Do you know how to tell Linux to use nameservers within a VRF?
What you mean IPSec/OpenVPN "punch a tunnel through a VRF" ? So the underlay should run via a VRF? source-interface binding does not work?

In T5116#147640, @c-po wrote:

Do you know how to tell Linux to use nameservers within a VRF?
What you mean IPSec/OpenVPN "punch a tunnel through a VRF" ? So the underlay should run via a VRF? source-interface binding does not work?

First, I don't know how to tell applications use a nameserver within a VRF, but maybe you can use dnsmasq to relay DNS server from a VRF to global, it solves problem but not pretty.

Secondly, the underlay network should run via a VRF, source-interface binding doesn't work, I have to change systemd charon service to run in a VRF (ip vrf exec ...), but it's too ugly too, and can't run multiple IPsec tunnel over different VRFs.

I think the only solution is to use network namespaces
https://docs.strongswan.org/docs/5.9/howtos/nameSpaces.html

In T5116#147654, @Viacheslav wrote:

I think the only solution is to use network namespaces
https://docs.strongswan.org/docs/5.9/howtos/nameSpaces.html

Well, use VRF can implement this, but we have to figure out a proper way to start bunch of strongswan in different VRFs.

Because I tried ip vrf exec internet_vrf charon and it worked out, maybe I should say acceptable. But if I doing this, IPsec VPN's source interface have to in one of VRF, not all VRFs.

Out of the blue it seems like "network namespaces" would solve alot of current VRF compatability issues within VyOS:

https://linuxhint.com/use-linux-network-namespace/