4:36 p.m.
I have a subscription to a commercial VPN provider and would like to
configure certain applications to always use VPN connections as far as
the provider while everything else goes through as normal. Note that
this needs to work for arbitrary remote sites so the VPN is basically
acting as a proxy rather than me controlling both ends of the
connection, so e.g. an SSH tunnel won't do it.
I looked into this a while ago and there are several suggestions on the
Web as to how to do this on Linux, but those I tried didn't work for
me. At least one idea seemed to involve setting up an alternate network
name space with its own routing, but it's been a while and I'm afraid I
didn't take note of the details.
Has anyone done this? in Fedora
poc
4:53 p.m.
On 01/27/2017 02:36 PM, Patrick O'Callaghan wrote:
I have a subscription to a commercial VPN provider and would like to
configure certain applications to always use VPN connections as far as
the provider while everything else goes through as normal. Note that
this needs to work for arbitrary remote sites so the VPN is basically
acting as a proxy rather than me controlling both ends of the
connection, so e.g. an SSH tunnel won't do it.
I looked into this a while ago and there are several suggestions on the
Web as to how to do this on Linux, but those I tried didn't work for
me. At least one idea seemed to involve setting up an alternate network
name space with its own routing, but it's been a while and I'm afraid I
didn't take note of the details.
Hi Patrick,
Stéphane Graber of Ubuntu's LXC/D container world has done several
things with VPN from passing the vpn to a container where the container
sees it as just another eth device, to managing his sundry VPN
connections via namespacing.
His words:
"""
The code is available at: git clone
git://github.com/stgraber/vpn-container. Then it’s as simple as:
./start-vpn VPN-NAME CONFIG
"""
The approach is discussed at https://www.stgraber.org/category/lxc/.
Search for VPN in containers for the specific section.
5:55 p.m.
On Fri, 2017-01-27 at 14:53 -0800, Mike Wright wrote:
On 01/27/2017 02:36 PM, Patrick O'Callaghan wrote:
> I have a subscription to a commercial VPN provider and would like to
> configure certain applications to always use VPN connections as far as
> the provider while everything else goes through as normal. Note that
> this needs to work for arbitrary remote sites so the VPN is basically
> acting as a proxy rather than me controlling both ends of the
> connection, so e.g. an SSH tunnel won't do it.
>
> I looked into this a while ago and there are several suggestions on the
> Web as to how to do this on Linux, but those I tried didn't work for
> me. At least one idea seemed to involve setting up an alternate network
> name space with its own routing, but it's been a while and I'm afraid I
> didn't take note of the details.
Hi Patrick,
Stéphane Graber of Ubuntu's LXC/D container world has done several
things with VPN from passing the vpn to a container where the container
sees it as just another eth device, to managing his sundry VPN
connections via namespacing.
His words:
"""
The code is available at: git clone
git://github.com/stgraber/vpn-container. Then it’s as simple as:
./start-vpn VPN-NAME CONFIG
"""
The approach is discussed at https://www.stgraber.org/category/lxc/.
Search for VPN in containers for the specific section.
Thanks. The versions I'd seen before didn't involve containers but I'll
take a look.
poc
6:04 p.m.
On 01/27/2017 03:55 PM, Patrick O'Callaghan wrote:
Thanks. The versions I'd seen before didn't involve
containers but I'll
take a look.
I might be wrong, but my understanding is that if you're using
namespacing, you've created a container. The level of
"containerization" depends on which (and how many) namespaces are involved.
6:21 p.m.
On Fri, 2017-01-27 at 16:04 -0800, Samuel Sieb wrote:
On 01/27/2017 03:55 PM, Patrick O'Callaghan wrote:
> Thanks. The versions I'd seen before didn't involve containers but I'll
> take a look.
>
I might be wrong, but my understanding is that if you're using
namespacing, you've created a container. The level of
"containerization" depends on which (and how many) namespaces are involved.
I definitely did not use lxc, which isn't even installed. Without
looking further my impression is that containers use namespaces but as
only one of several Linux features.
I do have several VMs, which would be another way to do it, but that
wasn't part of it either.
poc
8:15 p.m.
On 01/27/2017 04:04 PM, Samuel Sieb wrote:
On 01/27/2017 03:55 PM, Patrick O'Callaghan wrote:
> Thanks. The versions I'd seen before didn't involve containers but I'll
> take a look.
>
I might be wrong, but my understanding is that if you're using
namespacing, you've created a container. The level of
"containerization" depends on which (and how many) namespaces are involved.
Sure, of a type. It's probably a semantic game and different people
would argue that their definition of a container is the "right" one.
When you namespace a network you've actually given yourself a new
network stack, free to modify as you wish. I don't remember the syntax
but I believe there are ways to share pieces of the different stacks in
addition to simply networking between them.
4:10 p.m.
New subject: uidmap (was Re: Selective VPN)
On Fri, 2017-01-27 at 23:55 +0000, Patrick O'Callaghan wrote:
On Fri, 2017-01-27 at 14:53 -0800, Mike Wright wrote:
> On 01/27/2017 02:36 PM, Patrick O'Callaghan wrote:
> > I have a subscription to a commercial VPN provider and would like to
> > configure certain applications to always use VPN connections as far as
> > the provider while everything else goes through as normal. Note that
> > this needs to work for arbitrary remote sites so the VPN is basically
> > acting as a proxy rather than me controlling both ends of the
> > connection, so e.g. an SSH tunnel won't do it.
> >
> > I looked into this a while ago and there are several suggestions on the
> > Web as to how to do this on Linux, but those I tried didn't work for
> > me. At least one idea seemed to involve setting up an alternate network
> > name space with its own routing, but it's been a while and I'm afraid
I
> > didn't take note of the details.
>
> Hi Patrick,
>
> Stéphane Graber of Ubuntu's LXC/D container world has done several
> things with VPN from passing the vpn to a container where the container
> sees it as just another eth device, to managing his sundry VPN
> connections via namespacing.
>
> His words:
>
> """
> The code is available at: git clone
> git://github.com/stgraber/vpn-container. Then it’s as simple as:
> ./start-vpn VPN-NAME CONFIG
> """
>
> The approach is discussed at https://www.stgraber.org/category/lxc/.
> Search for VPN in containers for the specific section.
Thanks. The versions I'd seen before didn't involve containers but I'll
take a look.
Decided to try this, but there's a dependency on something called
uidmap which doesn't seem to exist for Fedora (according to both dnf
search and Google).
Other ideas are welcome.
poc
10:13 p.m.
New subject: uidmap (was Re: Selective VPN)
On 01/28/2017 02:10 PM, Patrick O'Callaghan wrote:
On Fri, 2017-01-27 at 23:55 +0000, Patrick O'Callaghan wrote:
> On Fri, 2017-01-27 at 14:53 -0800, Mike Wright wrote:
>> On 01/27/2017 02:36 PM, Patrick O'Callaghan wrote:
>>> I have a subscription to a commercial VPN provider and would like to
>>> configure certain applications to always use VPN connections as far as
>>> the provider while everything else goes through as normal. Note that
>>> this needs to work for arbitrary remote sites so the VPN is basically
>>> acting as a proxy rather than me controlling both ends of the
>>> connection, so e.g. an SSH tunnel won't do it.
>>>
>>> I looked into this a while ago and there are several suggestions on the
>>> Web as to how to do this on Linux, but those I tried didn't work for
>>> me. At least one idea seemed to involve setting up an alternate network
>>> name space with its own routing, but it's been a while and I'm afraid
I
>>> didn't take note of the details.
>>
>> Hi Patrick,
>>
>> Stéphane Graber of Ubuntu's LXC/D container world has done several
>> things with VPN from passing the vpn to a container where the container
>> sees it as just another eth device, to managing his sundry VPN
>> connections via namespacing.
>>
>> His words:
>>
>> """
>> The code is available at: git clone
>> git://github.com/stgraber/vpn-container. Then it’s as simple as:
>> ./start-vpn VPN-NAME CONFIG
>> """
>>
>> The approach is discussed at https://www.stgraber.org/category/lxc/.
>> Search for VPN in containers for the specific section.
>
> Thanks. The versions I'd seen before didn't involve containers but I'll
> take a look.
Decided to try this, but there's a dependency on something called
uidmap which doesn't seem to exist for Fedora (according to both dnf
search and Google).
I'm not sure about uidmap. What about newuidmap and newgidmap?
4:42 a.m.
New subject: uidmap (was Re: Selective VPN)
On Sat, 2017-01-28 at 20:13 -0800, Mike Wright wrote:
> Decided to try this, but there's a dependency on something
called
> uidmap which doesn't seem to exist for Fedora (according to both dnf
> search and Google).
I'm not sure about uidmap. What about newuidmap and newgidmap?
Same answer.
poc
10:27 p.m.
New subject: uidmap (was Re: Selective VPN)
On 01/28/2017 02:10 PM, Patrick O'Callaghan wrote:
Decided to try this, but there's a dependency on something
called
uidmap which doesn't seem to exist for Fedora (according to both dnf
search and Google).
uid/gid remapping is only required for unprivileged containers. In your
situation that may not be a consideration. IOW, if your system is
locked down a limited purpose/access VM is probably as safe as its host.
Firewall it so as to not allow NEW inbound connections.
4:34 a.m.
New subject: uidmap (was Re: Selective VPN)
On Sat, 2017-01-28 at 20:27 -0800, Mike Wright wrote:
On 01/28/2017 02:10 PM, Patrick O'Callaghan wrote:
> Decided to try this, but there's a dependency on something called
> uidmap which doesn't seem to exist for Fedora (according to both dnf
> search and Google).
uid/gid remapping is only required for unprivileged containers. In your
situation that may not be a consideration. IOW, if your system is
locked down a limited purpose/access VM is probably as safe as its host.
Firewall it so as to not allow NEW inbound connections.
I could have used a VM from the start, but was hoping to avoid the
overhead. That's what containers are meant to provide. I would really
prefer it to be unprivileged.
It's odd that Fedora doesn't seem to support this. I'll have to dig
deeper. Maybe it's just there under another name.
poc
2637
days inactive
2639
days old
10 comments
3 participants
participants (3)
-
Mike Wright -
Patrick O'Callaghan -
Samuel Sieb