NAME¶

vpnns - per-app VPN using namespaces

SYNOPSIS¶

vpnns [--name=identifier] -- command

vpnns [--name=identifier] [--script=path] --attach

DESCRIPTION¶

vpnns isolates VPN-related network traffic and applications inside a separate network namespace. Applications intended to be used with the VPN cannot bypass the VPN to access the internet directly, and applications not intended to be used with the VPN cannot send traffic through the VPN tunnel.

USAGE¶

This starts up an application in a fresh user/net/uts/mount namespace:

Initially it will not have any network access as the only interface present in the netns is the loopback device. The application should still be able to talk to Xorg through UNIX sockets in /tmp.

The next step is to connect to a VPN and invoke vpnns --attach to pass the VPN traffic back and forth:

These commands connect to an ocserv or openvpn gateway, then tell vpnns to set up a tunnel device, default route, and resolv.conf inside the namespace created above. On success, the web browser will have connectivity. When the VPN disconnects, the browser will lose all connectivity, preventing leaks.

vpnns can be rerun multiple times if the connection fails or if the VPN client crashes. If run without arguments, it will open a shell inside the namespace.

OPTIONS¶

-n, --name identifier

vpnns is designed to allow multiple instances to coexist on the same system. This feature could be useful for connecting to multiple VPNs at the same time. identifier defaults to "default" but can be overridden through the --name option.

-s, --script path

Invoke the program at path to set up and tear down the tunnel device's IP configuration, instead of letting vpnns handle it internally. $TUNDEV will be set to the device name (e.g. tun0). $reason will be set to either connect or disconnect. Any IP configuration variables such as $INTERNAL_IP4_ADDRESS set by the VPN client will be inherited, so it is possible for a modified vpnc-script to be used. This option only has an effect if --attach is also specified.

CAVEATS¶

vpnns is not a security tool. It cannot prevent malicious applications from bypassing the namespace restrictions.

While OpenConnect works with vpnns out of the box, OpenVPN currently (as of 2017-01-08) requires out-of-tree patches to support non-root operation.

If /etc/resolv.conf is a symbolic link to a file that is regenerated on network connection changes, the bind mount used by vpnns to override the DNS configuration can be inadvertently deleted. vpnns attempts to work around this by using overlayfs to override /etc/resolv.conf, but that does not work on all systems.

Some distributions patch their kernels to prevent unprivileged users from creating namespaces, resulting in a "can't unshare namespaces: Operation not permitted" error. This security feature can be disabled using the following command:

To make the change permanent, edit /etc/sysctl.conf.

FILES¶

~/.vpnns-identifier

State directory for a given vpnns instance. By default, vpnns uses ~/.vpnns-default.

SEE ALSO¶

ocproxy(1), openconnect(8), openvpn(8)