Can I assign a virtual interface of wireless to a network namespace?












0















I am trying to make a VPN router while keeping the host itself accessing Internet without VPN. The host has only one NIC which is wireless. So I have added two virtual interfaces via iw phy phy0 interface add xxxxx. One (wlan0_sta) as station to connect wireless to Internet. The other (wlan0_ap) as AP to connect clients. Also a wireguard device (wg0) as VPN endpoint. hostapd and iptables were involved.



Now every part worked, except data from clients were routed to wlan0_sta, instead of wg0. So I planned to have wlan0_ap and wg0 in a separated network namespace to make the routing work. But I found that iw cannot put virtual interface into network namespace. Only a "phy" can be put into network namespace.



So what should I do?










share|improve this question


















  • 1





    In order to achieve what you desire, you do not need a network namespace, but you need to learn what policy routing is. Try this, unix.stackexchange.com/a/22794/49626, then ask again.

    – MariusMatutiae
    Oct 16 '18 at 12:14











  • I think Wireguard's pages have a clever use of built-in mark and ip rule add table main suppress_prefixlength 0 to force traffic into the tunnel (which is anyway policy routing as MariusMatutiae tells): Wireguard Routing & Network Namespaces - Improved Rule-based Routing. Other solutions might be available in that page, like having a dedicated network namespace for all physical interfaces thus compatible with your wifi setup.

    – A.B
    Nov 9 '18 at 12:27













  • @MariusMatutiae, thanks. That is harder than I thought. I have not succeeded yet....

    – Magicloud
    Nov 11 '18 at 1:28











  • @A.B, yes, that was read. I have not got rule based routing working. So I tried the namespace solution, which falled into this question.

    – Magicloud
    Nov 11 '18 at 1:29
















0















I am trying to make a VPN router while keeping the host itself accessing Internet without VPN. The host has only one NIC which is wireless. So I have added two virtual interfaces via iw phy phy0 interface add xxxxx. One (wlan0_sta) as station to connect wireless to Internet. The other (wlan0_ap) as AP to connect clients. Also a wireguard device (wg0) as VPN endpoint. hostapd and iptables were involved.



Now every part worked, except data from clients were routed to wlan0_sta, instead of wg0. So I planned to have wlan0_ap and wg0 in a separated network namespace to make the routing work. But I found that iw cannot put virtual interface into network namespace. Only a "phy" can be put into network namespace.



So what should I do?










share|improve this question


















  • 1





    In order to achieve what you desire, you do not need a network namespace, but you need to learn what policy routing is. Try this, unix.stackexchange.com/a/22794/49626, then ask again.

    – MariusMatutiae
    Oct 16 '18 at 12:14











  • I think Wireguard's pages have a clever use of built-in mark and ip rule add table main suppress_prefixlength 0 to force traffic into the tunnel (which is anyway policy routing as MariusMatutiae tells): Wireguard Routing & Network Namespaces - Improved Rule-based Routing. Other solutions might be available in that page, like having a dedicated network namespace for all physical interfaces thus compatible with your wifi setup.

    – A.B
    Nov 9 '18 at 12:27













  • @MariusMatutiae, thanks. That is harder than I thought. I have not succeeded yet....

    – Magicloud
    Nov 11 '18 at 1:28











  • @A.B, yes, that was read. I have not got rule based routing working. So I tried the namespace solution, which falled into this question.

    – Magicloud
    Nov 11 '18 at 1:29














0












0








0








I am trying to make a VPN router while keeping the host itself accessing Internet without VPN. The host has only one NIC which is wireless. So I have added two virtual interfaces via iw phy phy0 interface add xxxxx. One (wlan0_sta) as station to connect wireless to Internet. The other (wlan0_ap) as AP to connect clients. Also a wireguard device (wg0) as VPN endpoint. hostapd and iptables were involved.



Now every part worked, except data from clients were routed to wlan0_sta, instead of wg0. So I planned to have wlan0_ap and wg0 in a separated network namespace to make the routing work. But I found that iw cannot put virtual interface into network namespace. Only a "phy" can be put into network namespace.



So what should I do?










share|improve this question














I am trying to make a VPN router while keeping the host itself accessing Internet without VPN. The host has only one NIC which is wireless. So I have added two virtual interfaces via iw phy phy0 interface add xxxxx. One (wlan0_sta) as station to connect wireless to Internet. The other (wlan0_ap) as AP to connect clients. Also a wireguard device (wg0) as VPN endpoint. hostapd and iptables were involved.



Now every part worked, except data from clients were routed to wlan0_sta, instead of wg0. So I planned to have wlan0_ap and wg0 in a separated network namespace to make the routing work. But I found that iw cannot put virtual interface into network namespace. Only a "phy" can be put into network namespace.



So what should I do?







routing network-namespaces iw






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Oct 16 '18 at 10:31









MagicloudMagicloud

238213




238213








  • 1





    In order to achieve what you desire, you do not need a network namespace, but you need to learn what policy routing is. Try this, unix.stackexchange.com/a/22794/49626, then ask again.

    – MariusMatutiae
    Oct 16 '18 at 12:14











  • I think Wireguard's pages have a clever use of built-in mark and ip rule add table main suppress_prefixlength 0 to force traffic into the tunnel (which is anyway policy routing as MariusMatutiae tells): Wireguard Routing & Network Namespaces - Improved Rule-based Routing. Other solutions might be available in that page, like having a dedicated network namespace for all physical interfaces thus compatible with your wifi setup.

    – A.B
    Nov 9 '18 at 12:27













  • @MariusMatutiae, thanks. That is harder than I thought. I have not succeeded yet....

    – Magicloud
    Nov 11 '18 at 1:28











  • @A.B, yes, that was read. I have not got rule based routing working. So I tried the namespace solution, which falled into this question.

    – Magicloud
    Nov 11 '18 at 1:29














  • 1





    In order to achieve what you desire, you do not need a network namespace, but you need to learn what policy routing is. Try this, unix.stackexchange.com/a/22794/49626, then ask again.

    – MariusMatutiae
    Oct 16 '18 at 12:14











  • I think Wireguard's pages have a clever use of built-in mark and ip rule add table main suppress_prefixlength 0 to force traffic into the tunnel (which is anyway policy routing as MariusMatutiae tells): Wireguard Routing & Network Namespaces - Improved Rule-based Routing. Other solutions might be available in that page, like having a dedicated network namespace for all physical interfaces thus compatible with your wifi setup.

    – A.B
    Nov 9 '18 at 12:27













  • @MariusMatutiae, thanks. That is harder than I thought. I have not succeeded yet....

    – Magicloud
    Nov 11 '18 at 1:28











  • @A.B, yes, that was read. I have not got rule based routing working. So I tried the namespace solution, which falled into this question.

    – Magicloud
    Nov 11 '18 at 1:29








1




1





In order to achieve what you desire, you do not need a network namespace, but you need to learn what policy routing is. Try this, unix.stackexchange.com/a/22794/49626, then ask again.

– MariusMatutiae
Oct 16 '18 at 12:14





In order to achieve what you desire, you do not need a network namespace, but you need to learn what policy routing is. Try this, unix.stackexchange.com/a/22794/49626, then ask again.

– MariusMatutiae
Oct 16 '18 at 12:14













I think Wireguard's pages have a clever use of built-in mark and ip rule add table main suppress_prefixlength 0 to force traffic into the tunnel (which is anyway policy routing as MariusMatutiae tells): Wireguard Routing & Network Namespaces - Improved Rule-based Routing. Other solutions might be available in that page, like having a dedicated network namespace for all physical interfaces thus compatible with your wifi setup.

– A.B
Nov 9 '18 at 12:27







I think Wireguard's pages have a clever use of built-in mark and ip rule add table main suppress_prefixlength 0 to force traffic into the tunnel (which is anyway policy routing as MariusMatutiae tells): Wireguard Routing & Network Namespaces - Improved Rule-based Routing. Other solutions might be available in that page, like having a dedicated network namespace for all physical interfaces thus compatible with your wifi setup.

– A.B
Nov 9 '18 at 12:27















@MariusMatutiae, thanks. That is harder than I thought. I have not succeeded yet....

– Magicloud
Nov 11 '18 at 1:28





@MariusMatutiae, thanks. That is harder than I thought. I have not succeeded yet....

– Magicloud
Nov 11 '18 at 1:28













@A.B, yes, that was read. I have not got rule based routing working. So I tried the namespace solution, which falled into this question.

– Magicloud
Nov 11 '18 at 1:29





@A.B, yes, that was read. I have not got rule based routing working. So I tried the namespace solution, which falled into this question.

– Magicloud
Nov 11 '18 at 1:29










1 Answer
1






active

oldest

votes


















1














Probably no, at least as in Linux kernel version 4.9 for nl80211-based drivers.






share|improve this answer























    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "106"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: false,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f475769%2fcan-i-assign-a-virtual-interface-of-wireless-to-a-network-namespace%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    1














    Probably no, at least as in Linux kernel version 4.9 for nl80211-based drivers.






    share|improve this answer




























      1














      Probably no, at least as in Linux kernel version 4.9 for nl80211-based drivers.






      share|improve this answer


























        1












        1








        1







        Probably no, at least as in Linux kernel version 4.9 for nl80211-based drivers.






        share|improve this answer













        Probably no, at least as in Linux kernel version 4.9 for nl80211-based drivers.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Jan 16 at 20:14









        Vi.Vi.

        2,41732039




        2,41732039






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Unix & Linux Stack Exchange!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f475769%2fcan-i-assign-a-virtual-interface-of-wireless-to-a-network-namespace%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            How to make a Squid Proxy server?

            Is this a new Fibonacci Identity?

            Touch on Surface Book