RobOS VPN Sandbox & VPN Servers: Per-App Linux Network Namespaces and a Live Kernel Kill-Switch Proof
Two new desktop apps—RobOS VPN Servers (packages/vpn-servers) and RobOS VPN Sandbox (packages/vpn-sandbox)—let you launch individual desktop or CLI applications (such as Firefox, Transmission, or curl) inside an isolated Linux network namespace (ip netns) routed exclusively through OpenVPN (with all 3,598 official IPVanish server profiles bundled out of the box). An automated 5-step fault-injection proof kills the OpenVPN daemon mid-flight and verifies at the kernel packet counter level that zero bytes ever fall back to your normal public IP.
216.131.74.203) while the host's normal public IP (105.42.88.19) is blocked, and the top banner reports the live 5-step mid-session OpenVPN drop proof.3,598 IPVanish profiles and GPG-encrypted credentials. RobOS VPN Servers bundles the complete IPVanish `.ovpn` server catalog (packages/robos-lib/assets/ipvanish-configs.tar.xz), pre-sanitized for OpenVPN 2.6/2.7 compatibility by stripping deprecated keysize directives and negotiating AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC. Account passwords are encrypted in pass (robos/ovpn/<provider>/<account>) with an automatic AES-256-GCM local vault fallback, and a one-click Test button performs a live TLS 1.3 handshake to verify PUSH_REPLY and the assigned tunnel IP before launching any app.
robos_vpn_<id>.Three kernel barriers when OpenVPN stops. Unlike OS-wide VPN clients that share the host routing table and fall back to the default gateway when tun0 drops, RobOS VPN Sandbox places each launched app inside its own network namespace (robos_vpn_<id>) as an unprivileged user (uid 1000, setpriv --inh-caps=-net_admin,-net_raw). Inside the namespace, iptables -P OUTPUT DROP and ip6tables -P OUTPUT DROP block all egress except -o tun+; on the virtual Ethernet link (veth_n_<id>), only -m owner --uid-owner 0 (the root OpenVPN daemon) to the exact VPN server IP and port is permitted, followed by -A OUTPUT -o veth_n_<id> -j DROP. On the host side, both the FORWARD chain (ROBOS_VPN_FWD_<id>) and the POSTROUTING MASQUERADE rule are locked strictly to the VPN server IP and port. Namespace-specific /etc/netns/robos_vpn_<id>/resolv.conf and nsswitch.conf (hosts: files dns) paired with openvpn --dns-updown disable ensure DNS queries travel exclusively through tun0 without touching host systemd-resolved.
Proving zero leak on mid-session VPN crash. The new /security/ section debuts with our live 5-phase E2E fault-injection test (tests/e2e/vpn-sandbox-killswitch-proof.test.cjs, also runnable via the Prove Kill-Switch button in the app). It records the host's real public IP (105.42.88.19), verifies the sandboxed app reaches https://api.ipify.org via the IPVanish tunnel IP (216.131.74.203), sends kill -9 to the OpenVPN daemon while leaving robos_vpn_<id> and its veth default route up, fires four egress probes from the unprivileged app (HTTPS, direct TCP to 1.1.1.1:80, direct UDP to 8.8.8.8:53, and direct UDP to the VPN server IP as uid 1000), and verifies via kernel iptables -L OUTPUT -v -n -x counters that 100% of post-drop packets are dropped in the kernel with zero bytes leaked.