github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #683] dns issue with network manager #468

New issue

Closed

opened 2026-05-05 05:55:10 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 05:55:10 -06:00

Owner

Originally created by @xahare on GitHub (Aug 4, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/683

when using --net on an internal address natted out, with a hosts that uses network manager, 127.0.1.1 is not available, so you have to use --dns. i dont know a good solution to this. ive tried

running dnsmasq. dont think end users should have to do this. and it could (in theory) mess up other stuff. if nothing else, you have to firewall it off carefully, and manage that while networks change. (change location, start / stop vpns or other virtualized networks etc)
--dns=8.8.8.8 --dns=8.8.4.4 but then you have NSA spying on you instead of just $unknown another problem is you might need the local nameserver, like when your at work.
using ip (to find default interface) and nmcli (to find nameserver) if resolv.conf has 127.0.1.1. but then you have to restart the firejail when the network changes. is there a way to change the resolver on the fly?

the other option is just use hosts main interface. these days which interface doesnt change. but, the address will, so a long running browser would still need to be restarted.

Originally created by @xahare on GitHub (Aug 4, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/683 when using --net on an internal address natted out, with a hosts that uses network manager, 127.0.1.1 is not available, so you have to use --dns. i dont know a good solution to this. ive tried 1. running dnsmasq. dont think end users should have to do this. and it could (in theory) mess up other stuff. if nothing else, you have to firewall it off carefully, and manage that while networks change. (change location, start / stop vpns or other virtualized networks etc) 2. --dns=8.8.8.8 --dns=8.8.4.4 but then you have NSA spying on you instead of just $unknown another problem is you might need the local nameserver, like when your at work. 3. using ip (to find default interface) and nmcli (to find nameserver) if resolv.conf has 127.0.1.1. but then you have to restart the firejail when the network changes. is there a way to change the resolver on the fly? the other option is just use hosts main interface. these days which interface doesnt change. but, the address will, so a long running browser would still need to be restarted.

gitea-mirror

2026-05-05 05:55:10 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:55:18 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 5, 2016):

You are right, there isn't any easy fix for it. The dns proxy on 127.0.1.1 will remain in the old network namespace, and it will not be available in the new namespace. What could work is another proxy to move data between loopback interface in the main network namespace and the loopback interface in the new network namespace. However, adding such a proxy will create some other security problems. The best solution is to find an external dns server you can trust, and this is difficult.

@netblue30 commented on GitHub (Aug 5, 2016): You are right, there isn't any easy fix for it. The dns proxy on 127.0.1.1 will remain in the old network namespace, and it will not be available in the new namespace. What could work is another proxy to move data between loopback interface in the main network namespace and the loopback interface in the new network namespace. However, adding such a proxy will create some other security problems. The best solution is to find an external dns server you can trust, and this is difficult.

gitea-mirror commented

2026-05-05 05:55:20 -06:00

Author

Owner

@xahare commented on GitHub (Aug 5, 2016):

how about overlay /etc/resolv.conf? you could have it listen for network changes or just check periodically.

was also thinking of making a container with unbound or dnsmasq "upstreaming" to localhost, but thats only slightly safer, attack surface wise, than running dnsmasq on the host.

@xahare commented on GitHub (Aug 5, 2016): how about overlay /etc/resolv.conf? you could have it listen for network changes or just check periodically. was also thinking of making a container with unbound or dnsmasq "upstreaming" to localhost, but thats only slightly safer, attack surface wise, than running dnsmasq on the host.

gitea-mirror commented

2026-05-05 05:55:22 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 7, 2016):

You are complicating yourself. Your router (DSL, cablemodem etc.) will give you the DNS settings it got from your ISP. More likely your ISP will forward your requests to some bigger ISP like Level 3 Communication, or whoever connects your ISP upstream. Can you trust any of this guys? Probably all of them are logging the requests. There is also the case when the home router is hacked and your bank http traffic is redirected to some fake bank website.

I would say find a dns server and put the IP address directly with "firejail --dns=... firefox"

@netblue30 commented on GitHub (Aug 7, 2016): You are complicating yourself. Your router (DSL, cablemodem etc.) will give you the DNS settings it got from your ISP. More likely your ISP will forward your requests to some bigger ISP like Level 3 Communication, or whoever connects your ISP upstream. Can you trust any of this guys? Probably all of them are logging the requests. There is also the case when the home router is hacked and your bank http traffic is redirected to some fake bank website. I would say find a dns server and put the IP address directly with "firejail --dns=... firefox"

gitea-mirror commented

2026-05-05 05:55:25 -06:00

Author

Owner

@xahare commented on GitHub (Aug 8, 2016):

i was also looking for seamless transitions to places like work where you want the local nameservers. but those are not that common so its not that bad to restart the browser with a different script.

@xahare commented on GitHub (Aug 8, 2016): i was also looking for seamless transitions to places like work where you want the local nameservers. but those are not that common so its not that bad to restart the browser with a different script.

gitea-mirror referenced this issue

2026-05-05 10:05:03 -06:00

[PR #468] [MERGED] fix "clean/clear" typos #3633

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#468

No description provided.

Rows
Columns