Gqwill69 at 16:58, 14 December 2017

2017-12-14T16:58:57Z

← Older revision		Revision as of 16:58, 14 December 2017
Line 82:		Line 82:
	vpn_username		vpn_username
	vpn_password		vpn_password

			== OpenVPN bypass VPN ==
			Add route to not go through VPN so connectivity isn't lost on a remote machine
			* /etc/openvpn/openvpn_config_file.ovpn
			route ''network'' ''netmask'' net_gateway

	[[Category:Linux]]		[[Category:Linux]]

Gqwill69: Created page with "Container to segment routes/routing tables in linux, specifically Ubuntu 16.04 in this wiki
The goal of this is to isolate an OpenVPN tunnel for specific application(s)
2017-11-10T20:54:45Z

Created page with "Container to segment routes/routing tables in linux, specifically Ubuntu 16.04 in this wiki<br> The goal of this is to isolate an OpenVPN tunnel for specific application(s)<br..."

New page
Container to segment routes/routing tables in linux, specifically Ubuntu 16.04 in this wiki<br>
The goal of this is to isolate an OpenVPN tunnel for specific application(s)<br>
This will build a namespace named "vpn" and build two virtual ethernet interfaces to route between 'global' routing table and 'vpn' routing table.<br>
This is very manual, but it works.

== Create custom OpenVPN systemd service file ==
* /etc/systemd/system/openvpn-netns.service
<pre>
[Unit]
Description=OpenVPN Custom Startup
After=network-online.target

[Service]
Type=forking
User=root
Group=root

ExecStart=/usr/sbin/openvpn --daemon vpn_name --config /etc/openvpn/vpn_ovpn_config_file.conf --writepid /run/openvpn/vpn_provider.pid

Restart=on-failure

PIDFile=/run/openvpn/vpn_provider.pid
ExecReload=/bin/kill -HUP $MAINPID
WorkingDirectory=/etc/openvpn

# Configures the time to wait before service is stopped forcefully.
TimeoutStopSec=300

[Install]
WantedBy=multi-user.target
</pre>

* Enable it
systemctl enable openvpn-netns

== Magic OpenVPN script ==
* /etc/openvpn/netns-script
<pre>
#!/bin/sh
case $script_type in
up)
ip netns add vpn
ip netns exec vpn ip link set dev lo up
ip link set dev "$1" up netns vpn mtu "$2"
ip netns exec vpn ip addr add dev "$1" \
"$4/${ifconfig_netmask:-30}" \
${ifconfig_broadcast:+broadcast "$ifconfig_broadcast"}
ip link add veth0 type veth peer name veth1
ip link set veth1 netns vpn
ip addr add 10.1.1.1/24 dev veth0
ip netns exec vpn ip addr add 10.1.1.2/24 dev veth1
ip link set veth0 up
ip netns exec vpn ip link set veth1 up
if [ -n "$ifconfig_ipv6_local" ]; then
ip netns exec vpn ip addr add dev "$1" \
"$ifconfig_ipv6_local"/112
fi
;;
route-up)
ip netns exec vpn ip route add default via "$route_vpn_gateway"
ip route add "$route_net_gateway"/24 via 10.1.1.2 dev veth0
if [ -n "$ifconfig_ipv6_remote" ]; then
ip netns exec vpn ip route add default via \
"$ifconfig_ipv6_remote"
fi
;;
down)
ip netns exec vpn ip link set veth1 down
ip link set veth0 down
#ip netns exec vpn ifconfig veth1 down
#ip netns delete vpn
;;
esac
</pre>

* Activate it
chmod 755 /etc/openvpn/netns-script

== VPN Authentication ==
* /etc/openvpn/auth.txt
vpn_username
vpn_password

[[Category:Linux]]