I have an Ubuntu 18.04 server in which I've created two virtual interface pairs (veth0a & veth0b) and assigned the end of one interface (veth0b) to a new network namespace (netns0):
ip netns add netns0 ip netns exec netns0 ip link set lo up ip link add veth0a type veth peer name veth0b ip link set veth0b netns netns0
I then used firejail to force a specific user (test-user) to use this new namespace by default by setting
/usr/bin/firejail as the default shell for this user and by adding the following to the
I've ran the following test to make sure this works:
tshark -i veth0a -f "port 443"from the root account
- SSH into the server as test-user
curl https://22.214.171.124as SSH user
The tshark output shows the proper veth0b source IP address for the 126.96.36.199 traffic.
The issue I'm running into is when trying to use the test-user account to establish socks5 dynamic port forwarding over SSH:
ssh -D 10000 -q -C -N test-user@server_ip
Running this command from my laptop or workstation allows me to establish a local socks5 server on port 1000 and tunnel it over the SSH connection. Setting this as my local socks5 proxy and going to
https://api.ipify.org demonstrates that the proxy is working and that my laptop is using the server's IP address.
The issue is that the sock5 traffic does not appear to be going through the proper namespace. In other words, while browsing the web on my laptop while connected to the socks5 server over the test-user ssh connection my traffic does not appear in tshark -i veth0a.
Is there an additional step needed to ensure the port forwarding tunnel also uses firejail? Does setting the shell in /etc/passwd only impact an interactive login shell? Do i need to also change the user's non-interactive shell to
/usr/bin/firejail? If so how would I do that?
Any help would be greatly appreciated.