Change iptables rules

[nick75e]

iptables rules can only be set when starting a sandbox. Is it possible to have an option to load a different config file while a sandbox is running.

Thanks.

[netblue30]

Use --join-network. It is very flexible, you can do much more than changing netfilter, you can also change IP addresses, add interfaces etc. Example:

# start firefox
$ firejail --net=eth0 --name=browser firefox &

# change netfilter configuration
$ sudo firejail --join-network=browser "cat /etc/firejail/nolocal.net | /sbin/iptables-restore"

# verify netfilter configuration
$ sudo firejail --join-network=browser "/sbin/iptables -vL"

# verify and change IP addresses
$ sudo firejail --join-network=browser ifconfig
Switching to pid 1604, the first child process inside the sandbox
eth0-1603 Link encap:Ethernet  HWaddr 26:5a:88:89:86:6c  
          inet addr:192.168.1.163  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::245a:88ff:fe89:866c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1945 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1829 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1849883 (1.7 MiB)  TX bytes:217050 (211.9 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
$ sudo firejail --join-network=browser "ifconfig eth0-1603 192.168.1.180"

[nick75e]

It works, thanks! But there's something weird. I tried ifconfig and it gives me an ipv6 address even though I have added these lines to /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

and protocol doesn't contain inet6. Does that mean I still have a ipv6 connection in any way?

[NoAgendaIT]

First you might want to verify if those settings are still active by running sysctl net.ipv6.conf.all.disable_ipv6 net.ipv6.conf.default.disable_ipv6 net.ipv6.conf.lo.disable_ipv6 because some network managers (and dhcp clients) just set these back to 0. sysctl.conf is normally only read once: at boot time.

Did you try ifconfig inside the jail or on the host? And the address, is it an address that starts with fe80:? And if so, does the other end of the veth pair (the one on the host with a name like veth1234eth0) also have an fe80:: address?

What do you mean with "protocol doesn't contain inet6"?

To answer your question of "does it mean you have an IPv6 connection in any way" the honest answer is yes, at least partially, iff both endpoints have that fe80 address. I'll briefly try to explain.

What I mean is, the fe80: address you see is called a link local address. It is not routed, meaning that the address is only reachable by "the other end". (virtual or physical). I was tempted to explain more about what the address is used for among other things, but I deleted all of that, figuring it's better to keep it at this rather than go into all kinds of scenarios. Instead I'd like to advice you, in order to be sure whether ipv6 traffic is flowing across, to play around with tcpdump, and see if you can capture such traffic for yourself.

[nick75e]

I've just checked and sysctl net.ipv6.conf.*.disable_ipv6 = 1 ifconfig was inside a jail.

What do you mean with "protocol doesn't contain inet6"?

I never use inet6 with protocol

Since I use openvpn, I was worried about ipv6 leaking. Then I remembered that it was inside a bridge and my system doesn't support ipv6 so there's probably no risks but I still created a netfilter6 config file blocking everything. Better be safe than sorry!

[netblue30]

I still have to look into it. I think that net.ipv6.conf entries are per-namespace. It could be possible to totally disable ipv6 or ipv4 as requested in --protocol command.

[chiraag-nataraj]

@nick75e Is this still an issue?

[nick75e]

yes, I still get an IPv6 address. Linux Mint 19, firejail 0.9.54

[chiraag-nataraj]

Hmm, this is definitely not ideal. Inside the jail (firejail --noprofile --net=wlp60s0 --protocol=inet,netlink,unix), sysctl net.ipv6.conf.all.disable_ipv6 returns 0, suggesting firejail (or whatever it calls) is resetting that somehow during its network setup. This does not happen when --net= is not used.

[smitsohu]

Some sysctl settings are per network namespace, net.ipv4.tcp_syncookies is affected as well.