Fj Graf

App isolation with Namespace

Written by

fjgraf

in

Isolation of firefox from the internet script to communicate only with openwebui.

#!/bin/bash

# --- CONFIGURATION ---
NS_NAME="restricted_net"
VETH_HOST="172.200.1.1"
VETH_NS="172.200.1.2"
TARGET_IP="192.168.1.100"

# 1. CLEANUP (Wipe the slate clean)
echo "Cleaning up..."
sudo ip netns delete $NS_NAME 2>/dev/null
sudo ip link delete veth-host 2>/dev/null
# Clean old NAT/Forward rules to avoid "Rule already exists"
sudo iptables -t nat -D POSTROUTING -s $VETH_NS/32 -j MASQUERADE 2>/dev/null
sudo iptables -D FORWARD -s $VETH_NS/32 -j ACCEPT 2>/dev/null
sudo iptables -D FORWARD -d $VETH_NS/32 -j ACCEPT 2>/dev/null

# 2. CREATE NAMESPACE & LINK
sudo ip netns add $NS_NAME
sudo ip link add veth-host type veth peer name veth-ns
sudo ip link set veth-ns netns $NS_NAME

# 3. ADDRESSING
sudo ip addr add $VETH_HOST/24 dev veth-host
sudo ip netns exec $NS_NAME ip addr add $VETH_NS/24 dev veth-ns

# 4. BRING UP INTERFACES
sudo ip link set veth-host up
sudo ip netns exec $NS_NAME ip link set veth-ns up
sudo ip netns exec $NS_NAME ip link set lo up

# 5. ROUTING: The "Precision" Path
# We tell the bubble: "To reach your specific target, go through the host."
sudo ip netns exec $NS_NAME ip route add $TARGET_IP/32 via $VETH_HOST dev veth-ns

# 6. SYSTEM-WIDE FORWARDING (Kernel Level)
sudo sysctl -w net.ipv4.ip_forward=1 > /dev/null

# 7. FIREWALL: Open the "Gates"
# This tells the Debian firewall to allow the traffic to pass through the host
sudo iptables -A FORWARD -s $VETH_NS/32 -j ACCEPT
sudo iptables -A FORWARD -d $VETH_NS/32 -m state --state ESTABLISHED,RELATED -j ACCEPT

# 8. NAT (MASQUERADE)
# This makes the target see your host's IP instead of the 10.200.x.x IP
sudo iptables -t nat -A POSTROUTING -s $VETH_NS/32 -j MASQUERADE

# 9. PERMISSION TO DRAW WINDOWS
xhost +local: > /dev/null

echo "-------------------------------------------------------"
echo "Targeting: $TARGET_IP"
echo "Testing path with 2 pings..."
sudo ip netns exec $NS_NAME ping -c 2 -W 2 $TARGET_IP
echo "-------------------------------------------------------"

# 10. LAUNCH FIREFOX
# --no-remote is CRITICAL
# sudo ip netns exec $NS_NAME sudo -u $USER firefox --no-remote         # No Auto Redirection
sudo ip netns exec $NS_NAME sudo -u $USER firefox --no-remote "http://192.168.1.100:8080"

Now lets configure a new shortcut so that when firefox executes, the script to run the namespace configuration is initialised every time it’s launched leaving firefox in its own bubble. Your sudo password will be prompted.

Save the following config in:

.local/share/applications/vault-firefox.desktop
  GNU nano 8.4            .local/share/applications/vault-firefox.desktop                     
[Desktop Entry]
Categories=Network;WebBrowser;
Comment=Isolated Firefox for VM Access
Exec=kdesu /home/bee/namespace/LAN-only-Firefox.sh
Icon=firefox-esr-symbolic
Name=Firefox Vault
NoDisplay=false
Path=
PrefersNonDefaultGPU=false
StartupNotify=true
Terminal=false
TerminalOptions=
Type=Application
X-KDE-SubstituteUID=false
X-KDE-Username=

More posts