VPNNS(1)

💖 VPNNS(1) 💖

okay bestie, welcome to the General Commands Manual entry for vpnns — she's a per-app VPN using namespaces and she's literally the moment. grab a snack, we're doing networking. 🦋

---

✨ NAME ✨

vpnns — per-app VPN using namespaces

---

🌸 SYNOPSIS 🌸

vpnns [--name=identifier] -- command

vpnns [--name=identifier] [--script=path] --attach

---

💅 DESCRIPTION 💅

so here's the vibe: vpnns isolates VPN-related network traffic and applications inside a separate network namespace. no cap, it's giving compartmentalization.

• applications that are meant to be used with the VPN cannot bypass the VPN to access the internet directly 😤
• applications that are not meant to be used with the VPN cannot send traffic through the VPN tunnel 🚫

it's a two-way boundary and she ate. 👑

---

🎀 USAGE 🎀

this starts up an application in a fresh user/net/uts/mount namespace:

vpnns -- google-chrome --user-data-dir=/tmp/vpntest

vpnns -- firefox -no-remote -P vpn

vpnns -- transmission-gtk

initially it will not have any network access, because the only interface present in the netns is the loopback device. that's on purpose, bestie, don't panic. 🙈 the application should still be able to talk to Xorg through UNIX sockets in /tmp.

the next step is to connect to a VPN and invoke vpnns --attach to pass the VPN traffic back and forth:

openconnect --script "vpnns --attach" --script-tun
vpn.example.com

openvpn --script-security 2 --config example.ovpn --dev
"|HOME=$HOME vpnns --attach"

these commands connect to an ocserv or openvpn gateway, then tell vpnns to set up a tunnel device, default route, and resolv.conf inside the namespace created above. on success, the web browser will have connectivity. ⭐ and when the VPN disconnects, the browser will lose all connectivity, preventing leaks. slay. 💅

vpnns can be rerun multiple times if the connection fails or if the VPN client crashes. it's resilient like that. 💪 and if you run it without arguments, it will open a shell inside the namespace. cute little home base. 🏠

---

🔥 OPTIONS 🔥

• -n, --name identifier — vpnns is designed to allow multiple instances to coexist on the same system. this feature could be useful for connecting to multiple VPNs at the same time. 👯 identifier defaults to "default" but can be overridden through the --name option.
• -s, --script path — invoke the program at path to set up and tear down the tunnel device's IP configuration, instead of letting vpnns handle it internally. $TUNDEV will be set to the device name (e.g. tun0). $reason will be set to either connect or disconnect. any IP configuration variables such as $INTERNAL_IP4_ADDRESS set by the VPN client will be inherited, so it is possible for a modified vpnc-script to be used. 🧚 this option only has an effect if --attach is also specified. periodt.

---

😭 CAVEATS 😭

vpnns is not a security tool. it cannot prevent malicious applications from bypassing the namespace restrictions. 💀

while OpenConnect works with vpnns out of the box, OpenVPN currently (as of 2017-01-08) requires out-of-tree patches to support non-root operation. ngl, kind of a lot. 🙈

if /etc/resolv.conf is a symbolic link to a file that is regenerated on network connection changes, the bind mount used by vpnns to override the DNS configuration can be inadvertently deleted. vpnns attempts to work around this by using overlayfs to override /etc/resolv.conf, but that does not work on all systems. 😭

some distributions patch their kernels to prevent unprivileged users from creating namespaces, resulting in a "can't unshare namespaces: Operation not permitted" error. this security feature can be disabled using the following command:

sudo sysctl -w kernel.unprivileged_userns_clone=1

to make the change permanent, edit /etc/sysctl.conf. ⚠️

---

🌈 FILES 🌈

• ~/.vpnns-identifier — state directory for a given vpnns instance. by default, vpnns uses ~/.vpnns-default. 💾

---

🫶 SEE ALSO 🫶

ocproxy(1), openconnect(8), openvpn(8)

---

and that's the whole page, bestie!! this one's from the VPNNS(1) manual, dated January 8, 2017 — yeah she's a classic, an OG, a vintage queen, and she still serves. go forth and namespace responsibly. 💖✨🎀🦋🌸💅