Ubuntu 16.04 headless

Succesfully I have managed to get split routing working under these instructions https://schnouki.net/posts/2014/12/12/openvpn-for-a-single-application-on-linux/ The target is to having only transmission over vpn and everything else through eth0.

I ran the transmission-daemon inside netns and I can connect to transmission web gui through elinks but I can't get it to connect to my LAN network so it's accessible from my desktop computers browser

My configuration is like that

ip netns add nordvpn
ip netns exec nordvpn ip addr add dev lo
ip netns exec nordvpn ip link set lo up
ip link add vpn0 type veth peer name vpn1
ip link set vpn0 up
ip link set vpn1 netns nordvpn up
ip addr add dev vpn0
ip netns exec nordvpn ip addr add dev vpn1
ip netns exec nordvpn ip route add default via dev vpn1
iptables -A INPUT \! -i vpn0 -s -j DROP
iptables -t nat -A POSTROUTING -s -o et+ -j MASQUERADE
sysctl -q net.ipv4.ip_forward=1


Description=Transmission BitTorrent Daemon

ExecStart=/bin/sh -c 'exec /sbin/ip netns exec nordvpn /usr/bin/sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error --config-dir /var/lib/transmission-daemon/info'

ExecReload=/bin/kill -s HUP $MAINPID



    "alt-speed-down": 50, 
    "alt-speed-enabled": false, 
    "alt-speed-time-begin": 540, 
    "alt-speed-time-day": 127, 
    "alt-speed-time-enabled": false, 
    "alt-speed-time-end": 1020, 
    "alt-speed-up": 50, 
    "bind-address-ipv4": "", 
    "bind-address-ipv6": "::", 
    "blocklist-enabled": false, 
    "blocklist-url": "http://www.example.com/blocklist", 
    "cache-size-mb": 4, 
    "dht-enabled": true, 
    "download-dir": "/mnt/NFS/Movies", 
    "download-limit": 100, 
    "download-limit-enabled": 0, 
    "download-queue-enabled": true, 
    "download-queue-size": 5, 
    "encryption": 0, 
    "idle-seeding-limit": 30, 
    "idle-seeding-limit-enabled": false, 
    "incomplete-dir": "/mnt/NFS/Incomplete", 
    "incomplete-dir-enabled": true, 
    "lpd-enabled": false, 
    "max-peers-global": 200, 
    "message-level": 1, 
    "peer-congestion-algorithm": "", 
    "peer-id-ttl-hours": 6, 
    "peer-limit-global": 200, 
    "peer-limit-per-torrent": 50, 
    "peer-port": 51413, 
    "peer-port-random-high": 65535, 
    "peer-port-random-low": 49152, 
    "peer-port-random-on-start": false, 
    "peer-socket-tos": "default", 
    "pex-enabled": true, 
    "port-forwarding-enabled": false, 
    "preallocation": 1, 
    "prefetch-enabled": 1, 
    "queue-stalled-enabled": true, 
    "queue-stalled-minutes": 30, 
    "ratio-limit": 2, 
    "ratio-limit-enabled": false, 
    "rename-partial-files": true, 
    "rpc-authentication-required": false, 
    "rpc-bind-address": "", 
    "rpc-enabled": true, 
    "rpc-password": "{aaaaabbbbbcccccc", 
    "rpc-port": 9091, 
    "rpc-url": "/transmission/", 
    "rpc-username": "blades", 
    "rpc-whitelist": ",10.200.200.*,", 
    "rpc-whitelist-enabled": true, 
    "scrape-paused-torrents-enabled": true, 
    "script-torrent-done-enabled": true, 
    "seed-queue-enabled": false, 
    "seed-queue-size": 10, 
    "speed-limit-down": 100, 
    "speed-limit-down-enabled": false, 
    "speed-limit-up": 100, 
    "speed-limit-up-enabled": false, 
    "start-added-torrents": true, 
    "trash-original-torrent-files": false, 
    "umask": 2, 
    "upload-limit": 100, 
    "upload-limit-enabled": 0, 
    "upload-slots-per-torrent": 14, 
    "utp-enabled": true


dev tun
proto udp
remote 1194
resolv-retry infinite
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ping 15
ping-restart 0
reneg-sec 0

remote-cert-tls server

#mute 10000
auth-user-pass /etc/openvpn/login.conf

verb 3
cipher AES-256-CBC

key-direction 1
# 2048 bit OpenVPN static key
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----

curl ipv4.icanhazip.com returns my public ip address

systemctl start transmission-daemon
ip netns exec nordvpn openvpn se10.nordvpn.com.udp1194.ovpn
ip netns pids nordvpn
ps aux
root     16252  0.5  0.0   7672  1656 ?        Ss   09:12   0:00 /usr/bin/sudo -u debian-transmission /usr/bin/transmission-daemon -f --log-error --config-dir /var/lib/transmission-daemon/info
debian-+ 16265  0.5  0.1  30700  3364 ?        Sl   09:12   0:00 /usr/bin/transmission-daemon -f --log-error --config-dir /var/lib/transmission-daemon/info
root      2231  0.0  0.1   6156  2800 ?        S    May12   0:01 openvpn se10.nordvpn.com.udp1194.ovpn

And connecting to netns

    ip netns exec nordvpn /bin/bash

    curl ipv4.icanhazip.com

returns vpn address

What Iam doing wrong?

2 Answers 2


I have the almost exact setup and issue.

As far as I can tell, the namespaced network just doesn't want to let itself be access from outside. There is probably some iptables rule that can allow 192.168.1.*:9091 to be mapped to but I resorted to using socat as a workaround to make the 10.200.200.* network accessible via the actual IP address, 192.168.1.*

I'm guessing is the ip address that the transmission daemon rpc is bound to in the nordvpn namespace. You should get that info using ip netns exec nordvpn ifconfig vpn1. Look for the inet addr value.

You can verify that the rpc service is up using ip netns exec nordvpn transmission-remote --auth <username>:<password> -si to get the session info.

Then connect virtual network and actual network for port 9091 using socat:

socat tcp-listen:9091,reuseaddr,fork tcp-connect:

You can also turn it into a poor man's daemon by running it as a scheduled task using at

echo 'socat tcp-listen:9091,reuseaddr,fork tcp-connect: > /dev/null 2>&1' | at now

Note that the fork argument for socat creates multiple child processes. You can stop these later on using pkill -f 'socat tcp-listen:9091'

You should be able to access it from your desktop using your ubuntu box IP after that.


Sorry to necro this but it comes up as the relevant search. I have followed the same guide and have the same issues. Ketwaroo's answer didn't work for me so I had to do some extra digging.

Here's what I found:

socat solution:

sudo socat tcp-listen:9091,fork,reuseaddr exec:'ip netns exec vpn socat STDIO "tcp-connect:"',nofork

Thanks to the author from this site: https://newbedev.com/port-forwarding-to-application-in-network-namespace-with-vpn for the working solution AND a systemd service file if you want to keep the socat solution

iptables solution:

iptables -t nat -A PREROUTING -p tcp --dport 9091 -j DNAT --to-destination
iptables -t nat -A POSTROUTING -p tcp --dport 9091 -j MASQUERADE

thanks to the author here: https://npre.wordpress.com/2012/09/15/port-forwarding-with-iptables/ for the insight for this.

I kept thinking there had to be an iptables entry through the network namespace but I was wrong, these 2 entries do what's required.

Hope this helps others who are trying to have some kind of port routing from LAN to a network namespace.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.