1

I have a Debian Jessie running Bind. There is an OpenVPN connection set up. And resolv.conf set up to use local Bind first:

nameserver 127.0.0.1
nameserver 4.2.2.4

I want to set up system in a way that certain programs access internet only through that VPN connection (in the absence of that connection it must not have any access anywhere), and the rest to access internet directly. I want all programs to use local Bind to resolve domain names and remove that 4.2.2.4 from resolv.conf.

I thought that network namespaces are suitable tool for a job: I move VPN interface into network namespace (so it is the only connection available there except loopback), then run those certain programs in my network namespace. I made following script that I set up to run as OpenVPN route-up script:

NS=zzz

if [ ! -f /var/run/netns/$NS ]; then
        /sbin/ip netns add $NS
fi

/sbin/ip link set $dev netns $NS
/sbin/ip netns exec $NS /sbin/ifconfig lo up
/sbin/ip netns exec $NS /sbin/ifconfig $dev $ifconfig_local pointopoint $ifconfig_remote up
/sbin/ip netns exec $NS /sbin/route add default gw $ifconfig_remote metric 1024

Works fine for me, except that Bind does not listen for loopback interface in my network namespace, so all name resolution requests go to external DNS. How do I fix that? Can I specify somehow that both loopback (regular one and netns one) are the same? Or should I run another copy of Bind in my namespace? Something else?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.