Transfers OpenVPN tunnel interface to a network namespace as its only non-localhost interface.

namespaced-openvpn.sh

#!/usr/bin/env bash

# Transfers VPN tunnel interface to a network namespace as its only
# non-localhost interface.
#
# Based on <https://github.com/slingamn/namespaced-openvpn>.

ip netns add protected
ip netns exec protected ip link set lo up
openvpn "$@" --ifconfig-noexec --route-noexec --script-security 2 \
    --dev tun --dev-type tun --disable-dco \
    --route-up '/bin/sh -c "sudo ip link set $dev netns protected; \
    sudo ip netns exec protected ip link set $dev up; \
    sudo ip netns exec protected ip addr add $ifconfig_local peer $route_vpn_gateway/32 dev $dev; \
    sudo ip netns exec protected ip route add default dev $dev"'