Anyone new to this topic, just skip to this post
OLD POST:
Background:
I have been diving into options to run OpenVPN for apps that need it. The idea is that some applications like Torrent clients and torrent scrapers like Flexget, Sickrage, Sonarr etc would need to go via VPN (depending on the country you live in). While other applications like Kodi, SyncThing, BittorrentSync, OwnCloud etc etc gain nothing by going through your VPN. Actually their speed will most likely decrease. Also, for Kodi, you might not be able to watch certain content (like BBC) since it has geo restrictions. You might want a specific VPN geo for those things, which is an entirely different requirement for VPN compared to Torrents and would rather be a solution in the form of a Kodi addon allowing you to turn on/off VPN for Kodi and to select a GEO/VPN from your couch with your TV remote. I am really talking about non-Kodi, apps that allow you to get content. Most people will want those apps to go via VPN permanently.
Solution:
For those reasons, it does not make sense to me to simply run OpenVPN on my OSMC device (or router) and let all network traffic go through that VPN server. Therefore, I am looking into the best solution to have specific applications always access the internet via VPN. If VPN is down, the applications do not have internet access.
From my online research, the best way to do this is to run OpenVPN within a seperate network namespace and make sure the applications that need to go through VPN will run within that network namespace. The latter seems the easiest part. The first is the one I am having trouble with.
Once I have got this working, I will post a NOOB HowTo for everyone, which will change the OSMC service scripts that run for example Transmission in such a way it will always run via the namespace, integrating nicely with OSMC’s options to start/stop any app.
The solution I found is described at the bottom of this question:
And it is completely based on this: Running an OpenVPN tunnel inside a network namespace
But for easy reading, i am quoting the information from those websites:
1. First create an --up script for OpenVPN. This script will create the VPN tunnel interface inside a network namespace called vpn, instead of the default namespace.
#!/bin/sh
case $script_type in
up)
ip netns add vpn
ip netns exec vpn ip link set dev lo up
mkdir -p /etc/netns/vpn
echo "nameserver 8.8.8.8" > /etc/netns/vpn/resolv.conf
ip link set dev "$1" up netns vpn mtu "$2"
ip netns exec vpn ip addr add dev "$1" \
"$4/${ifconfig_netmask:-30}" \
${ifconfig_broadcast:+broadcast "$ifconfig_broadcast"}
test -n "$ifconfig_ipv6_local" && \
ip netns exec vpn ip addr add dev "$1" \
"$ifconfig_ipv6_local"/112
;;
route-up)
ip netns exec vpn ip route add default via "$route_vpn_gateway"
test -n "$ifconfig_ipv6_remote" && \
ip netns exec vpn ip route add default via \
"$ifconfig_ipv6_remote"
;;
down)
ip netns delete vpn
;;
esac
2. Then start OpenVPN and tell it to use our --up script instead of executing ifconfig and route.
openvpn --ifconfig-noexec --route-noexec --up netns-up --route-up netns-up --down netns-up
3. Now you can start programs to be tunneled like this:
ip netns exec vpn command
The only catch is that you need to be root to invoke ip netns exec … and maybe you do not want your application to run as root. The solution is simple:
sudo ip netns exec vpn sudo -u $(whoami) command
END OF QUOTE
Problem:
The problem I am having is with the script. When I run the command from step 2, this is my output:
:/etc/openvpn$ sudo openvpn --ifconfig-noexec --route-noexec --up netns-up --route-up netns-up --down netns-up --config za1.nordvpn.com.tcp443.ovpn
(..)
Tue Mar 22 00:10:56 2016 [vpn-za.nordvpn.com] Peer Connection Initiated with [AF_INET]154.127.61.142:443
Tue Mar 22 00:10:59 2016 SENT CONTROL [vpn-za.nordvpn.com]: 'PUSH_REQUEST' (status=1)
Tue Mar 22 00:10:59 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 78.46.223.24,dhcp-option DNS 162.242.211.137,route 10.7.7.1,topology net30,ping 5,ping-restart 30,ifconfig 10.7.7.102 10.7.7.101'
Tue Mar 22 00:10:59 2016 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 22 00:10:59 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 22 00:10:59 2016 OPTIONS IMPORT: route options modified
Tue Mar 22 00:10:59 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Mar 22 00:10:59 2016 ROUTE_GATEWAY 192.168.1.254/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:39:7e:46
Tue Mar 22 00:10:59 2016 TUN/TAP device tun0 opened
Tue Mar 22 00:10:59 2016 TUN/TAP TX queue length set to 100
Tue Mar 22 00:10:59 2016 netns-up tun0 1500 1592 10.7.7.102 10.7.7.101 init
Tue Mar 22 00:10:59 2016 WARNING: Failed running command (--up/--down): external program exited with error status: 1
Tue Mar 22 00:10:59 2016 Exiting due to fatal error
I tried to trace the error by executing the commands from the script listed under the “UP” case one by one. The following command seems to be incorrect:
sudo ip link set dev "$1" up netns vpn mtu "$2"
because it shows me how to use “IP LINK”, so clearly the command is using IP LINK incorrectly. I read about this command but I have no idea how to fix this so I am completely stuck.
I have posted this issue in the OpenVPN forum but to my suprise there has been little response. I tried replying on the stackexchange.com question, replying to the person with the answer at the bottom but I do not have enough credits to do so. I even created a whole new question on stackexchange with 0 response. I hope someone with Linux network experience can help me out here.
Now hoping someone can fix the script for Debian Stretch.