Firejail: Run program with the tun0 interface

[Bundy01]

Hi,

I would like to run firefox only in my VPN interface (disconnect if my VPN picks up).
I tried adding net tun0 in the profile or running it with this command: firejail --net=tun0 firefox. I have that mistake:

Reading profile /etc/firejail/firefox-developer-edition.profile
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 13426, child pid 13427
RTNETLINK answers: Invalid argument
Error: failed to run /usr/lib/firejail/fnet
Error ioctl: interface.c:98 net_if_up: No such device
Error: failed to run /usr/lib/firejail/fnet
Error: proc 13426 cannot sync with peer: unexpected EOF
Peer 13427 unexpectedly exited with status 1

Is it possible it could work?

[netblue30]

I did some experiments here, it should definitely work. I'll bring in support for tap devices in two or three days.What tunneling software are you using: openvpn, wireguard ...?

Also, when you set the tunnel, does it assign an address to your tap interface? If you do /sbin/ifconfig or "ip addr show" what address do you get? I'm asking because the sandbox will automatically assign an address for the interface connected to your tap device and we need to make sure the address is on the same network as the tap device.

[Bundy01]

Hi,
I use openvpn and my interface name is tun0 and that of my ethernet connection enp3s0f1.
Thanks

[netblue30]

tun device will not work, you need a tap device. Move openvpn to a bridging configuration, they have an example here: https://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html. Basically you must use server-bridge and dev tap instead of server and dev tun in your configuration.

On the client you connect firejail to the tap device. Use the firejail version in git, I just added support for tap devices.
(this is a simple sandboxed /bin/bash session) $ firejail --net=tap0 --noprofile
Then, try to ping the server end of the tunnel. There could be a problem with how openvpn assigns the address, but we'll figure it out.

There is also a similar discussion going on here: #2046

[Futureknows]

Is this why routed network setups (--net=br0) are broken when the OS openvpn connection is activated? My direct networked ethernet devices (--net=eth0) allow me to activate/deactivate a VPN through the system network manager seamlessly, but on wifi devices activating openvpn breaks the connection on firejailed network namespaced sandboxes.

[Bundy01]

I've checked the tap interface of my vpn provider, but unfortunately I can't connect with tap :(

[veloute]

In the case that this isn't added, you could look into something like vpnfailsafe, which uses iptables to prevent internet access if the VPN tunnel drops (thereby preventing IP and DNS leaks).

[Bundy01]

Hi,
I finally opted for ufw, the following rules seem to work:

ufw default deny incoming
ufw default deny outgoing
ufw allow out on tun0
ufw allow out on enp3s0f1 proto udp from 192.168.1.1 to any port 1194

[sebastianst]

This is an old issue #59. Many VPN providers don't support tap interfaces, so please find a solution, maybe with network namespaces?

[kramer9]

I +1 the request to be able to direct the traffic directly to a vpn (--net=tun0)

[rugabunda]

+1 Definitely would like to see support for tun.

[intika]

An other solution is to use a bridge and iptables to route the jail over the tun interface https://firejail.wordpress.com/documentation-2/basic-usage/#routed (require masquerade and vlan kernel modules + ip_forward enabled) ...
supporting tun interface would really be amazing

[rusty-snake]

Is this a duplicate of #1814? If so, we can close.

[intika]

@rusty-snake you are right ;)

[rusty-snake]

Duplicate of #1814