I have a net namespace called vpn-ns with VPN running inside it.
What should I do to use this VPN on host. I need the same effect as if I would have been connected to the physical router with VPN on it. In particular I would like to run VPN2 on host with no issues (traffic then goes though VPN1 to VPN2 to host).
Is it possible?
All options I have discovered so far lead to nothing.
I’ve tried to setup NAT in the namespace and changed the default gateway on host,
sudo ip route replace default via 172.25.0.2 dev host
but looks like it creates some kind of cycle. (internet is not available and ping to any address <1ms)
On the host
dkuch@dkuch-PC:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp4s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether d8:bb:c1:9b:27:ed brd ff:ff:ff:ff:ff:ff
3: enp5s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether d8:bb:c1:9b:27:ee brd ff:ff:ff:ff:ff:ff
4: enp14s0f0np0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 64:9d:99:b1:f0:c9 brd ff:ff:ff:ff:ff:ff
5: enp14s0f1np1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 64:9d:99:b1:f0:ca brd ff:ff:ff:ff:ff:ff
6: wlo1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 8c:1d:96:d9:da:41 brd ff:ff:ff:ff:ff:ff
altname wlp0s20f3
inet 192.168.50.10/24 brd 192.168.50.255 scope global dynamic noprefixroute wlo1
valid_lft 80432sec preferred_lft 80432sec
inet6 fe80::cce0:f238:6c73:b6d6/64 scope link noprefixroute
valid_lft forever preferred_lft forever
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether ea:ba:15:e8:ba:45 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
8: br-dc8bb3b6ab31: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 26:14:76:40:83:63 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.1/16 brd 172.18.255.255 scope global br-dc8bb3b6ab31
valid_lft forever preferred_lft forever
inet6 fe80::2414:76ff:fe40:8363/64 scope link noprefixroute
valid_lft forever preferred_lft forever
9: veth4d23d68@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-dc8bb3b6ab31 state UP group default
link/ether c2:a9:6c:13:93:7a brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::c0a9:6cff:fe13:937a/64 scope link
valid_lft forever preferred_lft forever
10: veth16d9e34@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-dc8bb3b6ab31 state UP group default
link/ether 72:25:f1:35:4f:c7 brd ff:ff:ff:ff:ff:ff link-netnsid 1
inet6 fe80::7025:f1ff:fe35:4fc7/64 scope link
valid_lft forever preferred_lft forever
11: vethd445ea1@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-dc8bb3b6ab31 state UP group default
link/ether 16:53:45:8d:02:f9 brd ff:ff:ff:ff:ff:ff link-netnsid 2
inet6 fe80::1453:45ff:fe8d:2f9/64 scope link
valid_lft forever preferred_lft forever
12: veth97a0609@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-dc8bb3b6ab31 state UP group default
link/ether ca:fc:3d:ee:6e:8f brd ff:ff:ff:ff:ff:ff link-netnsid 3
inet6 fe80::c8fc:3dff:feee:6e8f/64 scope link
valid_lft forever preferred_lft forever
13: host@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 86:2b:9c:05:79:39 brd ff:ff:ff:ff:ff:ff link-netns vpn-ns
inet 172.25.0.1/24 scope global host
valid_lft forever preferred_lft forever
inet6 fe80::842b:9cff:fe05:7939/64 scope link
valid_lft forever preferred_lft forever
dkuch@dkuch-PC:~$ ip route
default via 192.168.50.1 dev wlo1
default via 192.168.50.1 dev wlo1 proto dhcp metric 600
169.254.0.0/16 dev docker0 scope link metric 1000 linkdown
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
172.18.0.0/16 dev br-dc8bb3b6ab31 proto kernel scope link src 172.18.0.1
172.18.0.0/16 dev br-dc8bb3b6ab31 proto kernel scope link src 172.18.0.1 metric 425
172.25.0.0/24 dev host proto kernel scope link src 172.25.0.1
192.168.50.0/24 dev wlo1 proto kernel scope link src 192.168.50.10 metric 600
dkuch@dkuch-PC:~$ sudo iptables --table nat --list
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 anywhere
MASQUERADE all -- 172.18.0.0/16 anywhere
MASQUERADE all -- 172.25.0.0/24 anywhere
MASQUERADE all -- 172.25.0.0/24 anywhere
MASQUERADE all -- 172.25.0.0/24 anywhere
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
DNAT tcp -- anywhere anywhere tcp dpt:3000 to:172.18.0.3:3000
DNAT tcp -- anywhere anywhere tcp dpt:5540 to:172.18.0.2:5540
DNAT tcp -- anywhere anywhere tcp dpt:postgresql to:172.18.0.5:5432
DNAT tcp -- anywhere anywhere tcp dpt:9090 to:172.18.0.4:9090
In the namespace
dkuch@dkuch-PC:~$ sudo ip netns exec vpn-ns ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: vpn-namespace@if13: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether be:61:79:d2:96:2b brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 172.25.0.2/24 scope global vpn-namespace
valid_lft forever preferred_lft forever
inet6 fe80::bc61:79ff:fed2:962b/64 scope link
valid_lft forever preferred_lft forever
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 172.18.0.1/30 brd 172.18.0.3 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::634a:5794:f715:548c/64 scope link stable-privacy
valid_lft forever preferred_lft forever
dkuch@dkuch-PC:~$ sudo ip netns exec vpn-ns ip route
default via 172.25.0.1 dev vpn-namespace
172.18.0.0/30 dev tun0 proto kernel scope link src 172.18.0.1
172.25.0.0/24 dev vpn-namespace proto kernel scope link src 172.25.0.2
dkuch@dkuch-PC:~$ sudo ip netns exec vpn-ns iptables --table nat --list
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.25.0.1 anywhere
MASQUERADE all -- 172.25.0.0/24 anywhere
MASQUERADE all -- 172.25.0.0/24 anywhere
MASQUERADE all -- 172.25.0.0/24 anywhere
