Set the interface of non-interface aware commands.

Comments

• lukast__

  May 10

  Is there any kind of mechanism to define the default interface system-wide or command-wide (maybe some wrapper?) without having to fiddle around with iptables or similar?

  There are some LD_PRELOAD libraries, although that only works with dynamically linked programs (and maybe only with glibc), and there is the (rather complex) possibility to use network namespaces. But AFAIK there is no simple solution.

  cpu_logger | Recommended providers: Layer7, dataforest (Avoro/PHP-Friends), @host_c
• itsdeadjim

  May 10

  Yeah probably with namespaces:

  ip netns add ns1
  ip link set eth3 netns ns1
  ip netns exec ns1 bash
  

  Thanked by (3)ehab Not_Oles foxone
• wankel OG

  May 10

  @foxone said:
  These are very nice to use because they also prevent leaking data to other interfaces.

  Somewhat off-topic, did you mention that because of this VPN-for-privacy attack, that circumvents VPN-interfaces by creating rogue higher-priority routes? I read about that on Arstechnica. What's your impression?
• foxone OG

  May 11

  @wankel said:

  @foxone said:
  These are very nice to use because they also prevent leaking data to other interfaces.

  Somewhat off-topic, did you mention that because of this VPN-for-privacy attack, that circumvents VPN-interfaces by creating rogue higher-priority routes? I read about that on Arstechnica. What's your impression?

  In that case link-local addresses are not routable so you cannot add a rogue route to them.

  Thanked by (1)wankel
• VSYS_Host

  May 14

  Programs that do not accept %interface for ipv6 have not been developed to work with link-local addresses. Such programs most likely use the getaddrinfo() function that will return an error for link-local address without interface specifying, and your program will not send any packets in this case. Even if they directly use syscalls, for example, sendto(), it will also expect an interface in socket structure, and overall behavior will be the same. And this can't be solved with any kind of routes/firewall forwarding.

  Thanked by (1)yoursunny
• foxone OG

  May 15

  Sad. At the end i had to make a whole RFC4193 subnet