dwmw2 at infradead
Jun 4, 2009, 5:12 PM
Post #1 of 6
(1372 views)
Permalink
|
|
VPN without messing with routes.
|
|
I've been playing with ways to maintain a fairly clean separation
between real-world networking and the VPN. Keeping them in order can be
really painful when there are a lot of 'real' IP addresses which need to
be routed through your VPN and you can't just have a simple rule of
"RFC1918 addresses through VPN, real addresses to the real world".
The network namespace support which has been added to the Linux kernel
recently means that there are a bunch of interesting things we can do.
You start by moving vpnc's tundev into a private namespace of its own,
where it's the _only_ network device (and, of course the default route).
Then do whatever you like to expose that to the 'real' network namespace
in a controlled fashion.
One option, of course, is just to run a SOCKS server in the VPN's
network-namespace, set up so that it can listen for requests from the
normal network-namespace, and forward them on the VPN. You could perhaps
use this script as the basis for something which does that, but this
script does something different instead...
What this script does it make any address xx.yy.zz.ww on the VPN
reachable not by IPv4, but instead by making an _IPv6_ connection to the
address fec0:0:0:ffff:0:0:xxyy:zzww -- using the same mechanism (NAT-PT)
that lets IPv6-only hosts talk to Legacy IP networks.
So rather than messing with the IPv4 routing in the 'normal' system, you
just hijack an otherwise-unused tiny corner of the IPv6 address space
instead -- and you can get to _all_ hosts on the VPN, and all hosts in
your normal IPv4 address space simultaneously.
I haven't yet completely sorted out DNS. Obviously you want to couple
this with a trick DNS server that will return appropriately-mapped IPv6
addresses whenever it's asked for a host within the VPN domain.
There's totd which does almost mostly what we want, but it's not quite
right -- if we ran that we'd _also_ have to run dnsmasq to split VPN
queries from real-world queries anyway. Since dnsmasq can do a huge
amount of munging of queries already, it's probably best to add
this kind of support to dnsmasq. It shouldn't be hard.
Based on an earlier implementation by Johannes.
--
dwmw2
|
vpnc-netns.sh
vpnc-script-sshd
