Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/laserbat/vpnify

vpnify - transparently route traffic of a process through VPN
https://github.com/laserbat/vpnify

containers namespaces netns network privacy vpn

Last synced: about 2 months ago
JSON representation

vpnify - transparently route traffic of a process through VPN

Awesome Lists containing this project

README 

        
vpnify

==



This tool can be used to transparently route traffic of certain programs through VPN, while keeping the rest of it routed normally. It is protocol-agnostic and can work with any VPN software.



For example:



    vpnify sudo openvpn --config vpn.conf



Creates an isolated VPN connection. To make a program use this connection, you can use



    vpnify 



That's all. No configuration needed. It creates network namespace and configures it on the first run and deletes it once the last process using it exits.



Installation

--



Just copy to /usr/local/bin/



    sudo cp $HOME/vpnify/vpnify /usr/local/bin/vpnify



Multiple VPN's

--

To create two or more distinct VPN connections, you just need to create a new symlink.



    ln -s /usr/local/bin/vpnify /usr/local/bin/vpnify2



Now you can do this:



    vpnify sudo openvpn --config vpn.conf

    vpnify2 sudo openvpn --config vpn2.conf



Programs run with vpnify2 will use different connection from programs run with vpnify.



Custom resolv.conf and hosts

--



You can put your custom hosts and resolv.conf file to /etc/vpnify/ (or /etc/vpnify/\ for a symlinked version). 



Also you can create folders named "pre.d" and "post.d" in the same folder with custom hooks that will be executed before running the supplied command inside the namespace and after the cleanup respectively.



Advanced features: Limiting clearnet access

--

You can use hooks to limit clearnet access by the applications run inside vpnify. First let's create a folder /etc/vpnify/pre.d/:



    mkdir -p /etc/vpnify/pre.d/



Or, if you want to setup a symlinked version,



    mkdir -p /etc/vpnify//pre.d/



Now we need to create a hook that will execute firewall commands:



    vim /etc/vpnify/pre.d/limit.sh



Contents of this file can be something like:



    iptables -I FORWARD -i $VETH0 -j DROP # Drop all outgoing traffic

    iptables -I FORWARD -i $VETH0 -d 198.51.100.157 -p udp --destination-port 1024 -j ACCEPT # Allow ONLY packets going to your VPN server



Where 198.51.100.157 is IP address of your VPN server. Replace udp/1024 with transport protocol your VPN uses it's port.

This forbids all outgoing traffic from inside vpnify except for traffic going to 198.51.100.157 udp:1024.



Don't forget to make the hook executable!



    chmod +x /etc/vpnify/pre.d/limit.sh



If your VPN configuration uses a hostname you need to add this hostname to /etc/vpnify/hosts (which will be /etc/hosts inside the namespace).

Otherwise it will fail to resolve, since all traffic outside is blocked.



Take a look at files in example-hooks/\*.d/limit.sh for a better explanation and a clean-up hook!



unVpnify

---

You can use this script to route all the traffic on your machine through a VPN *except* for applications running inside (un)vpnify!



To do this, let's create a symlink:



    ln -s /usr/local/bin/vpnify /usr/local/bin/unvpn



Then, we create the configuration folders



    mkdir -p /etc/vpnify/unvpnify/pre.d/

    mkdir -p /etc/vpnify/unvpnify/post.d/



And now, create a hook that does some routing magic. Look [here](https://www.thomas-krenn.com/en/wiki/Two_Default_Gateways_on_One_System) for a deeper explanation of routing commands used in this hook.



    vim /etc/vpnify/unvpnify/pre.d/unvpn.sh



    ip rule add iif $VETH0 table rt2 # Route all traffic from our namespace through a second routing table

    ip route add default via 192.168.1.1 table rt2 # Set up the default gateway on our second table



    chmod +x /etc/vpnify/unvpnify/unvpn.sh



Also we need to add the 'rt2' routing table to our system:



    echo '1 rt2' >> /etc/iproute2/rt_tables



Check out example-hooks/\*.d/unvpn.sh for more information and a clean-up hook.



bashrc

---



You might want your bash prompt to change when you are using vpnify, so you can easily tell apart which consoles are runing through vpnify and which are not. Luckily it is very easy to do. Just put something like this in your bashrc:



    netns() {

        [[ -z "$NETNS" ]] || echo "[$NETNS]"

    }



    PS1="$(netns)$PS1"



sudoers

---



If you want to use this script without having to type your password every time, you can add this line to your /etc/sudoers



    %wheel ALL=(ALL) NOPASSWD:SETENV: /usr/local/bin/vpnify



**Warning: this might not be secure, use with caution.**



Compatibility

--



This script should work on any modern linux that supports network and mount namespaces and has nsenter command available. I have tested it on Void Linux, Ubuntu 16.04, CentOS 6.5 and 7.