Configure a virtual network device so 1 computer has 2 IP's [solved]

[mwshook]

Due to a somewhat complex router/port forwarding/VPN situation I want some apps on my Tara desktop to run on one IP address (behind a VPN) and other apps to run on a different IP address without a VPN.

I found a way running VirtualBox. I made virtual machine using a basic command-line-only Debian install. I configured it so the virtual machine gets its own IP address on the router. (I'm not really sure how that works.) I can then run openvpn and the appropriate apps on the virtual machine.

It works pretty well but is a bit clunky to use. I was wondering if there was a more elegant way to set this up without a virtual machine. Is it possible to set up a virtual ethernet interface to work off a second IP, and configure a specific user or list of apps that use that interface?

If I'm better off sticking to my VirtualBox solution, I will stick to that.

[sgtor]

I'm not sure if this is what you want but you could use the VPN on your actual computer instead and run the virtualbox without a VPN.

The way that works is if the VM network card is setup for NAT it will go through the VPN on your machine. If you set the VM card as a bridge instead it will get the IP from the router using DHCP and will not run within the VPN at all.

You can set it up and check that it worked correctly by running ifconfig on your machine and the VM to see the IP addresses.

[mwshook]

After looking around I think VirtualBox is the best solution as it can give me that separate IP address for certain applications without too much headache. I did some reading and got headless VirtualBox running on a TTY. The System Monitor tells me Virtualbox with CLI-only Debian is using less than 30 megs of RAM! I'll mark this solved.

[sgtor]

yeah I was actually thinking about this one in the back of my head and staying with the VM is probably your least difficult way of doing it.

I have some theories but nothing I've tested myself so I don't know how much of a pain it would be to implement. It would involve having two network cards installed into the computer, then you would have to mess with your routing tables to make the 2nd card connect directly to the router potentially messing up the security of the VPN if you don't do it right. Then from there you would need some proxy software that would use the 2nd card, plus it would only work for programs that have settings to use a proxy.

I actually don't think there is a way with one network card other than using the VM.

The only reason I'm telling you all this since you're willing to use the VM is because it was in the back of my head. lol Someone with more knowledge than me might have a different way but again it seems a moot point since you're good with the VM. I guess you had a good question because you had me thinking about it for a while even after I posted my idea of solution.

[mwshook]

A "virtual network card" is probably possible. But a "virtual machine" is far more versatile. So there's probably not a good reason to develop the virtual network card. If someone seriously needed the capability, I assume they would install an extra physical network card. I'm just a home user mucking about, trying to run various services on my home desktop.

[sgtor]

Actually now that you mention it I do remember reading about Virtual Network Cards but it didn't even occur to me to use that method. About all I know about them is that it can be done. I have no idea how to implement them. I might look into it for fun

[redlined]

hi guys!

I think what you're looking for can be found by implementing a(nother) TUN or TAP adapter as it is a virtual network adapter. I'm not sure how to configure it for more than one instance (e.g. VPN usually makes use of TUN adapter then tells system that is the only way to reach the internets).

I suspect some good level of both routes and scripting knowledge would help sort this, but to divide certain apps to use this VPN TUN or this straight-thru adapter seems very difficult unless the app itself has support for proxy settings internal (not a call to system proxy if set) or some level of separation required to isolate apps needing something other than whole system (as it is with VMs). Even with internal proxy support if it is not socks5 proxy supported then system DNS will be used so IPs accessed either need to be hardcoded in (or resolved via hosts file, etc) or use a local DNS service (bind, unbound, dnscrypt-proxy, etc) to keep that VPN level of integrity involved.

Side note, OpenVPN can be configured to use a proxy, instead of controlling all connected access for system, you'd then point apps you want VPN'd at the proxy. I'd have to search for how this is setup but do recall doing it some years back when trying many different ways to encrypt transports and tunnels.

[FreedomTruth]

NOT an answer to your question specifically, but a somewhat related matter: You can have multiple IP addresses assigned to a physical device, i.e.

Code: Select all

ifconfig eth0 192.168.1.2
ifconfig eth0:1 192.168.2.2
ifconfig eth0:2 192.168.3.1

This can be useful for specific software (postfix and apache, for instance, can be bound to a particular IP address, so one can run separate domains on different addresses, for example).
But, with VPN I don't know what happens. Specifically, I don't know how you'd configure each application to use a specific network interface -- I'm sure the VM solution you are already using is probably the easiest

[redlined]

another good option, but even as I reread my initial response I see it is much harder to setup and run right versus the vm, especially stipped like mentioned, to ensure isolation and control vice assign multiple IP, or proxify/socksify and trust the app outside containment like that.

If geoblocking, even the bigs like amzn/ntflx I'd raise note with VPN provider, they need find the work around for blocks as a service, or lower price and say for only cutting ISP out from the picture of your online time(s) and keeping them trustworthy in the overall. Best to use the VM, that way discipline is on you for maintain and run proper and that should be simple enough although I don't use vm nor wine, tried them and didn't care much for the short experience.