First I create a "vpn" network namespace and a veth pair to connect it to the internet via my "ens32" wired ethernet adapter. Then I start openvpn inside the network namespace. Everything in the "vpn" network namespace now has the exit ip of the vpn, and everything in the default namespace has my wan ip. So far so good.

Next, I setup a usb wifi device as an access point and provide dhcp so I can connect other devices to it via wifi. Those connections run through my default namespace but I want the traffic to go through the "vpn" namespace instead so the wifi access point is for the vpn connection and not my wan/isp connection. I guessing this can be done with the right rules in the nftable but I can't figure out what. I think incoming access point traffic needs to be forwarded to vpn.default (*see below), and somehow return traffic from the vpn namespace needs to know if it should go to the access point or my wired lan.

Any help is greatly appreciated!

The default namespace looks like this: ens32 is wired ethernet ( connected to my lan and the internet. vpn.default ( is the default namespace side of the veth pair. wlx9cefd5fc6bf9 ( is the usb wifi device set up as an access point.

The "vpn" namespace side: tun0 (10.x.x.x) is the openvpn connection. vpn.namespace ( is the "vpn" namespace side of the veth pair.

And the nftable rules are: table ip nat { chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; }

    chain INPUT {
            type nat hook input priority 100; policy accept;

    chain POSTROUTING {
            type nat hook postrouting priority srcnat; policy accept;
            ip saddr ip daddr != counter packets 1 bytes 106 masquerade

    chain OUTPUT {
            type nat hook output priority -100; policy accept;

    chain vpn-postrouting {
            type nat hook postrouting priority srcnat; policy accept;
            iif "vpn.default" oif "ens32"


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.