<div dir="ltr"><div dir="ltr"><div>Thanks for your answer, Robert.</div><div><br></div><div>>
Wait, is the "normal" link interface also available in the namespace?</div>> If yes, can you show the configuration file used for Squid? Are you sure<br>> you're binding Squid correctly so that it is reachable over the<br>> Wireguard interface, or that it sends its responses over the Wireguard<br><div>> interface?<span class="gmail-im"></span></div><div><br></div><div>Nope. That namespace only olds the VPN interface. I'm exploiting this neat trick for Wireguard: <a href="https://www.wireguard.com/netns/#the-new-namespace-solution">https://www.wireguard.com/netns/#the-new-namespace-solution</a>, where you first create the wg0 interface in the "normal / physical namespace", then you move it into the dedicated one and things work :)</div><div><br></div><div>> That doesn't necessarily mean that it runs in the wrong namespace, if<br>> the "standard" link is available in the namespace, it might "just" be<br>> binding to the wrong interface. For example `tcp_outgoing_address` are<br>> configurations regarding that behavior. </div><div><br></div><div>Well, sudo `ip netns pids vpn` (`vpn` is the namespace name) doesn't show any squid related PID, while it does show the PID of the tinyproxy process. The PID in the squid log below (`Squid Parent: (squid-1) process 107287 started`) is not returned by the `ip netns pids vpn` command.</div><div>I think it's related on how squid forks or something...</div><div><br></div><div><span class="gmail-im">>> I'd like to run squid inside this network namespace.</span></div><div>> Can you show the service file you're using for Squid?<span class="gmail-im"><br></span></div><div><span class="gmail-im"><br></span></div><div><span class="gmail-im"></span>❯ systemctl cat squid<br># /usr/lib/systemd/system/squid.service<br>## Copyright (C) 1996-2025 The Squid Software Foundation and contributors<br>##<br>## Squid software is distributed under GPLv2+ license and includes<br>## contributions from numerous individuals and organizations.<br>## Please see the COPYING and CONTRIBUTORS files for details.<br>##<br><br>[Unit]<br>Description=Squid Web Proxy Server<br>Documentation=man:squid(8)<br>After=local-fs.target network.target network-online.target nss-lookup.target<br><br>[Service]<br>Type=notify<br>PIDFile=/run/squid.pid<br>ExecStartPre=/usr/sbin/squid --foreground -z<br>ExecStart=/usr/sbin/squid --foreground -sYC<br>ExecReload=/bin/kill -HUP $MAINPID<br>KillMode=mixed<br>NotifyAccess=all<br><br>[Install]<br>WantedBy=multi-user.target<br><br># /etc/systemd/system/squid.service.d/override.conf<br>[Service]<br>NetworkNamespacePath=/run/netns/vpn<br>BindReadOnlyPaths=/etc/netns/vpn/resolv.conf:/etc/resolv.conf:norbind<br><br><br>[Unit]<br>After=vpn.service<br>BindsTo=vpn.service</div><div><br></div><div><br></div><div>❯ cat /etc/squid/squid.conf<br>acl SSL_ports port 443<br>acl Safe_ports port 80<br><br>http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br><br>http_access allow localhost manager<br>http_access deny manager<br><br>http_access allow localhost<br><br># The two deny rules below are unnecessary in this default configuration<br># because they are followed by a "deny all" rule. However, they may become<br># critically important when you start allowing external requests below them.<br><br># Protect web applications running on the same server as Squid. They often<br># assume that only local users can access them at "localhost" ports.<br>http_access deny to_localhost<br><br># Protect cloud servers that provide local users with sensitive info about<br># their server via certain well-known link-local (a.k.a. APIPA) addresses.<br>http_access deny to_linklocal<br><br># And finally deny all other access to this proxy<br>http_access deny all<br><br>http_port 3129<br><br>cache deny all<br>coredump_dir /var/cache/squid<br><br>access_log stdio:/dev/null</div><div><br></div><div><br></div><div>
<span class="gmail-im"></span>❯ journalctl -b -u squid -e</div><div>Jan 04 23:43:17 gagazet systemd[1]: Starting Squid Web Proxy Server...<br>Jan 04 23:43:17 gagazet squid[107280]: 2026/01/04 23:43:17| Processing Configuration File: /etc/squid/squid.conf (depth 0)<br>Jan 04 23:43:17 gagazet squid[107280]: 2026/01/04 23:43:17| Created PID file (/run/squid.pid)<br>Jan 04 23:43:17 gagazet squid[107280]: Squid Parent: will start 1 kids<br>Jan 04 23:43:17 gagazet squid[107280]: Squid Parent: (squid-1) process 107282 started<br>Jan 04 23:43:17 gagazet squid[107282]: 2026/01/04 23:43:17 kid1| Processing Configuration File: /etc/squid/squid.conf (depth 0)<br>Jan 04 23:43:17 gagazet squid[107282]: 2026/01/04 23:43:17 kid1| Set Current Directory to /var/cache/squid<br>Jan 04 23:43:17 gagazet squid[107282]: 2026/01/04 23:43:17 kid1| Creating missing swap directories<br>Jan 04 23:43:17 gagazet squid[107282]: 2026/01/04 23:43:17 kid1| No cache_dir stores are configured.<br>Jan 04 23:43:17 gagazet squid[107280]: Squid Parent: squid-1 process 107282 exited with status 0<br>Jan 04 23:43:17 gagazet squid[107280]: 2026/01/04 23:43:17| Removing PID file (/run/squid.pid)<br>Jan 04 23:43:17 gagazet squid[107283]: Processing Configuration File: /etc/squid/squid.conf (depth 0)<br>Jan 04 23:43:17 gagazet squid[107283]: Created PID file (/run/squid.pid)<br>Jan 04 23:43:17 gagazet squid[107283]: Squid Parent: will start 1 kids<br>Jan 04 23:43:17 gagazet squid[107283]: Squid Parent: (squid-1) process 107287 started<br>Jan 04 23:43:17 gagazet squid[107287]: Processing Configuration File: /etc/squid/squid.conf (depth 0)<br>Jan 04 23:43:17 gagazet squid[107287]: Set Current Directory to /var/cache/squid<br>Jan 04 23:43:17 gagazet squid[107287]: Starting Squid Cache version 7.3 for x86_64-pc-linux-gnu...<br>Jan 04 23:43:17 gagazet squid[107287]: Service Name: squid<br>Jan 04 23:43:17 gagazet squid[107287]: Process ID 107287<br>Jan 04 23:43:17 gagazet squid[107287]: Process Roles: worker<br>Jan 04 23:43:17 gagazet squid[107287]: With 1024 file descriptors available<br>Jan 04 23:43:17 gagazet squid[107287]: Initializing IP Cache...<br>Jan 04 23:43:17 gagazet squid[107287]: DNS IPv6 socket created at [::], FD 7<br>Jan 04 23:43:17 gagazet squid[107287]: DNS IPv4 socket created at 0.0.0.0, FD 8<br>Jan 04 23:43:17 gagazet squid[107287]: Adding nameserver 10.128.0.1 from /etc/resolv.conf<br>Jan 04 23:43:17 gagazet squid[107287]: Adding nameserver fd7d:76ee:e68f:a993::1 from /etc/resolv.conf<br>Jan 04 23:43:17 gagazet squid[107287]: Logfile: opening log stdio:/dev/null<br>Jan 04 23:43:17 gagazet squid[107287]: Local cache digest enabled; rebuild/rewrite every 3600/3600 sec<br>Jan 04 23:43:17 gagazet squid[107287]: Store logging disabled<br>Jan 04 23:43:17 gagazet squid[107287]: Swap maxSize 0 + 262144 KB, estimated 20164 objects<br>Jan 04 23:43:17 gagazet squid[107287]: Target number of buckets: 1008<br>Jan 04 23:43:17 gagazet squid[107287]: Using 8192 Store buckets<br>Jan 04 23:43:17 gagazet squid[107287]: Max Mem size: 262144 KB<br>Jan 04 23:43:17 gagazet squid[107287]: Max Swap size: 0 KB<br>Jan 04 23:43:17 gagazet squid[107287]: Using Least Load store dir selection<br>Jan 04 23:43:17 gagazet squid[107287]: Set Current Directory to /var/cache/squid<br>Jan 04 23:43:17 gagazet squid[107287]: Finished loading MIME types and icons.<br>Jan 04 23:43:17 gagazet squid[107287]: HTCP Disabled.<br>Jan 04 23:43:17 gagazet squid[107287]: Squid plugin modules loaded: 0<br>Jan 04 23:43:17 gagazet squid[107287]: Adaptation support is off.<br>Jan 04 23:43:17 gagazet squid[107287]: Accepting HTTP Socket connections at conn3 local=[::]:3129 remote=[::] FD 10 flags=9<br> listening port: 3129<br>Jan 04 23:43:17 gagazet systemd[1]: Started Squid Web Proxy Server.</div><div><br></div><div><span class="gmail-im"></span></div>
</div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Sun, Jan 4, 2026 at 4:35 PM Robert 'Bobby' Zenz <<a href="mailto:Robert.Zenz@bonsaimind.org">Robert.Zenz@bonsaimind.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> I have a network namespace which runs a Wireguard VPN (only).<br>
> <br>
> ``<br>
> ❯ ip l<br>
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN<br>
> mode DEFAULT group default qlen 1000<br>
> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00<br>
> 3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state<br>
> UNKNOWN mode DEFAULT group default qlen 1000<br>
> link/none`<br>
> ```<br>
<br>
Wait, is the "normal" link interface also available in the namespace?<br>
If yes, can you show the configuration file used for Squid? Are you sure<br>
you're binding Squid correctly so that it is reachable over the<br>
Wireguard interface, or that it sends its responses over the Wireguard<br>
interface?<br>
<br>
> But if I do the same with the systemd unit of squid, it doesn't work.<br>
> The proxy process still runs within the standard namespace (if I curl<br>
> using the proxy, the IP is the one of the standard namespace)<br>
<br>
That doesn't necessarily mean that it runs in the wrong namespace, if<br>
the "standard" link is available in the namespace, it might "just" be<br>
binding to the wrong interface. For example `tcp_outgoing_address` are<br>
configurations regarding that behavior.<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="https://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">https://lists.squid-cache.org/listinfo/squid-users</a><br>
</blockquote></div><div><br clear="all"></div><br><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><span style="font-family:monospace"> ..<br> /**\<br> /****\ <br> /\****/\<br> / \**/ \<br> / \/ \<br> / /\ /\<br> / \ / \ / \<br> / \ / \/ \<br> \ /\ /\ /<br> \ / \ / \ /<br> \/ \/ \/<br> /\ <br> / +\<br> \+ /<br> \/<br> <a href="http://rdb.is" target="_blank">rdb.is</a><br> Book a meeting with me:<br> <a href="https://calendly.com/rdbisme" target="_blank">https://calendly.com/rdbisme</a><br><br><br></span></div></div></div>