A brief introduction to the Linux Network Namespace

1. Network namespaceNetwork namespace
Marian HackMan Marinov <mm@1h.com>

2. What it is?What it is?
The most simple answer is:
new network stack for your process

3. What it is?What it is?
The most simple answer is:
new network stack for your process
Linux has one network stack... but with
network namespaces it can spawn many
instances of the same network code.

4. How it works?How it works?
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
eth0eth0
firewall:firewall:
iptables -L -nviptables -L -nv

5. How it works?How it works?
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
eth0eth0
firewall:firewall:
iptables -L -nviptables -L -nv
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
vlan1vlan1
firewall:firewall:
iptables -L -nviptables -L -nv
# ip netns add babylon5# ip netns add babylon5

6. How it works?How it works?
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
eth0eth0
firewall:firewall:
iptables -L -nviptables -L -nv
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
eth0eth0
firewall:firewall:
iptables -L -nviptables -L -nv
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
vlan3vlan3
firewall:firewall:
iptables -L -nviptables -L -nv
# ip netns add babylon5# ip netns add babylon5
# ip netns add stargate# ip netns add stargate

7. How it works?How it works?
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
eth0eth0
firewall:firewall:
iptables -L -nviptables -L -nv
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
eth0eth0
firewall:firewall:
iptables -L -nviptables -L -nv
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
vlan3vlan3
firewall:firewall:
iptables -L -nviptables -L -nv
# ip netns list# ip netns list
babylon5babylon5
stargatestargate

8. How to enter in netns?How to enter in netns?
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
eth0eth0
firewall:firewall:
iptables -L -nviptables -L -nv
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
eth0eth0
firewall:firewall:
iptables -L -nviptables -L -nv
Linux Network StackLinux Network Stack
devices:devices: routing:routing:
lolo ip r lip r l
vlan3vlan3
firewall:firewall:
iptables -L -nviptables -L -nv
# ip netns exec stargate # ip netns exec stargate
bashbash
bash-4.3#bash-4.3#
WhatWhat
happened?happened?

9. How to enter in netns?How to enter in netns?
root@terion:~# ip -0 a lroot@terion:~# ip -0 a l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 655361: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: wwan0: <BROADCAST,MULTICAST> mtu 15002: wwan0: <BROADCAST,MULTICAST> mtu 1500
link/ether 02:80:37:ec:02:00 brd ff:ff:ff:ff:ff:fflink/ether 02:80:37:ec:02:00 brd ff:ff:ff:ff:ff:ff
3: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP>3: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP>
mtu 1500mtu 1500
link/ether f0:de:f1:81:0a:2a brd ff:ff:ff:ff:ff:fflink/ether f0:de:f1:81:0a:2a brd ff:ff:ff:ff:ff:ff
4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP>4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP>
mtu 1500mtu 1500
link/ether 08:11:96:03:b2:28 brd ff:ff:ff:ff:ff:fflink/ether 08:11:96:03:b2:28 brd ff:ff:ff:ff:ff:ff
root@terion:~# ip netns exec stargate bashroot@terion:~# ip netns exec stargate bash
bash-4.3# ip -0 a lbash-4.3# ip -0 a l
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

10. Moving devices?Moving devices?
root@terion:~# ip link set dev eth0 netns stargateroot@terion:~# ip link set dev eth0 netns stargate
root@terion:~# ip netns exec stargate bashroot@terion:~# ip netns exec stargate bash
bash-4.3# ip -0 a lbash-4.3# ip -0 a l
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN
group default qlen 1group default qlen 1
link/loopback 00:00:00:00:00:00 brdlink/loopback 00:00:00:00:00:00 brd
00:00:00:00:00:0000:00:00:00:00:00
3: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc3: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc
noop state DOWN group default qlen 1000noop state DOWN group default qlen 1000
link/ether f0:de:f1:81:0a:2a brd ff:ff:ff:ff:ff:fflink/ether f0:de:f1:81:0a:2a brd ff:ff:ff:ff:ff:ff

11. Connect themConnect them
Create veth pair devices:Create veth pair devices:
# ip link add veth0 type veth peer name veth1# ip link add veth0 type veth peer name veth1
Add veth1 to stargate network namespaceAdd veth1 to stargate network namespace
# ip link set veth1 netns stargate# ip link set veth1 netns stargate
Add veth0 to babylon5 network namespace AS eth0Add veth0 to babylon5 network namespace AS eth0
# ip link set veth0 netns babylon5# ip link set veth0 netns babylon5 name eth0name eth0

12. Connect themConnect them
# ip netns exec stargate bash# ip netns exec stargate bash
bash-4.3# ip lbash-4.3# ip l
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
11: veth1@if12: <BROADCAST,MULTICAST> mtu 150011: veth1@if12: <BROADCAST,MULTICAST> mtu 1500
qdisc noop state DOWNqdisc noop state DOWN
link/ether f2:19:34:1d:e2:dd brd ff:ff:ff:ff:ff:fflink/ether f2:19:34:1d:e2:dd brd ff:ff:ff:ff:ff:ff

13. Connect themConnect them
root@terion:~# ip netns exec babylon5 bashroot@terion:~# ip netns exec babylon5 bash
bash-4.3# ip lbash-4.3# ip l
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
12: eth0@if11: <BROADCAST,MULTICAST> mtu 150012: eth0@if11: <BROADCAST,MULTICAST> mtu 1500
qdisc noop state DOWNqdisc noop state DOWN
link/ether 6a:82:05:98:f2:c2 brd ff:ff:ff:ff:ff:fflink/ether 6a:82:05:98:f2:c2 brd ff:ff:ff:ff:ff:ff

14. Read the help :)Read the help :)
root@terion:~# ip netns helproot@terion:~# ip netns help
Usage: ip netns listUsage: ip netns list
ip netns add NAMEip netns add NAME
ip netns delete NAMEip netns delete NAME
ip netns identify [PID]ip netns identify [PID]
ip netns pids NAMEip netns pids NAME
ip netns exec NAME cmd ...ip netns exec NAME cmd ...
ip netns monitorip netns monitor

15. Thank YouThank You
IRC: irc.freenode.net hackman
ICQ: 7556201
Jabber: hackman@jabber.com
E-Mail: mm@1h.com