Arch Linux

BasT

Member

Registered: 2010-08-28

Posts: 117

ktorrent isn't properly contained by network namespace

Old title: Routing through VPN leaks IP address

I have set up a network namespace with the traffic entering the host through veth0. For now I would like to route all traffic from veth0 (10.1.1.1) to the vpn device tun0 (10.18.18.12).

ip routes

default via 10.18.18.1 dev tun0 table 200 
10.18.18.0/24 dev tun0 table 200 scope link src 10.18.18.12
default via 192.168.17.1 dev eth0 proto dhcp metric 100 
10.1.1.0/24 dev veth0 proto kernel scope link src 10.1.1.1 
10.8.8.0/24 dev tun0 proto kernel scope link src 10.8.8.17 
192.168.17.0/24 dev eth0 proto kernel scope link src 192.168.17.5 metric 100

ip rules

ip rule show
0:      from all lookup local 
1000:   from all iif veth0 lookup 200 
1001:   from all iif tun0 lookup 200 
32766:  from all lookup main 
32767:  from all lookup default 

And finally the NAT.

iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

All this works fine for most purposes like

curl http://ip.changeip.com [from inside the network namespace]
--> returns the VPN IP

However if I start ktorrent inside the namespace and check the IP via https://torguard.net/checkmytorrentipaddress.php, it shows me my actual WAN, not the VPN's.

I've tried a whole bunch of iptables rules, hoping to fix it but sofar no success. I guess the main issue is, I don't understand what the problem is in the first place.

Last edited by BasT (2017-12-22 13:27:57)

BasT

Member

Registered: 2010-08-28

Posts: 117

Re: ktorrent isn't properly contained by network namespace

So I got deluge working in the netns and here there is no IP leakage. Maybe this is an issue of ktorrent somehow breaking out of the namespace? Maybe via dbus or something?

BasT

Member

Registered: 2010-08-28

Posts: 117

Re: ktorrent isn't properly contained by network namespace

Seems my suspicion was correct. If I take veth0 down and even pinging doesn't work from the netns, ktorrent will still make a connection.