I have a Debian Jessie running Bind. There is an OpenVPN connection set up. And
resolv.conf set up to use local Bind first:
nameserver 127.0.0.1 nameserver 188.8.131.52
I want to set up system in a way that certain programs access internet only through that VPN connection (in the absence of that connection it must not have any access anywhere), and the rest to access internet directly. I want all programs to use local Bind to resolve domain names and remove that
I thought that network namespaces are suitable tool for a job: I move VPN interface into network namespace (so it is the only connection available there except loopback), then run those certain programs in my network namespace. I made following script that I set up to run as OpenVPN
NS=zzz if [ ! -f /var/run/netns/$NS ]; then /sbin/ip netns add $NS fi /sbin/ip link set $dev netns $NS /sbin/ip netns exec $NS /sbin/ifconfig lo up /sbin/ip netns exec $NS /sbin/ifconfig $dev $ifconfig_local pointopoint $ifconfig_remote up /sbin/ip netns exec $NS /sbin/route add default gw $ifconfig_remote metric 1024
Works fine for me, except that Bind does not listen for loopback interface in my network namespace, so all name resolution requests go to external DNS. How do I fix that? Can I specify somehow that both loopback (regular one and netns one) are the same? Or should I run another copy of Bind in my namespace? Something else?