|
Enable nft. Use different nft config for ns0. Host open emails port. ns0
open wireguard and qbt ports. ns0 configure wireguard. host not
configure wiregurad, so also no need ip forwarding sysctl kernel
parameters. ns0 use /etc/netns/ns0/nftables.conf that will bind mount to
ns0.
Host and ns0 both run dnsmasq for dns cache. ns0 dnsmasq I disable dbus
because it will conficts with host dnsmasq dbus. Dnsmasq use dbus for
config cahnge?
I disable systemd-resolved and switch to dnsmasq because
systemd-resolved use dbus for dns query? which is maybe easy for dns
leak, e.g., when systemd-resolved is only running on host, ns0 with
different /etc/resolv.conf still get dns from host open public ip when
run resolvectl query, although drill does not leak.
sye add enabled systemd units
|
