Re: [Vserver] can't terminate OpenVPN tunnel within a vserver?

From: Baltasar Cevc <>
Date: Tue 04 Jul 2006 - 23:38:30 BST
Message-Id: <>

Hash: SHA1


On 04.07.2006, at 10:29, Daniel W. Crompton wrote:
> On 7/3/06, Eugen Leitl <> wrote:
>> On Mon, Jul 03, 2006 at 12:12:34PM +0200, Baltasar Cevc wrote:
>> > >I can't have an OpenVPN tunnel terminate in a vserver,
>> > >can I?
> You can, I just did it yesterday. You need to set the following in the
> file "bcapabilities":
I haven't tested it myself as I run OpenVPN in the host system only,
but I'd say that these caps are not nice to give to a guest, as far as
I know, you could more or less do any network operation (for any
interface) in the guest then.

However, maybe, you will have to do this to get it working. I can't
remember any option that could make OpenVPN use an already existing
interface (I don't know how tun/tap work, thus whether that would be
feasible at all). It should be worth searching the OpenVPN and/or
kernel docs about that, though.

Just quickly searching around, my understanding is that you have to
create the tun device on the host (which is what you want from a
security perspective). Afterwards you can assign it to a guest and
OpenVPN should be happy to use that one. However that seems to work
with tap, I assume it won't work using tun as a device.

> Add if you want to load the module inside the vserver on access:
That would be quite crazy, I'd say. You could load anything, thus
provide the guest with any priviledge ever wanted...
You absolutely want to load the modules manually on the host and never
give the guest permission to do so.

> Add if you want to mknod the device inside the vserver:
Quite dangerous, too, as it enables you to access the whole HD for


((( Baltasar Cevc

) World wide web:
   * (a project for the local youth; German
   * (programming and admin projects)
   * (private homepage)
) Phone:
   +49 176 232 20 822
Version: GnuPG v1.2.4 (Darwin)


Vserver mailing list
Received on Tue Jul 4 23:39:07 2006

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 04 Jul 2006 - 23:39:15 BST by hypermail 2.1.8