[GH-ISSUE #230] Feature request: Integrated network namespace support (awgnetns --up/down, awgrun) #135

New issue

Open

opened 2026-10-13 21:06:52 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:06:52 +00:00

Owner

Originally created by @Vas-Sferd on GitHub (Sep 2, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/230

Is your feature request related to a problem? Please describe.
Currently, Amnezia‑WG can be used inside a linux network namespace, but this requires a series of manual steps (creating the namespace, moving the interface, configuring IP and routes, etc.) as described in the WireGuard netns documentation.
This works, but it is tedious, error‑prone, and not integrated with the typical awg-quick workflow.
Also, using awg-quick inside the main namespace modifies iptables and adds unnecessary complexity.

Describe the solution you'd like
I propose adding a dedicated set of tools that make namespace usage seamless like in Android, without touching the host’s iptables and without requiring veth pairs for new netns.

Specifically, I would like to see:

awgnetns-up <awgnetns config name> and awgnetns-down <awgnetns config name>
- These commands would:
  - Create a new network namespace (or use an existing one if specified in awgnetns config).
  - Create the Amnezia‑WG interface in the init namespace, then move it into the target namespace (as described in the WireGuard netns guide). (If it possible to add integrate veth-like possibility to amneziawg without moving interface it could be more clear solution)
  - Configure the interface (IP, private key, peers, etc.) from the config file.
  - Bring the interface up and set the default route via the WG interface inside the namespace.
Unit file generation (e.g., awgnetns --gen-unit <awgnetns config name>)
- This would generate systemd service files (or similar) to automatically start/stop the namespace‑based VPN at boot or on demand.
awgrun <command> [args...]
- This command would run the given program inside the namespace that corresponds to a given config (or the default one).
- It should not require sudo – instead, it would check that the user belongs to a dedicated group (e.g., awgns) and use a setuid‑enabled binary (similar to how sudo works) to perform the namespace switch.
- This makes it easy to integrate with .desktop files or launchers – you can simply run awgrun firefox to launch Firefox inside the VPN namespace. It is more like amnezia-wg for android solution where you can easy specify which app use or even see vpn tunnel or not.

Why this is better

No iptables rules are added to the main network namespace – all traffic stays isolated.
No veth pair is needed – the Amnezia‑WG interface(s) itself acts as the only network device inside the namespace, while the encrypted UDP socket remains in the host namespace (as described in the WireGuard netns design).
Cleaner, more secure isolation for applications that must go through VPN.
The programs that dont like vpn interfaces dont see this interfaces.

Originally created by @Vas-Sferd on GitHub (Sep 2, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/issues/230 **Is your feature request related to a problem? Please describe.** Currently, Amnezia‑WG can be used inside a linux network namespace, but this requires a series of manual steps (creating the namespace, moving the interface, configuring IP and routes, etc.) as described in the [WireGuard netns documentation](https://www.wireguard.com/netns/). This works, but it is tedious, error‑prone, and not integrated with the typical `awg-quick` workflow. Also, using `awg-quick` inside the main namespace modifies iptables and adds unnecessary complexity. **Describe the solution you'd like** I propose adding a dedicated set of tools that make namespace usage seamless like in Android, without touching the host’s iptables and without requiring veth pairs for new netns. Specifically, I would like to see: 1. **`awgnetns-up <awgnetns config name>`** and **`awgnetns-down <awgnetns config name>`** - These commands would: - Create a new network namespace (or use an existing one if specified in awgnetns config). - Create the Amnezia‑WG interface in the *init* namespace, then move it into the target namespace (as described in the WireGuard netns guide). (If it possible to add integrate veth-like possibility to amneziawg without moving interface it could be more clear solution) - Configure the interface (IP, private key, peers, etc.) from the config file. - Bring the interface up and set the default route via the WG interface inside the namespace. 2. **Unit file generation** (e.g., `awgnetns --gen-unit <awgnetns config name>`) - This would generate systemd service files (or similar) to automatically start/stop the namespace‑based VPN at boot or on demand. 3. **`awgrun <command> [args...]`** - This command would run the given program **inside the namespace** that corresponds to a given config (or the default one). - It should **not require `sudo`** – instead, it would check that the user belongs to a dedicated group (e.g., `awgns`) and use a setuid‑enabled binary (similar to how `sudo` works) to perform the namespace switch. - This makes it easy to integrate with `.desktop` files or launchers – you can simply run `awgrun firefox` to launch Firefox inside the VPN namespace. It is more like amnezia-wg for android solution where you can easy specify which app use or even see vpn tunnel or not. **Why this is better** - No iptables rules are added to the main network namespace – all traffic stays isolated. - No veth pair is needed – the Amnezia‑WG interface(s) itself acts as the only network device inside the namespace, while the encrypted UDP socket remains in the host namespace (as described in the WireGuard netns design). - Cleaner, more secure isolation for applications that must go through VPN. - The programs that dont like vpn interfaces dont see this interfaces.

bsakaguchi referenced this issue

2026-10-13 21:07:34 +00:00

[PR #135] Fix dkms.conf #201