Using PrivateNetwork seems to break on systemd 253.5

[aragilar]

On the latest systemd in Debian, the [email protected] unit stopped working until I removed https://github.com/Jamesits/systemd-named-netns/blob/master/services/netns%40.service#L15. I suspect there's some changes to what security settings are used which are implied by PrivateNetwork.

The most obvious change (and the way I spotted this) was the associated file in /run/netns stopped being read-only, and instead had no permissions.

[Jamesits]

Yes, and I almost forgot that I had the answer somehow...

See systemd/systemd#2741 (comment)

[stevo1977]

First of all, this namespace setup has been working flawlessly for me for years, so thank you!

I recently upgraded to systemd 254 and netns-nat@ovpn failed on a dependency job. I tried @aragilar 's fix above (changing the PrivateNetwork to no), which got rid of the mount/dependency problem, but the service is still failing to start. I've attached the contents of journalctl -xeu [email protected]. Any idea what is still causing an issue?
ovpn_fail.txt

[Jamesits]

@stevo1977

> ip route add default via 100.64.0.1 dev veth1 onlink
Error: Nexthop has invalid gateway.

This line failed; I'm not sure why, maybe 100.64.0.1 is used elsewhere on your system?

[stevo1977]

@Jamesits , thank you for having a look.

It looks like that assignment comes from lines 42-45 in netnsinit, as a part of autoconfigure_tunnel_up_inside():

	# setup default route
	if [ ! -z "${GATEWAY}" ]; then
		ip route add default via ${GATEWAY%%/*} dev ${DEVNAME_INSIDE} onlink
	fi

but I'm not sure where the variable GATEWAY comes from, or what the function of %%/* is in bash.

[Jamesits]

@stevo1977

%%/* means remove everything after (incl.) the character /. GATEWAY comes from the configuration file (/etc/default/...).

[stevo1977]

@Jamesits , ah, very cool.

I tried a few different IP addresses in /etc/default/netns-nat but they all returned the same invalid gateway error. Is there some other conflict there with the new systemd? So weird.