8.8 nameserver 4.4.4.4 ```

gitea-mirror commented

2026-05-05 09:56:34 -06:00

Author

Owner

@kmk3 commented on GitHub (Jun 9, 2025):

It works with these lines in firefox.local. I am able to disconnect my active
VPN connection and still have firefox work. Thank you very much.

Glad it worked!

Also, what is the name/version of the system dns manager?

I don't know how to find that so here's a bunch of logs:
$ resolvectl
[...]
$ cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 192.168.100.1
nameserver 8.8.8.8
nameserver 4.4.4.4

What is the distribution name/version?

What is the output of the following?

resolvectl --version
ls -l /etc/resolv.conf

Depending on the file type, this could also be related to:

#4545

@kmk3 commented on GitHub (Jun 9, 2025): > It works with these lines in firefox.local. I am able to disconnect my active > VPN connection and still have firefox work. Thank you very much. Glad it worked! > > Also, what is the name/version of the system dns manager? > > I don't know how to find that so here's a bunch of logs: > > ``` > $ resolvectl > [...] > ``` > > ``` > $ cat /etc/resolv.conf > # Generated by NetworkManager > nameserver 192.168.100.1 > nameserver 8.8.8.8 > nameserver 4.4.4.4 > ``` What is the distribution name/version? What is the output of the following? ```sh resolvectl --version ls -l /etc/resolv.conf ``` Depending on the file type, this could also be related to: * #4545

gitea-mirror commented

2026-05-05 09:56:34 -06:00

Author

Owner

@pranaovs commented on GitHub (Jun 9, 2025):

What is the distribution name/version

Arch Linux

What is the output of the following?

$ resolvectl --version
systemd 257 (257.6-1-arch)
+PAM +AUDIT -SELINUX -APPARMOR -IMA +IPE +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP -SYSVINIT +LIBARCHIVE

$ ls -l /etc/resolv.conf
-rw-r--r-- 1 root root 88 Jun 10 00:51 /etc/resolv.conf

@pranaovs commented on GitHub (Jun 9, 2025): > What is the distribution name/version Arch Linux > What is the output of the following? ```console $ resolvectl --version systemd 257 (257.6-1-arch) +PAM +AUDIT -SELINUX -APPARMOR -IMA +IPE +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP -SYSVINIT +LIBARCHIVE ``` ```console $ ls -l /etc/resolv.conf -rw-r--r-- 1 root root 88 Jun 10 00:51 /etc/resolv.conf ```

gitea-mirror commented

2026-05-05 09:56:35 -06:00

Author

Owner

@aminvakil commented on GitHub (Jun 10, 2025):

Does it work with the following in ~/.config/firejail/firefox.local?
ignore net
ignore private-dev
ignore private-etc

Yes, adding ignore net and ignore private-dev fixed the issue with IP as I've stated in https://github.com/netblue30/firejail/issues/6760#issuecomment-2916263852.

And adding ignore private-etc fixed the issue for DNS as well. I check specific domains / subdomains which are only resolvalbe through VPN to make sure.

Was this working with a previous version of firefox/firejail?

Yes, but I can't pinpoint to exact firefox / firejal version which triggered this change, it was a couple of months ago.

If so, which versions?

Also, what is the name/version of the system dns manager?

I'm using NetworkManager and my VPN is getting activated through NetworkManager as well which changes resolv.conf directly.

It's not a symlink (i.e. I'm not using systemd-resolved).

Arch Linux
networkmanager 1.52.0
firefox 139.0.1
firejail 0.9.74

@aminvakil commented on GitHub (Jun 10, 2025): > Does it work with the following in ~/.config/firejail/firefox.local? > > ``` > ignore net > ignore private-dev > ignore private-etc > ``` Yes, adding `ignore net` and `ignore private-dev` fixed the issue with IP as I've stated in https://github.com/netblue30/firejail/issues/6760#issuecomment-2916263852. And adding `ignore private-etc` fixed the issue for DNS as well. I check specific domains / subdomains which are only resolvalbe through VPN to make sure. > > Was this working with a previous version of firefox/firejail? Yes, but I can't pinpoint to exact firefox / firejal version which triggered this change, it was a couple of months ago. > > If so, which versions? > > Also, what is the name/version of the system dns manager? I'm using NetworkManager and my VPN is getting activated through NetworkManager as well which changes resolv.conf directly. It's not a symlink (i.e. I'm not using systemd-resolved). ``` Arch Linux networkmanager 1.52.0 firefox 139.0.1 firejail 0.9.74 ```

gitea-mirror referenced this issue

2026-05-05 10:26:30 -06:00

[PR #3499] [MERGED] Update disable-common.inc #4782

Rows
Columns

[GH-ISSUE #6760] firefox: program not in sync with network adapter changes (VPN) #3358

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Additional context

Environment

Checklist

Log