If the host is an OpenVPN client, how would I set up Internet access for a firejail sandbox with its own network namespace?
At this point in time (Jan. 2017) there does not seem to be a de facto solution. The subject was discussed in quite some detail in this post Implement X11 isolation - not sure if there has been anything further since.
firejail returns the following error with a tun
--net device, not something a VM would ordinarily have a problem with:
Error: the software is not supported for /31 networks
A TAP interface could be bridged, there are TAP VPNs out there (ibVPN for one I think).
I have implemented a ssh forwarding (socks) proxy based on instructions given in this article Firejail with Tor HOWTO.
See this post also on setting up an HTTP proxy redirect traffic from bridge to http proxy.
Edit 17 Feb '17:
OpenVPN integration https://github.com/netblue30/firejail/issues/59