add vpn drop-in

_posts/2020-12-03-poking-pi-ii.md

@@ -146,5 +146,19 @@ ExecStartPre=/usr/sbin/ip netns exec default /usr/sbin/iptables -A FORWARD -o ve
 ExecStart=/usr/sbin/ip netns exec default /usr/sbin/iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
 ```
 
+Then use a drop-in to modify the OpenVPN service to use this namespace:
+
+```
+% cat /etc/systemd/system/openvpn-client@.service.d/override.conf
+[Service]
+NetworkNamespacePath=/var/run/netns/vpn
+
+[Unit]
+Requires=netns-vpn.service
+After=netns-vpn.service
+```
+
+This runs all instances of the `openvpn-client` template service in the namespace created by the one-shot service.
+
 [tb-linux]: https://www.tunnelbear.com/blog/linux_support/
 [`veth`]: https://man7.org/linux/man-pages/man4/veth.4.html