My understanding of what ip netns does (and general networking) is fuzzy, so maybe what I'm asking for isn't even possible.

So, what I have. Three global interfaces, let's call them lo, eth0 and tun0. eth0 is used to access Internet, tun0 is an interface created by openconnect for the purpose of connecting to company's VPN.

For reasons I don't understand1, some company's resources are only accessible when the machine is not connected to VPN. I've established this by killing openconnect process, which subsequently removed the tun0 interface.

What I hoped to be able to achieve:

  1. Create a dedicated novpn namespace.
  2. Create virtual interface pair veth0 and veth1.
  3. Configure veth0 to handle addresses of eth0.
  4. Add veth0 to novpn namespace.
  5. Run browser using something like ip netns exec novpn firefox.

But it didn't do what I expected. The browser run in such a way was still able to access VPN network resources.

So, is it even possible to create two namespaces, one that is connected to VPN and the other one that isn't?

1 - It is trying to access a third-party authentication provider, but, probably, the resource being accessed is different based on whether the machine is connected to VPN or not, or maybe it's looking for the source IP in the outgoing traffic... your guess is as good as any.

  • You may not need network namespaces for this. You can probably get what you want by just updating your routing tables. The keyword you're probably looking for is split tunneling. – igal Nov 13 '17 at 15:56
  • @igal thank you for the hint, I will need to read more about it! – wvxvw Nov 13 '17 at 16:04
  • Sure. Good luck. I'll be back after work if you don't get this resolved by then. – igal Nov 13 '17 at 16:12
  • Also, you might want to update your question to include the output of ifconfig and route (or ip addr and ip route). If some of that information is sensitive then you can just edit it or mock it up to use some place-holder information that people can refer to in their solutions. – igal Nov 13 '17 at 16:22
  • 1
    Depending on how you did (3), probably the packets from the novpn just followed the default route, which is through the tunnel. Have a look at macvlan if you want a second virtual ethernet device (with different IP address) that connects to your LAN (and therefore to the internet). Also, please edit question and describe what kinds of applications need tunnel/no tunnel access, and to which addresses - there may be easier ways of implementing this. – dirkt Nov 13 '17 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.