#!/bin/bash

attach()
{
  name=${1-vpn}
  if [ $UID -ne 0 ]; then
    exec tmux -L $name attach
  else
    exec ip netns exec $name su -c "exec tmux -L $name new -A" $SUDO_USER
  fi
}

start()
{
  name=${1-vpn}
  addrbase=${2-192.168.99}

  ip link add $name.1 type veth peer name $name.2

  ip addr add $addrbase.1/30 dev $name.1
  ip link set $name.1 up

  iptables -v -t nat -A POSTROUTING -s $addrbase.0/30 -o eth0 -j MASQUERADE

  mkdir -p /etc/netns/$name
  sed /127.0.0.1/d </etc/resolv.conf >/etc/netns/$name/resolv.conf

  ip netns add $name

  ip link set $name.2 netns $name

  ip netns exec $name bash -c "
    ip addr add $addrbase.2/30 dev $name.2
    ip link set $name.2 up
    ip route add default via $addrbase.1
    ip link set lo up"

  attach $1
}

stop()
{
  name=${1-vpn}
  addrbase=$(ip addr show $name.1 |
    sed -n 's/.*inet \([0-9]*\.[0-9]*\.[0-9]*\).*/\1/p')

  ip link del $name.1
  iptables -v -t nat -D POSTROUTING -s $addrbase.0/30 -o eth0 -j MASQUERADE
  ip netns del $name
}

command="$1"
shift

case "$command" in
  "start" | "stop" | "attach")
    "$command" "$@"
    ;;
  *)
    echo "usage: $0 {start | stop | attach} [vpn-name] [vpn-addr-base]"
esac

Quote:

---

Еще там в скрипте опечатка, здесь:

Quote:

---

    name=${1-vpn}
    addrbase=${2-192.168.99}

---

---

Quote:

---

When not performing substring expansion, using the forms documented below, bash tests for a parameter that is unset or null. Omitting the colon results in a test only for a parameter that is unset.

     ${parameter:-word}
     Use Default Values. If parameter is unset or null, the expansion of word is substituted. Otherwise, the value of parameter is substituted.

---

Quote:

---

# на хосте
ip ro add $ipremote dev $devlocal
# в контейнере
ip addr add $ipremote/32 dev $devremote
ip ro add default dev $devremote

---

code:
14:25:55.395093 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 8.8.8.8 tell 192.168.98.2, length 28
14:25:56.397572 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 8.8.8.8 tell 192.168.98.2, length 28
14:25:57.399569 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 8.8.8.8 tell 192.168.98.2, length 28