panda's tech note

Linux Network Namespace

Linux namespace (netns) provides a separation mechanism of network resources. Assuming two network interfaces on Linux without netns depicted below, it is not possible to ping one interface to the other via external network because packets are routed over an internal routing mechanism.

+--------------+
| Host      +------+ 192.168.0.1/24
|           | eth0 |<----+
|           +------+     |
|     Internal ^         |
|      routing |         | External link
|              v         |
|           +------+     |
|           | eth1 |<----+
|           +------+ 192.168.0.2/24
+--------------+

When we would like to test (ping) or measure via physical interfaces rather than the internal routing, we can use netns to isolate two interfaces from the kernel default space as shown in the following figure.

+--------------+
| Host         |
| +- net0 -----------+
| |         +------+ 192.168.0.1/24
| |         | eth0 |<----+
| |         +------+ |   |
| +------------------+   |
|              |         | External link
| +- net1 -----------+   |
| |         +------+ |   |
| |         | eth1 |<----+
| |         +------+ 192.168.0.2/24
| +------------------+
+--------------+

To accomplish this, you can use the following procedure.

  1. Create two namespaces; net0 and net1
# ip netns add net0
# ip netns add net1
  1. Move the devices eth0 and eth1 to the namespaces net0 and net1, respectively.
# ip link set dev eth0 netns net0
# ip link set dev eth1 netns net1
  1. Bring the interfaces up
# ip netns exec net0 ip link set eth0 up
# ip netns exec net1 ip link set eth1 up
  1. Assign an IP address to each interface
# ip netns exec net0 ip a add 192.168.0.1/24 dev eth0
# ip netns exec net1 ip a add 192.168.0.2/24 dev eth1
  1. Finally, you can execute any command in the specified network namespace.
# ip netns exec net1 ping 192.168.0.1