This isn't a fedora-specific question, but I don't know where to ask.
If there's a fedora-specific answer, thanks, and if not, I'd appreciate a pointer to the apprpropriate forum.
I normally use a VPN that routes through another country. This works fine. However, a site I often use recently changed its security policies and now will only allow connection from networks that claim to be based in the US. So, in order to connect, I either have to turn off my VPN or rout it through a US proxy or just my ISP -- which I can do, but I resent it a little.
So, I was thinking about adding another network card. I'd have one attached to my VPN and another attached just to the ISP. I'd like for some applications to use one card and other applications to use another, e.g. my browser to use the ISP-attached card and my email client to use the VPN-attached card.
I've set up machines as bridges and gateways before, and I can configure moving traffic between two cards, but I've never tried to have different applications use different cards.
Is this doable? Does anybody know where to look for info?
Thanks!
billo
On Tue, 2020-11-17 at 09:00 -0500, William Oliver wrote:
This isn't a fedora-specific question, but I don't know where to ask.
If there's a fedora-specific answer, thanks, and if not, I'd appreciate a pointer to the apprpropriate forum.
I normally use a VPN that routes through another country. This works fine. However, a site I often use recently changed its security policies and now will only allow connection from networks that claim to be based in the US. So, in order to connect, I either have to turn off my VPN or rout it through a US proxy or just my ISP -- which I can do, but I resent it a little.
So, I was thinking about adding another network card. I'd have one attached to my VPN and another attached just to the ISP. I'd like for some applications to use one card and other applications to use another, e.g. my browser to use the ISP-attached card and my email client to use the VPN-attached card.
I've set up machines as bridges and gateways before, and I can configure moving traffic between two cards, but I've never tried to have different applications use different cards.
Is this doable? Does anybody know where to look for info?
It is theoretically possible to get the same result without having to buy a new card. Some VPNs support "split tunnelling", which will in effect create an additional virtual interface and let you connect to selected destinations through it rather than the default. AFAIK it all involves playing games with network namespaces ('ip -netns ...').
I say "theoretically" because I've never actually managed to get this to work in Fedora, though there are several articles on the subject for other distros.
Note that even if you buy a new card, it will still be connected to your ISP, so I don't think you'll gain anything.
poc
On 17 Nov 2020, at 14:00, William Oliver vendor@billoblog.com wrote:
This isn't a fedora-specific question, but I don't know where to ask.
If there's a fedora-specific answer, thanks, and if not, I'd appreciate a pointer to the apprpropriate forum.
I normally use a VPN that routes through another country. This works fine. However, a site I often use recently changed its security policies and now will only allow connection from networks that claim to be based in the US. So, in order to connect, I either have to turn off my VPN or rout it through a US proxy or just my ISP -- which I can do, but I resent it a little.
So, I was thinking about adding another network card. I'd have one attached to my VPN and another attached just to the ISP. I'd like for some applications to use one card and other applications to use another, e.g. my browser to use the ISP-attached card and my email client to use the VPN-attached card.
I've set up machines as bridges and gateways before, and I can configure moving traffic between two cards, but I've never tried to have different applications use different cards.
Is this doable? Does anybody know where to look for info?
Why not add a second VPN connection that comes out in the US and setup routing to use that for your app that wants a US IP.
Barry
Thanks!
billo _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
On 11/17/20 10:00 AM, William Oliver wrote:
Is this doable? Does anybody know where to look for info?
What about running that 2nd VPN (US-based) within a standard container? Then open your needed apps "in that same network namespace"? (the network namespace of the container running the VPN). I've never done it but I believe is doable.
HTH Jorge
On 11/17/20 2:44 PM, Jorge Fábregas wrote:
On 11/17/20 10:00 AM, William Oliver wrote:
Is this doable? Does anybody know where to look for info?
What about running that 2nd VPN (US-based) within a standard container? Then open your needed apps "in that same network namespace"? (the network namespace of the container running the VPN). I've never done it but I believe is doable.
Ok, I've just did it now. I launched my VPN within a container. Then on my host I searched for the $PID of the process and then:
nsenter -t $PID -n firefox
Now Firefox shares the network namepsace of the running container (without having to create a "firefox container" beforehand...).
I did this test as root.
HTH, Jorge
On Tue, 2020-11-17 at 15:14 -0400, Jorge Fábregas wrote:
On 11/17/20 2:44 PM, Jorge Fábregas wrote:
On 11/17/20 10:00 AM, William Oliver wrote:
Is this doable? Does anybody know where to look for info?
What about running that 2nd VPN (US-based) within a standard container? Then open your needed apps "in that same network namespace"? (the network namespace of the container running the VPN). I've never done it but I believe is doable.
Ok, I've just did it now. I launched my VPN within a container. Then on my host I searched for the $PID of the process and then:
nsenter -t $PID -n firefox
Now Firefox shares the network namepsace of the running container (without having to create a "firefox container" beforehand...).
I did this test as root.
I've done this successfully using a VM, but not with a container. Can you give step-by-step instructions? I'm not very familiar with the container stuff other than basic uses of flatpak.
poc
On 11/17/20 6:22 PM, Patrick O'Callaghan wrote:
I've done this successfully using a VM, but not with a container. Can you give step-by-step instructions? I'm not very familiar with the container stuff other than basic uses of flatpak.
Well there are no specific steps. It'll all depend on what VPN do you use and what container engine you use like docker, podman etc. There's a whole world when it comes to containerization :) You can search for fedora & podman tutorials. There are plenty.
In a nutshell, instead of running a full VM with a VPN just so that you have a level of isolation (network-wise), which is overkill, you simply run a small container.
If you could run your VPN within a container (launched via podman) then you can attach your regular non-containerized applications to the container's network-namespace. They'll be just "contained" network-wise.
Again, you'll need to have a basic understanding of how containers work underneath (the different Linux namespaces etc) in order to play out with this stuff.
Cheers!
On 2020-11-17 20:14, Jorge Fábregas wrote:
Ok, I've just did it now. I launched my VPN within a container. Then on my host I searched for the $PID of the process and then:
nsenter -t $PID -n firefox
Now Firefox shares the network namepsace of the running container (without having to create a "firefox container" beforehand...).
Very good idea, namespaces are a very powerful tool that many people ignore.
I sometimes want to run a program without allowing any network access, my approach is:
unshare -n /bin/bash
this will give you a shell where everything can be run, but ifconfig -a will show you that there is no network interfaces (localhost is missing too).
In your case you should play with the VPN in the secondary namespace, where you have to arrange a way to have some way traffic out, so that the VPN can work. The idea of letting podman do all the setup and then "borrow" the namespace for something out of the container is very smart.
("container" is a meaningless word; the kernel only knows about namespaces, you can use or not each of them, in your case network is all you need...)
Best regards.
On 11/18/20 6:51 AM, Roberto Ragusa wrote:
unshare -n /bin/bash
this will give you a shell where everything can be run, but ifconfig -a will show you that there is no network interfaces (localhost is missing too).
Never thought about that one. Great idea.
The idea of letting podman do all the setup and then "borrow" the namespace for something out of the container is very smart.
Indeed! If it wasn't for podman one had to create the namespace, bridge interface on host, the tap interfaces, assign IPs to them, insert proper firewall rules. and so on. I like how you phrased that.
("container" is a meaningless word; the kernel only knows about namespaces, you can use or not each of them, in your case network is all you need...)
Right on.
On Wed, 2020-11-18 at 11:51 +0100, Roberto Ragusa wrote:
[snip] Very good idea, namespaces are a very powerful tool that many people ignore.
I sometimes want to run a program without allowing any network access, my approach is:
unshare -n /bin/bash
this will give you a shell where everything can be run, but ifconfig -a will show you that there is no network interfaces (localhost is missing too).
In your case you should play with the VPN in the secondary namespace, where you have to arrange a way to have some way traffic out, so that the VPN can work. The idea of letting podman do all the setup and then "borrow" the namespace for something out of the container is very smart.
("container" is a meaningless word; the kernel only knows about namespaces, you can use or not each of them, in your case network is all you need...)
Best regards.
-- Roberto Ragusa mail at robertoragusa.it
I'd like to say thanks to everybody who responded. I don't know much about containers, so I'll have to do some self-educating to see if these are good solutions -- but they certainly look like a good place to dig around in. I appreciate the help. If I get a solution, I'll check back in and let folk know how it turned out.
billo
On 11/18/20 8:52 AM, William Oliver wrote:
I'd like to say thanks to everybody who responded. I don't know much about containers, so I'll have to do some self-educating to see if these are good solutions -- but they certainly look like a good place to dig around in. I appreciate the help. If I get a solution, I'll check back in and let folk know how it turned out.
For your simple use-case, a routing rule would be a lot easier.
On 11/17/20 6:00 AM, William Oliver wrote:
I normally use a VPN that routes through another country. This works fine. However, a site I often use recently changed its security policies and now will only allow connection from networks that claim to be based in the US. So, in order to connect, I either have to turn off my VPN or rout it through a US proxy or just my ISP -- which I can do, but I resent it a little.
Just add a routing rule for the IP or range for that site that uses your ISP gateway. That will override the default gateway of your VPN.
I still generally use the "route" command although it's deprecated in favour of "ip route".
On 17Nov2020 09:00, William Oliver vendor@billoblog.com wrote:
I normally use a VPN that routes through another country. This works fine. However, a site I often use recently changed its security policies and now will only allow connection from networks that claim to be based in the US. So, in order to connect, I either have to turn off my VPN or rout it through a US proxy or just my ISP -- which I can do, but I resent it a little.
My approach isn't app sepecific, it's domain/website specific.
I run a local proxy (squid in my case) and route everything through it. I've got a persistent ssh tunnel to a US VM etc, with a proxy on the VM.
Then I just configure the proxy rules to choose the appropriate upstream proxy for special domains (including "DIRECT" - no upstream proxy).
"What a PITA" I hear you say. But I actually drive the rules from a simple text file. AN upstream proxy is defined thus:
UPSTREAM1=host:port
and a rule looks like:
UPSTREAM *.wikipedia.org *.wikia.com
Obviously, pick memorable proxy nammes. The name "DIRECT" is special in my script and turns into "no proxy". Like any ACL, rules apply in the order in the file: first match is chosen.
I run squid via my svcd command, which accepts a signature argument - when the proxy rule file changes, the squid.conf ACLs get recomputed and squid is restarted. So adjusting the rule just means editing the file and waiting a few seconds for the restart.
The rule generation is done by my proxy-peerage script, which emits acl definitions and cache_peer directives. I patch the squid.conf from that.
My proxy-peerage script is here:
https://hg.sr.ht/~cameron-simpson/css/browse/bin/proxy-peerage?rev=tip
along with everything else.
Cheers, Cameron Simpson cs@cskk.id.au
-
Barry Scott -
Cameron Simpson -
Jorge Fábregas -
Patrick O'Callaghan -
Roberto Ragusa -
Samuel Sieb -
William Oliver