github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #480] Moving veth in new network namespace and setting default gateway #340

New issue

Closed

opened 2026-05-05 05:37:58 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 05:37:58 -06:00

Owner

Originally created by @irregulator on GitHub (Apr 24, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/480

Hello there,

I'm experimenting with firejail and veth interfaces. My goal is to create a veth interfaces pair, create a separate network namespace with firejail, move one veth in it and assign a default gateway to that namespace.

This is the script that I use to create a veth pair and assign IPs to them.

root@thyella:~# cat bringup_vethpair.sh 
#!/bin/bash
ran=$(< /dev/urandom tr -dc A-Za-z | head -c2;echo;)
ip link add veth-${ran} type veth peer name veth-b
ip a add 10.10.3.1/30 dev veth-${ran}
ip link set dev veth-${ran} up
sysctl -w net.ipv4.conf.veth-${ran}.forwarding=1
ip a add 10.10.3.2/30 dev veth-b
ip link set dev veth-b up

Running it results in:

28: veth-b@veth-EH: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 16:a8:13:e3:72:da brd ff:ff:ff:ff:ff:ff
    inet 10.10.3.2/30 scope global veth-b
       valid_lft forever preferred_lft forever
    inet6 fe80::14a8:13ff:fee3:72da/64 scope link 
       valid_lft forever preferred_lft forever
29: veth-EH@veth-b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 7e:72:73:34:10:c4 brd ff:ff:ff:ff:ff:ff
    inet 10.10.3.1/30 scope global veth-EH
       valid_lft forever preferred_lft forever
    inet6 fe80::7c72:73ff:fe34:10c4/64 scope link 
       valid_lft forever preferred_lft forever

I then run firejail like so:

➜  thyella /usr/tmp/bin  ./firejail --noprofile --interface=veth-b --defaultgw=10.10.3.1
Parent pid 18846, child pid 18847
MyDefault gateway 10.10.3.1
1202401401 

DEBUG1
ip: 0 
mask: 0 
gw: 1202401401 

DEBUG2
ip: 0 
mask: 0 
gw: 1202401401 

Warning: cannot configure default route

Interface        MAC                IP               Mask             Status
lo                                  127.0.0.1        255.0.0.0        UP    
veth-b           16:a8:13:e3:72:da  10.10.3.2        255.255.255.252  UP    
Default gateway 10.10.3.1


Child process initialized

The extra output is some dummy debug messages I've added, 07f2c74fe4

The veth pair is successfully moved in the namespace but no default route is set:

[user@thyella bin]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1       
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00                                      
    inet 127.0.0.1/8 scope host lo                                                             
       valid_lft forever preferred_lft forever                                                 
    inet6 ::1/128 scope host                                                                   
       valid_lft forever preferred_lft forever
28: veth-b@if29: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 16:a8:13:e3:72:da brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.10.3.2/30 brd 10.10.3.3 scope global veth-b
       valid_lft forever preferred_lft forever
    inet6 fe80::14a8:13ff:fee3:72da/64 scope link 
       valid_lft forever preferred_lft forever
[user@thyella bin]$ ip r
10.10.3.0/30 dev veth-b  proto kernel  scope link  src 10.10.3.2

But I'm actually able to manually set a default route from within the namespace:

[root@thyella bin]$ ip r add default via 10.10.3.1 dev veth-b                             
[root@thyella bin]$ ip r                                                                     
default via 10.10.3.1 dev veth-b                                                               
10.10.3.0/30 dev veth-b  proto kernel  scope link  src 10.10.3.2 
[root@thyella bin]$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=48 time=78.3 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=48 time=79.8 ms
^C

Is the --defaultgw parameter just not compatible with --interface ?

I've also discovered that I can normally create the network namespace:

➜  thyella /usr/tmp/bin  ./firejail --noprofile --interface=veth-b --name=veth-test
[user@thyella bin]$ ip r
10.10.3.0/30 dev veth-b  proto kernel  scope link  src 10.10.3.2

Then use --join-network from the outside to inject the default route in the namespace:

root@thyella:~# firejail --join-network=veth-test "ip r add default via 10.10.3.1 dev veth-b"

result:

[user@thyella bin]$ ip r
default via 10.10.3.1 dev veth-b                                                               
10.10.3.0/30 dev veth-b  proto kernel  scope link  src 10.10.3.2

Still, a sigle command, for example using --defaultgw when creating the namespace, would be much more convenient.

Thanks for developing firejail.

Originally created by @irregulator on GitHub (Apr 24, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/480 Hello there, I'm experimenting with firejail and veth interfaces. My goal is to create a veth interfaces pair, create a separate network namespace with firejail, move one veth in it and assign a default gateway to that namespace. This is the script that I use to create a veth pair and assign IPs to them. ``` root@thyella:~# cat bringup_vethpair.sh #!/bin/bash ran=$(< /dev/urandom tr -dc A-Za-z | head -c2;echo;) ip link add veth-${ran} type veth peer name veth-b ip a add 10.10.3.1/30 dev veth-${ran} ip link set dev veth-${ran} up sysctl -w net.ipv4.conf.veth-${ran}.forwarding=1 ip a add 10.10.3.2/30 dev veth-b ip link set dev veth-b up ``` Running it results in: ``` 28: veth-b@veth-EH: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 16:a8:13:e3:72:da brd ff:ff:ff:ff:ff:ff inet 10.10.3.2/30 scope global veth-b valid_lft forever preferred_lft forever inet6 fe80::14a8:13ff:fee3:72da/64 scope link valid_lft forever preferred_lft forever 29: veth-EH@veth-b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 7e:72:73:34:10:c4 brd ff:ff:ff:ff:ff:ff inet 10.10.3.1/30 scope global veth-EH valid_lft forever preferred_lft forever inet6 fe80::7c72:73ff:fe34:10c4/64 scope link valid_lft forever preferred_lft forever ``` I then run firejail like so: ``` ➜ thyella /usr/tmp/bin ./firejail --noprofile --interface=veth-b --defaultgw=10.10.3.1 Parent pid 18846, child pid 18847 MyDefault gateway 10.10.3.1 1202401401 DEBUG1 ip: 0 mask: 0 gw: 1202401401 DEBUG2 ip: 0 mask: 0 gw: 1202401401 Warning: cannot configure default route Interface MAC IP Mask Status lo 127.0.0.1 255.0.0.0 UP veth-b 16:a8:13:e3:72:da 10.10.3.2 255.255.255.252 UP Default gateway 10.10.3.1 Child process initialized ``` The extra output is some dummy debug messages I've added, https://github.com/irregulator/firejail/commit/07f2c74fe4ce5351e7b8d88722d79a26956b7a7c The veth pair is successfully moved in the namespace but no default route is set: ``` [user@thyella bin]$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 28: veth-b@if29: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 16:a8:13:e3:72:da brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 10.10.3.2/30 brd 10.10.3.3 scope global veth-b valid_lft forever preferred_lft forever inet6 fe80::14a8:13ff:fee3:72da/64 scope link valid_lft forever preferred_lft forever [user@thyella bin]$ ip r 10.10.3.0/30 dev veth-b proto kernel scope link src 10.10.3.2 ``` But I'm actually able to manually set a default route from within the namespace: ``` [root@thyella bin]$ ip r add default via 10.10.3.1 dev veth-b [root@thyella bin]$ ip r default via 10.10.3.1 dev veth-b 10.10.3.0/30 dev veth-b proto kernel scope link src 10.10.3.2 [root@thyella bin]$ ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=48 time=78.3 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=48 time=79.8 ms ^C ``` Is the `--defaultgw` parameter just not compatible with `--interface` ? I've also discovered that I can normally create the network namespace: ``` ➜ thyella /usr/tmp/bin ./firejail --noprofile --interface=veth-b --name=veth-test [user@thyella bin]$ ip r 10.10.3.0/30 dev veth-b proto kernel scope link src 10.10.3.2 ``` Then use `--join-network` from the outside to inject the default route in the namespace: ``` root@thyella:~# firejail --join-network=veth-test "ip r add default via 10.10.3.1 dev veth-b" ``` result: ``` [user@thyella bin]$ ip r default via 10.10.3.1 dev veth-b 10.10.3.0/30 dev veth-b proto kernel scope link src 10.10.3.2 ``` Still, a sigle command, for example using `--defaultgw` when creating the namespace, would be much more convenient. Thanks for developing firejail.

gitea-mirror

2026-05-05 05:37:58 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:38:04 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 25, 2016):

Problem on my side. Somehow I was attempting to configure the default gateway before setting the ip address, so the kernel refused the gateway. I put a fix in the master branch, it should work now. Thanks for the bug.

@netblue30 commented on GitHub (Apr 25, 2016): Problem on my side. Somehow I was attempting to configure the default gateway before setting the ip address, so the kernel refused the gateway. I put a fix in the master branch, it should work now. Thanks for the bug.

gitea-mirror referenced this issue

2026-05-05 10:04:23 -06:00

[PR #340] [MERGED] fix typo #3598

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#340

No description provided.

Rows
Columns