Runtime Linux Capabilities - running DSVPN as a fly app

Hi,

I am attempting to run dead simple vpn (GitHub - jedisct1/dsvpn: A Dead Simple VPN.) on fly using this repo:
GitHub - briceburg/weepn: Dead Simple VPN on Fly.io

While this works fine locally in a privileged container (via the docker run --privileged flag) I am having issues with the application on Fly. Specifically it’s complaining about iptables;

2021-04-16T04:16:37Z [info] Perhaps iptables or your kernel needs to be upgraded.
2021-04-16T04:16:37Z [info] iptables v1.8.6 (legacy): can't initialize iptables table `raw': Table does not exist (do you need to insmod?)

Does the fly.toml let us set different Linux capabilities? such as NET_ADMIN?

Perhaps this may be an environment thing… as the container already appears relatively privileged in its own firecracker? environment (considering the app was able to successfully sysctl set net.ipv4.ip_forward = 1)… and host iptables simply doesn’t have raw table support??

This is my first app on fly. so far, very awesome!

Thanks,

~ Brice

A VM should have all the privilege it wants. Except for some restrictions to protect our hosts, everything should be possible within the VM, as root.

This might be happening because even though our kernels are compiled with the proper config, the ip_tables modules aren’t loaded at boot.

In fact, no modules are provided with our kernels. We’re only running the kernel binary. Perhaps we need to consider mounting compiled modules read-only in every instance.

Docker images also don’t usually include utilities like insmod or lsmod or modprobe, because the kernel is usually shared with Docker. In our case, each VM has its own kernel and is independent from our hosts.

@briceburg I have compiled and deployed our kernel with CONFIG_IP_NF_RAW=y and you can now use the raw table with iptables.

Please deploy again to get the new kernel :slight_smile:

Let me know how it goes!

1 Like

@jerome – absolutely amazing. I can confirm DSVPN is now swimmingly working on the platform! I can’t thank you enough… really. it’s a giant breath of fresh air coming from aws-style support to fly and is a friendly reminder of how things once were and can still be! :heart:
~ Brice

1 Like

Happy to help!