Routing between linux namespaces

namespacenetwork-namespacesnetworkingrouting

I have the following network topology using linux namespaces:

.--------.veth0       .--------.veth2       .--------.
| ns_snd |------------| ns_mid |------------| ns_rcv |
'--------'       veth1'--------'       veth3'--------'

veth0: 10.0.0.1/30
veth1: 10.0.0.2/30
veth2: 10.0.0.5/30
veth3: 10.0.0.6/30

veth0 belongs to ns_snd,
veth[1,2] belongs to ns_mid,
veth3 belongs to ns_rcv

The commands are:

S1="veth0"
S2M1="veth1"
M2R1="veth2"
R1="veth3"

NS_SND="ns_snd"
NS_RCV="ns_rcv"
NS_MID="ns_mid"


#Remove existing namespace
sudo ip netns del $NS_SND
sudo ip netns del $NS_RCV
sudo ip netns del $NS_MID

#Remove existing veth pairs
sudo ip link del $S1
sudo ip link del $R1
sudo ip link del $S2M1
sudo ip link del $M2R1

#Create veth pairs
sudo ip link add $S1 type veth peer name $S2M1
sudo ip link add $M2R1 type veth peer name $R1

#Bring up
sudo ip link set dev $S1 up
sudo ip link set dev $S2M1 up
sudo ip link set dev $M2R1 up
sudo ip link set dev $R1 up


#Create the specific namespaces
sudo ip netns add $NS_SND
sudo ip netns add $NS_RCV
sudo ip netns add $NS_MID

#Move the interfaces to the namespace
sudo ip link set $S1 netns $NS_SND
sudo ip link set $S2M1 netns $NS_MID
sudo ip link set $M2R1 netns $NS_MID
sudo ip link set $R1 netns $NS_RCV

#Configure the loopback interface in namespace
sudo ip netns exec $NS_SND ip address add 127.0.0.1/8 dev lo
sudo ip netns exec $NS_SND ip link set dev lo up
sudo ip netns exec $NS_RCV ip address add 127.0.0.1/8 dev lo
sudo ip netns exec $NS_RCV ip link set dev lo up
sudo ip netns exec $NS_MID ip address add 127.0.0.1/8 dev lo
sudo ip netns exec $NS_MID ip link set dev lo up

#add bridge
#sudo ip netns exec $NS_MID brctl addbr br549
#sudo ip netns exec $NS_MID brctl addif br549 $S2M1
#sudo ip netns exec $NS_MID brctl addif br549 $M2R1
#sudo ip netns exec $NS_RCV ip route add 10.0.0.0/30 via 10.0.0.5

#Bring up interface in namespace
sudo ip netns exec $NS_SND ip link set dev $S1 up
sudo ip netns exec $NS_SND ip address add 10.0.0.1/30 dev $S1
sudo ip netns exec $NS_MID ip link set dev $S2M1 up
sudo ip netns exec $NS_MID ip address add 10.0.0.2/30 dev $S2M1
sudo ip netns exec $NS_MID ip link set dev $M2R1 up
sudo ip netns exec $NS_MID ip address add 10.0.0.5/30 dev $M2R1
sudo ip netns exec $NS_RCV ip link set dev $R1 up
sudo ip netns exec $NS_RCV ip address add 10.0.0.6/30 dev $R1

#Add ip routes
sudo ip netns exec $NS_SND ip route add 10.0.0.4/30 via 10.0.0.2
sudo ip netns exec $NS_RCV ip route add 10.0.0.0/30 via 10.0.0.5

#sudo ip netns exec $NS_SND "./scripts/setup_ns_snd.sh"
#sudo ip netns exec $NS_RCV "./scripts/setup_ns_rcv.sh"

Inside ns_snd I can ping 10.0.0.5, but 10.0.0.6 not. What do I need to add or what I have forgotten to add?

Best Answer

The issue is that you're trying to route a packet from namespace ns_snd through ns_mid to ns_rcv. The kernel is going to treat the namespaces as if they were separate hosts. Meaning you have to configure the kernel to act as a router.
This is rather simple to do:

sudo ip netns exec $NS_MID sysctl -w net.ipv4.ip_forward=1

Related Solutions

Creating VLANs between network namespaces

Several things are mixed up:

In your graphic you let the “default namespace” look like a switch, but you configured it to a router.
With a router in the middle, vlan1 and the other vlan1 are different. They don’t share the same LAN, so they can’t be in the same VLAN.
Your vconfig calls will not find veth11 or veth13, because they are not in the default namespace. – You didn’t get any errors!?
veth1 and veth11 are one “pipe”. Why do you assign them different VLAN IDs?
Why don’t you put one end of the pipe in ns1 (you do that), and the other end in ns3 (instead of the default namespace). – You can then route or bridge between them, without even mixing it with ns2 and ns4.
Or in other words: don’t mix everything together in the default namespace, just to split them again later...
You can also do it in the way seen in the diagram, but don’t work with routing or IP addresses (and then VLANS on top!?!): Put two bridges in the default namespace, connect one side of each “pipe” in one of the bridges. – One bridge (this time configured with VLANS) would do it, too. I haven’t checked if the Linux bridge code is VLAN aware,though. It probably is.
Your veth-names are confusing. Why not “eth1a” together with “eth1b” or something similar in a symmetric fashion?
ip obsoletes ifconfig and vconfig

Linux – How to forward traffic between Linux network namespaces

First: I don't think you can achieve this by using 127.0.0.0/8 and/or a loopback interface (like lo). You have to use some other IPs and interfaces, because there are specific things hardwired for 127.0.0.0/8 and for loopback.

Then there is certainly more than one method, but here's an example:

# ip netns add vpn
# ip link add name vethhost0 type veth peer name vethvpn0
# ip link set vethvpn0 netns vpn
# ip addr add 10.0.0.1/24 dev vethhost0
# ip netns exec vpn ip addr add 10.0.0.2/24 dev vethvpn0
# ip link set vethhost0 up
# ip netns exec vpn ip link set vethvpn0 up
# ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.134 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.100 ms

The first command creates out of thin air a pair of virtual ethernet interfaces connected by a virtual ethernet cable. The second command moves one of these interfaces into the netns vpn. Consider it the equivalent of things like socketpair(2) or pipe(2): a process creates a pair, then forks, and each process keeps only one end of the pair and they can communicate.

Usually (LXC, virt-manager,...) there's also a bridge involved to put everything in the same LAN when you have many netns.

Once this is in place, for the host it's like any router. Enable ip forwarding (be more restrictive if you can: you need it at least for vethhost0 and the main interface):

# echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

Add some DNAT rule, like:

# iptables -t nat -A PREROUTING ! -s 10.0.0.0/24 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.2

Now you can either add a default route inside vpn with:

# ip netns exec vpn ip route add default via 10.0.0.1

Or else, instead, add a SNAT rule to have everything be seen as coming from 10.0.0.1 inside vpn.

# iptables -t nat -A POSTROUTING -d 10.0.0.2/24 -j SNAT --to-source 10.0.0.1

With this in place you can test from any other host, but not from the host itself. To do this, also add a DNAT rule similar to the previous DNAT, but in OUTPUT and changed (else any outgoing http connexion would be changed too) to your own IP. Let's say your IP is 192.168.1.2:

# iptables -t nat -A OUTPUT -d 192.168.1.2 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.2

Now it will even work if you connect from the host to itself if you don't use a loopback ip, but any other IP belonging to the host with a nat rule as above. Let's say your IP is 192.168.1.2:

# ip netns exec vpn nc -l -s 10.0.0.2 -p 80 &
[1] 10639
# nc -vz 192.168.1.2 80
nc: myhost (192.168.1.2) 80 [http] open
#
[1]+  Done                    ip netns exec vpn nc -l -s 10.0.0.2 -p 80

Best Answer

Related Solutions

Creating VLANs between network namespaces

Linux – How to forward traffic between Linux network namespaces

Related Question